1

when I run follow command as normal user everything works correctly:

fabio@myclient:~$ rsync -rv myserver:~/backup /home/fabio/backup/

It works without any user interaction, but I need to run in a script executed as root so I tried:

root@myclient:~# sudo -u fabio rsync -rv myserver:~/backup /home/fabio/backup/

and also tried:

root@myclient:~# su - fabio -c "rsync -rv myserver:~/backup /home/fabio/backup"

both works but ask me a "passphrase for key", can I avoid it?

  • Could you try to ssh -vvvv to myserver and see which one is the key used for the identification? I tried it right now in my environment and your second command should work fine. – CarCarlo Sep 27 '16 at 21:28
1

The "passphrase for key" is likely coming from SSH not rsync or sudo, which is asking for the passphrase to unlock your private SSH key.

Since I really won't recommend you use a key without a passphrase, consider the circumstances under which the script is run as root. Is the script always run as root sometime after you log in? Are you okay with entering your passphrase once sometime after you log in?

If this is the case, I'd recommend using something like keychain to make sure that the ssh-agent started as your user is used by the script while it's being run as root. You can set this up so that you only have to enter the passphrase once sometime after logging in, and any future invocations require no interaction.

If this is not the case, if the script must be run autonomously without any interactive authentication from you, consider generating a keypair specifically for the backup script, and then restricting what it can do, either by having it authenticate as another user on the remote end (i.e. not fabio, but, for example, fabio-backup), or restricting it with the command= argument in your .authorized_keys file on the remote end (though this is a bit more complicated, as it requires looking at the SSH_ORIGINAL_COMMAND environment variable; see authorized_keys(5) for details)

  • I want sync my personal backups in my PC from server by anacron script, maybe can I run anacron as user fabio ? – Fabio Sep 28 '16 at 8:01
  • That won't help; this isn't a local user permissions problem. The SSH key is encrypted with a passphrase and there's no way to know what the actual private key is until you enter that passphrase. If you don't have to enter your passphrase more than once, it's probably because you're running an SSH agent, which stores the decrypted key in memory after you enter your passphrase. You can try to get the backup script to use that agent, either manually or by using a tool like keychain. – Dylan Frese Sep 28 '16 at 20:07
  • I'd still recommend creating a user specifically for backups on the server, creating an unencrypted keypair specifically for that user, and have the backup script use that keypair. You say that you want to sync your backups from your PC from your server, i.e., you're pulling the backups. I'd also recommend you instead push your backups to your server; it's not good practice to have a remote server able to login to your personal machine, it should always go the other direction. – Dylan Frese Sep 28 '16 at 20:09
1

Your ssh private key is protected by passphrase. When you run it manually as (logged in)user, it uses ssh agent where you stored passphrase keystore once upon a time.

However, when run unattended, this does not happen -- after all, user might not even be logged in (and thus its keystore unavailable). For it to always work, you need to remove passphrase from your ssh private key (via ssh-keygen -p when logged in as user fabio - just press enter for new passphrase and it should be removed).

Minor security note: when private key is not protected by passphrase, anybody who gains access to fabio account, will also be able to ssh as it to other hosts allowing that key, without first needing to sniff passphrase from the user)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.