5

I am trying to get ssh to work in cron, and it seems like I have tried all the standard tricks with no luck at all. I can run a non-interactive ssh by using

>./some_script_with_ssh

in bash. It's only when I try to use it in cron that it fails. Any help I could get would be greatly appreciated.

Below are some of the data requested in similar questions:

My user's crontab

PATH = /home/zach/.ssh/:/usr/bin
52 * * * * ssh -vvv my_account@my_remote "touch temp.temp"

Printout from the email cron sent me

OpenSSH_7.3p1 Ubuntu-1, OpenSSL 1.0.2g  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "my_remote" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to my_remote [IP_HERE] port 22.
debug1: Connection established.
debug1: identity file /home/zach/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/zach/.ssh/id_rsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.3p1 Ubuntu-1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.2
debug1: match: OpenSSH_6.2 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to my_remote:22 as 'my_account'
debug3: hostkeys_foreach: reading file "/home/zach/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /home/zach/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from my_remote
debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
debug2: ciphers ctos: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: ciphers stoc: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: MACs ctos: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: MACs stoc: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: ecdh-sha2-nistp256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: aes128-ctr MAC: umac-64-etm@openssh.com compression: none
debug1: kex: client->server cipher: aes128-ctr MAC: umac-64-etm@openssh.com compression: none
debug3: send packet: type 30
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:K8vzLDbyV5JKlcnHsIj6BK/yR4OTJaY4fFuHpsg0FdE
debug3: hostkeys_foreach: reading file "/home/zach/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /home/zach/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from my_remote
debug3: hostkeys_foreach: reading file "/home/zach/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /home/zach/.ssh/known_hosts:2
debug3: load_hostkeys: loaded 1 keys from 128.97.70.146
debug1: Host 'my_remote' is known and matches the ECDSA host key.
debug1: Found key in /home/zach/.ssh/known_hosts:1
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug2: set_newkeys: mode 0
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS received
debug2: key: /home/zach/.ssh/id_rsa (0x55f6f6440f50)
debug3: send packet: type 5
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-with-mic,password,keyboard-interactive
debug3: start over, passed a different list publickey,gssapi-with-mic,password,keyboard-interactive
debug3: preferred publickey,keyboard-interactive
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/zach/.ssh/id_rsa
debug3: send_pubkey_test
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 60
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug2: input_userauth_pk_ok: fp SHA256:jsePXa9FO8c9f0bVwdgvXMJQ2GyHVqz5spaO13EQ0/M
debug3: sign_and_send_pubkey: RSA SHA256:jsePXa9FO8c9f0bVwdgvXMJQ2GyHVqz5spaO13EQ0/M
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug2: no passphrase given, try next key
debug2: we did not send a packet, disable method
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred:
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug3: send packet: type 50
debug2: we sent a keyboard-interactive packet, wait for reply
debug3: receive packet: type 60
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 1
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug3: send packet: type 61
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-with-mic,password,keyboard-interactive
debug2: userauth_kbdint
debug3: send packet: type 50
debug2: we sent a keyboard-interactive packet, wait for reply
debug3: receive packet: type 60
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 1
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug3: send packet: type 61
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-with-mic,password,keyboard-interactive
debug2: userauth_kbdint
debug3: send packet: type 50
debug2: we sent a keyboard-interactive packet, wait for reply
debug3: receive packet: type 60
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 1
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug3: send packet: type 61
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-with-mic,password,keyboard-interactive
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey,gssapi-with-mic,password,keyboard-interactive).

Permissions on local RSA data

>ls -l ~/.ssh/
total 12
-rw------- 1 zach zach 1766 Dec 22 13:47 id_rsa
-rw-r--r-- 1 zach zach  419 Dec  4  2015 id_rsa.pub
-rw-r--r-- 1 zach zach 1332 Dec 21 13:51 known_hosts

Permissions on local home

>ls -l ~/..
total 20
drwx------  2 root root 16384 Jul 17  2015 lost+found
drwx------ 67 zach zach  4096 Dec 22 16:05 zach

Permissions on local ~/.ssh folder

drwx------  2 zach zach    4096 Dec 22 15:11 .ssh

Permissions on remote home

drwx------ 31 my_account       grad      4096 Dec 22 13:57 my_account

Permissions on remote RSA data

> ls -l ~/.ssh/
total 12
-rwx------ 1 my_account grad 419 Dec  4  2015 authorized_keys
-rw------- 1 my_account grad  36 Dec 20 22:45 config
-rw------- 1 my_account grad 223 Sep 10 14:51 known_hosts

Permissions on remote ~/.ssh folder

> ls -l ~
drwx------  2 my_account grad   4096 Dec 20 22:45 .ssh

Local /etc/ssh/ssh_config

host *
    passwordauthentication no
    stricthostkeychecking no
    identityfile ~/.ssh/id_rsa
    sendenv lang lc_*
    hashknownhosts yes

Remote /etc/ssh/ssh_config

> cat /etc/ssh/ssh_config
Host *
    Protocol            2
    ServerAliveInterval     120
    TCPKeepAlive        no
    ConnectTimeout      5
    NoHostAuthenticationForLocalhost    yes
    PreferredAuthentications    gssapi-with-mic,publickey,keyboard-interactive,password
    GSSAPIAuthentication    yes
    SendEnv         "LOGNAME LANG LC_*"
    ForwardX11Trusted       yes

My ssh key is not password protected.

>env | grep SSH
SSH_AGENT_LAUNCHER=gnome-keyring
SSH_AUTH_SOCK=/run/user/1000/keyring/ssh (I am user 1000)

I have also tried to use the -n, -T, -t, and -t -t options for ssh with no noticeable difference.

  • 1
    The issue appears to be described by this message debug1: read_passphrase: can't open /dev/tty: No such device or address and the next line. I have read your statement that the key is not protected by a passphrase, but this looks to be the point at which things go wrong. You appear to be using ubuntu and openssh from March 2016. If I was in this position I would reach for expect to set up an environment where /dev/tty existed. I suspect you can fix this by providing an environment variable SSH_ASKPASS (possibly pointing to /bin/true), but I don't know. Hopefully someone else can help. – icarus Dec 23 '16 at 6:06
  • try -T option (that is if you key are not password protected). – Archemar Dec 23 '16 at 9:18
7
debug1: Offering RSA public key: /home/zach/.ssh/id_rsa
debug3: send_pubkey_test
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 60
debug1: Server accepts key: pkalg ssh-rsa blen 279
debug2: input_userauth_pk_ok: fp SHA256:jsePXa9FO8c9f0bVwdgvXMJQ2GyHVqz5spaO13EQ0/M
debug3: sign_and_send_pubkey: RSA SHA256:jsePXa9FO8c9f0bVwdgvXMJQ2GyHVqz5spaO13EQ0/M
debug1: read_passphrase: can't open /dev/tty: No such device or address
debug2: no passphrase given, try next key

Your key is passphrase protected, but you probably didn't notice, because you are using gnome-keyring which takes care of that. So what are the possibilities:

  • Use separate key, which is not encrypted for cron jobs, becuase you still don't have a reasonable and secure way how to provide passphrase in cron job. This is preferred.

  • If you don't mind storing passphrase in plaintext, use sshpass:

    sshpass -p your_passhprase -vvv my_account@my_remote "touch temp.temp"
    
  • Other possibility is to try to "hijack" the connection to your gnome-keyring (using SSH_AUTH_SOCK environment variable). But note that this might not work always (once you log out of your graphical session, the gnome-keyring will not be running anymore and you will see the failures again:

    SSH_AUTH_SOCK=/run/user/1000/keyring/ssh ssh -vvv my_account@my_remote "touch temp.temp"
    
  • You seem to be right. I ran keygen -p and changed the passphrase to empty, which fixed the problem. I am a little confused about why though. I never have to enter a passphrase when I use this in a shell, so why is it needed when cron runs the command in my name? – Zach Boyd Dec 23 '16 at 14:03
  • because you are using gnome-keyring, which remembers your passphrase. The keyring is started only for you graphical session, not for the crons. – Jakuje Dec 23 '16 at 14:05
  • ^^. Edited the comment. The keyring starts only for graphical session. – Jakuje Dec 23 '16 at 14:06
  • Great--that's what I was missing. Thanks for the great answer! I believe the etiquette is to wait a day or two before accepting the answer, right? – Zach Boyd Dec 23 '16 at 14:07
  • Not necessarily. See the tour or dedicated help article about accepting. If it worked for you and answered your questions, don't hesitate to accept it. If there will appear better one, you can accept the other later. – Jakuje Dec 23 '16 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.