My SysAdmin is requiring me to use sudo to run a certain script. This script (depending on which subcommand you pass in as an argument) connects to another machine using ssh keys, but this is failing, presumably because it is run as root and not as me.

How can I still use sudo (which my sysadmin requires and which I don't have the power to change) to gain the privileges to run the script, and yet make the command run with access to my ssh keys?


Depending on how sudo has been configured, it may overwrite most environment variables. In particular, it is likely that it overwrites SSH_AUTH_SOCK, and it might overwrite HOME. That's not something you can fix without changing the sudo configuration.

You can see the sudo configuration (and in particular which environment variables are preserved) by running sudo -V as root. It is a feature that you cannot see the configuration as an unprivileged user.

It is possible that your system administrator has locked down your sudo permissions so that the script cannot use your ssh keys. This could be a security policy, and if it is implemented correctly, then by definition you cannot fix it by yourself, you will need your sysadmin to change the configuration.

It's difficult to know what is needed without knowing what the script does and what the sudo configuration is. Perhaps a sudoers line like the following might help (it tells sudo to preserve the SSH_AUTH_SOCK environment variable if the command to run is /path/to/script):

Defaults!/path/to/script env_keep+=SSH_AUTH_SOCK

If the script runs as a user who is neither you nor root, you will have to give that user permission to read your keys or access your agent.


Two things spring to mind. First, edit the script so that only the commands that need elevated privileges are run with sudo. This should allow your ssh connection to work. This has the advantage of running with elevated privileges only those commands that need it. Run the command without sudo on the commandline, relying on the fact the sudo calls in the script will do the right thing.

Second, edit the script so that it explicitly sets the name of the user to connect as. You can use the $SUDO_USER variable, which holds the user name of the user that started the current sudo session. This should do the trick:

ssh "${SUDO_USER}@remotehost.example.com"
  • Perhaps I am guilty of understatement when I use the word "script". It's a pretty large system with lots of files: github.com/drush-ops/drush – iconoclast Oct 5 '12 at 18:58
  • Also, it does allow me to explicitly set the ssh user. But that wouldn't mean it's able to use my ssh keys, would it? – iconoclast Oct 5 '12 at 18:59
  • 2
    Ah, I see. Yes - a bit more than a home-grown admin hack! If it lets you explicitly set the ssh user, does it not also allow you to explicitly set the key to use? From a cursory glance at the source, perhaps you can set -i ${SUDO_USER}/.ssh/id_rsa or whatever in the ssh-options setting? – D_Bye Oct 5 '12 at 23:04

The user id will always change with sudo, but you can preserve your environment with the -E parameter.

  • I get sudo: sorry, you are not allowed to preserve the environment when I try that. Maybe getting them to change that configuration would solve the problem...? – iconoclast Oct 5 '12 at 19:00
  • 1
    the ssh command needs the SETENV tag in the sudoers file so that -E works. – Hartmut Oct 5 '12 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.