I run a remote script through ssh and get permission errors on touch, while everything works fine if I connect through ssh using the same key. The script is executed, echoes are run for example.

Here is the code I run:

ssh -Tv user@149.202.xxx.xxx 'bash var/deploy.sh'

Here is the content of the script:

echo "blabla"
touch bidule
ln -sfn www-26 www

Here is the result of the command:

debug1: Reading configuration data /Users/local_user/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug1: Connecting to 149.202.xxx.xxx [149.202.xxx.xxx] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /Users/local_user/.ssh/id_rsa type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.9
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.5p1 Ubuntu-10ubuntu0.1
debug1: match: OpenSSH_7.5p1 Ubuntu-10ubuntu0.1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 149.202.xxx.xxx:22 as 'user'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client chacha20-poly1305@openssh.com <implicit> none
debug1: kex: client->server chacha20-poly1305@openssh.com <implicit> none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256     SHA256:sSTBN/oPCEhmpaK2UKIU1DC1uhlGB3F0II2TDfHi5eA
debug1: Host '149.202.xxx.xxx' is known and matches the ECDSA host key.
debug1: Found key in /Users/local_user/.ssh/known_hosts:1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/local_user/.ssh/local_user_mac
debug1: Server accepts key: pkalg ssh-rsa blen 535
debug1: Authentication succeeded (publickey).
Authenticated to 149.202.xxx.xxx ([149.202.xxx.xxx]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Sending environment.
debug1: Sending env LC_CTYPE = UTF-8
debug1: Sending command: bash var/deploy.sh
touch: cannot touch 'bidule': Permission denied
ln: failed to create symbolic link 'www': Permission denied
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0
debug1: channel 0: free: client-session, nchannels 1
Transferred: sent 4144, received 2844 bytes, in 0.4 seconds
Bytes per second: sent 10803.0, received 7414.0
debug1: Exit status 1

I also tried various options with ssh (-ttv, -Tv, -v) and always get the same answer.

Note that if I use the same key and simply go with a ssh user@149.202.xxx.xxx and then run bash var/deploy.sh from the command line, it works fine.

Also note that all the content of this directory is uploaded via sftp using the same key.


Server os:

Distributor ID: Ubuntu
Description:    Ubuntu 17.10
Release:    17.10
Codename:   artful

Client (where the ssh command is used): bitbucket pipeline instance or mac OSX for local tests.

For information here is the permissions on the var directory:

[10:39:32] iam.test.edu-sante.com@Dagobert:~/var$ ls -rtla
total 48
drwxr-xr-x  4 root                   root           4096 Mar 26 14:37 ..
-rw-r--r--  1 user                   group            58 Mar 26 17:46 deploy.sh
drwxr-xr-x  3 user                   group          4096 Mar 26 17:46 www-26
lrwxrwxrwx  1 user                   group             6 Mar 27 10:13 www -> www-24
drwxr-xr-x 11 user                   group          4096 Mar 27 10:13 .

Note that the var directory here isn't the /var directory it's a $HOME/var directory specific to the user.

And just in case here is my sshd config file:

#   $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $
Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
UsePrivilegeSeparation yes
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 2m
PermitRootLogin no
StrictModes yes
MaxAuthTries 6
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile      %h/.ssh/authorized_keys
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
Subsystem   sftp    /usr/lib/openssh/sftp-server
Match group sftp
  ChrootDirectory %h
  ForceCommand internal-sftp
  AllowTcpForwarding no

User isn't part of the sftp group.


It seems you want to run the script in the ~/var directory, but currently it is run in the home directory.

The command bash var/deploy.sh does not switch to the var directory, and touch bidule tries to create a file in the current directory, which is likely the user's home directory.

  • One solution would be to cd to the correct directory before calling the script, another one would be to let the script do the cd (which I personally would have done). – Kusalananda Mar 27 at 11:45
  • Hi sorry for the stupid question and thanks for the answer. I wasn't able to upvote you as I don't have the needed reputation, but I would have otherwise – Jean-Xavier Raynaud Mar 28 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.