1

I have a private webserver which runs under user 'nobody'. This webserver occasionally needs to access another server using SSH automatically. When this happens, I cannot be present to use a password.

Therefore, I created a file with permission 700 and assigned user nobody (chmod and chown) to it. However, when accessing that file using 'sudo -u nobody cat testfile', I still cannot access the file. I therefore assume I cannot create a rsa_id with correct permissions for the webserver to use.

Is it possible to create a file which can be used by the nobody user, to connect to SSH? If not, is it the next best thing to create a user specifically for the server with a home directory and then use that rsa_id?

PS: I'm on centos

Thanks for reading!

2
  • 1
    CentOS doesn't use the 'nobody' user for running httpd, but an apache user/group. So you wouldn't need to create a user or group, it's already there. What else have you changed?
    – jsbillings
    Jul 16 '20 at 12:35
  • It was like this when I got the server, therefore I have no idea how it was. Jul 16 '20 at 13:25
0

I created a file with permission 700 and assigned user nobody (chmod and chown) to it. ... I still cannot access the file

You can't if it's in a directory that nobody cannot access.

Find out what user the web server actually runs under, it might not be nobody to begin with. Then create a distinct SSH key for it and it put it somewhere the webserver can read. The config directory might be a good candidate (/etc/apache or /etc/httpd or whatever it is in CentOS).

Then note that unless the scripts on your webserver run under distinct users, you probably can't limit the access to that SSH key to just one script, but anything that runs in the webserver can use it.

3
  • "You can't if it's in a directory that nobody cannot access." - Didn't know this. Thanks, that'll help! I will try out your suggestion! Jul 16 '20 at 13:26
  • This works, thank you very much! Jul 16 '20 at 13:45
  • @CookieAndPizza, yes, that's how it works in Unix-like systems. So you can stop anyone outside your group from reading any of your files with just chmod o-rwx ~. At least at some point, Windows NT permission systems did allow for a situation where you could access /foo/bar/third, but not e.g. /foo itself. I don't know if anyone uses it, it feels just weird...
    – ilkkachu
    Jul 16 '20 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.