6

Context

I want to setup rsync backups of my server, so I run the following command

rsync -r -e ssh --rsync-path="sudo rsync" rsyncuser@example.com:/ /backup/

Ideally, that command would ask my private ssh key password, then connect, then ask the sudo password for rsyncuser, and then run rsync on the server. But I got the infamous error:

sudo: no tty present and no askpass program specified

So I had to add this to /etc/sudoers (using sudo visudo), which basically gives passwordless full read-write access to the system to the user rsyncuser, which is not to my taste:

rsyncuser ALL= NOPASSWD:/usr/bin/rsync

Question

How can I instead tell sudo to read its password from, say, another TTY ?

That way, I could run rsync in one terminal window on my local machine, and use another terminal window to open a (possibly separate) ssh connexion to the server, and supply the sudo password there.

The only way I think of doing something like that would be to use an expect script around sudo, which reads the password from a named pipe, and I would write to that pipe from the other terminal.

Note: this is more for the sake of exeprimentation and learning than any practical purpose, I'm not trying to find out how to use sudo with rsync, I've already read all I could find about that.

  • Have you tried rsync -e 'ssh -t' ...? – peterph Sep 18 '13 at 22:43
  • 1
    @peterph I just tried that, I get Pseudo-terminal will not be allocated because stdin is not a terminal. – Georges Dupéron Sep 18 '13 at 23:11
6

sudo will read an environment variable, SUDO_ASKPASS, if it is not running from a terminal (as in your case) or if -A is set. It uses this as a command to run to get the password. For example:

echo -e '#!/bin/sh\nhead -n 1' > ~/bin/reader
chmod a+x ~/bin/reader
export SUDO_ASKPASS="$HOME/bin/reader"
sudo -A echo "I'm root\!"

Will prompt you for the password on stdin, and won't require a terminal.

In the specific case of what you are trying to do however, it might be better to allow root SSH login, but only with an SSH key and the command restricted to rsync. There is a good resource on this here.

  • How does that work? reader just runs head with no input. On my debian (bash), it expects the root password but I don't get the prompt. Presumably because -A suppresses it. The net result is my root password written visibly in my terminal before the command executes. – terdon Sep 19 '13 at 0:38
  • 1
    @terdon I intended reader only as an example to show how SUDO_ASKPASS works. No one should actually use a script like that. And yes, it suppresses the usual sudo prompt, allowing head to read it from the terminal, perfectly visible. – wingedsubmariner Sep 19 '13 at 0:43
  • Nice then, +1 :) – terdon Sep 19 '13 at 0:44
  • I +1'd at no one should actually use a script like that. – Willtech Mar 27 '18 at 11:11
0

Try:

ssh userfoo@host "sudo -S p'enter pw: ' [command] "

This will issue a password prompt ("enter pw:") that will display on your local host/terminal. The downside of this is the security risk from your password being displayed in the clear on your terminal window. It will not be saved in your local .bash_history, but it is the terminal window scroll-back history. So, if you're using Konsole for example, use Ctrl+Shift+K to clear that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.