Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #169131 > unrolled thread

cron, sshfs and sudo

Back to article view | Back to linux.debian.user

Contents

  cron, sshfs and sudo Wim Bertels <wim.bertels@ucll.be> - 2016-06-17 09:40 +0200
    Re: cron, sshfs and sudo Dan Purgert <dan@djph.net> - 2016-06-17 12:40 +0200
      Re: cron, sshfs and sudo Wim Bertels <wim.bertels@ucll.be> - 2016-07-14 14:00 +0200
    Re: cron, sshfs and sudo Daniel Bareiro <daniel-listas@gmx.net> - 2016-07-14 15:50 +0200

#169131 — cron, sshfs and sudo

Hallo,

use case: use cron to mount a sshfs share (with automatic key auth)

on 1 installation this is working fine:
script:
"
#!/bin/bash

sudo -u user1 sshfs user1@123.234.1.2:/var/user1/shared /mnt/shared

exit
"

on the other it keeps failing because the passphrase needs to be entered
to unlock the key, it doesn't fail however without sudo and a custom
user1 crontab entry; but as cron is run by root, this should be able to
do easier

suggestions?

mvg,
Wim

[toc] | [next] | [standalone]

#169138

Wim Bertels wrote:
> use case: use cron to mount a sshfs share (with automatic key auth)
>
> on 1 installation this is working fine:
> [snipped the script]
>
> on the other it keeps failing because the passphrase needs to be entered
> to unlock the key, it doesn't fail however without sudo and a custom
> user1 crontab entry; but as cron is run by root, this should be able to
> do easier
>
> suggestions?

"Install 1" may be using something like gnome keyring manager with a
saved SSH passphrase.  For auto-mounting, you may also be able to safely
use passphrase-less keys.

-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| 

[toc] | [prev] | [next] | [standalone]

#170116

> >
> > on the other it keeps failing because the passphrase needs to be entered
> > to unlock the key, it doesn't fail however without sudo and a custom
> > user1 crontab entry; but as cron is run by root, this should be able to
> > do easier
> >
> > suggestions?
> 
> "Install 1" may be using something like gnome keyring manager with a
> saved SSH passphrase.  For auto-mounting, you may also be able to safely
> use passphrase-less keys.

Hallo,

tnx for the feedback, i investigated it a bit further

- as crontab is executed in a separate environment the gnome keyring is
not open for crontab.
- using a passphrase-less key is indeed an option, but insecure by
design

but u can access the ssh socket from within the cronjob already opened
by the regular user (gnome-keyring) and as such make a more secure
connection, since the user had to enter his password to unlock the
keyring
(passing SSH_AUTH_SOCK from the regular user as a env var to the
cronscript)

mvg,
Wim

[toc] | [prev] | [next] | [standalone]

#170118

[Multipart message — attachments visible in raw view] — view raw

On 17/06/16 04:01, Wim Bertels wrote:

> Hallo,

Hello, Win.

> use case: use cron to mount a sshfs share (with automatic key auth)
> 
> on 1 installation this is working fine:
> script:
> "
> #!/bin/bash
> 
> sudo -u user1 sshfs user1@123.234.1.2:/var/user1/shared /mnt/shared
> 
> exit
> "
> 
> on the other it keeps failing because the passphrase needs to be entered
> to unlock the key, it doesn't fail however without sudo and a custom
> user1 crontab entry; but as cron is run by root, this should be able to
> do easier
> 
> suggestions?

One possibility I can think is to generate a public/private key pair for
the "user1" and copy the public key to 123.234.1.2.

Then install keychain (aptitude install keychain), adding the following
lines to the profile of user1:

keychain ~/.ssh/id_dsa
. ~/.keychain/$HOSTNAME-sh

Finally, in the mounting script, be sure to add the following line
before mounting itself:

source $HOME/.keychain/${HOSTNAME}-sh


I hope this will help.

Kind regards,
Daniel

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web