I've got a web server with a dedicated unprivileged user who runs the apache instance on the box. The php code for the app the web server runs is in a private github repo that I occasionally need to git pull to update.
I wish to pull using my personal credentials (my local id_rsa key), but for security reasons, I've set the box up so that I can only access the box via a second, non-root account with sudo access, and then sudo -iu username into the web server user.
I've tried enabling ssh-agent forwarding, and even had sudo keep the SSH_AUTH_SOCK env variable, but the auth sock file has the wrong permissions (700 for the user I ssh'd into).
I've verified that the key is actually added to the agent, and that it is accessible from the first user. I tried to ssh-add -L from the web server user and got a response saying it cannot connect to the ssh-agent. I suspect this is because the permissions are wrong.
Is there a way to change the permissions in an automated fashion?
Or am I going about this the wrong way?
