Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to start tcpdump on several remote machines to perform some network analysis with a script, but I'm failing to run it correctly. The command I would like to use is:

ssh user@host "nohup sudo /usr/sbin/tcpdump udp -l -s 68 -n -v -i eth0 1>tcpdump.txt 2>tcpdump.err &"

With the intention to start tcpdump remotely, pipe the results to file and return immediately. Not having a keyboard installed on the remote machine, all I get is

sudo: no tty present and no askpass program specified

written in tcpdump.err. I also tried:

  • writing the command in a bash script and running the script remotely
  • enclosing the sudo part in the 'script' command (script -c 'nohup sudo...')

but with no success. Is there some other alternatives I can try?

share|improve this question
    
Have you tried ssh -t to force pseudo-tty allocation? –  parkydr Jan 14 '13 at 10:39
    
I'm sorry, I forgot to mention that alternative: I have already tried using the -t option, both once and twice ("ssh -t -t ...") –  user189796 Jan 14 '13 at 12:49

1 Answer 1

You're using sudo in your command, which will require authentication, unless configured otherwise on the remote host. You'll be forced to enter a password to authenticate unless you try something like

user NOPASSWD: /usr/sbin/tcpdump

in the sudoers file on the remote host.

This can have serious security implications; if someone were to hack into the system as this user (or just sit down at one of their logged in consoles), they could tcpdump all traffic to/from that host without authenticating as root or that user.

Check out the tag_spec section of the sudoers man page for more details.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.