0

(Note: Even though I have answered a couple of my own questions, I still have an unanswered question at the bottom of this post.)

When I run the following command from a bash command line it works.

ssh -t -v my-rails-project@192.168.29.205 sudo /home/my-rails-project/x/pg_rsync_ralph07_to_ralph12_finish

And the ssh verbose output is:

OpenSSH_7.2p2 Ubuntu-4ubuntu2.4, OpenSSL 1.0.2g  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 192.168.29.205 [192.168.29.205] port 22.
debug1: Connection established.
debug1: identity file /home/my-rails-project/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/my-rails-project/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/my-rails-project/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/my-rails-project/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/my-rails-project/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/my-rails-project/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/my-rails-project/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/my-rails-project/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 192.168.29.205:22 as 'my-rails-project'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:EnDsn2kFQgiA56e4B2UuvDr3ajTLlN7/15lxLItnjUQ
debug1: Host '192.168.29.205' is known and matches the ECDSA host key.
debug1: Found key in /home/my-rails-project/.ssh/known_hosts:1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/my-rails-project/.ssh/id_rsa
debug1: Server accepts key: pkalg rsa-sha2-512 blen 279
debug1: Authentication succeeded (publickey).
Authenticated to 192.168.29.205 ([192.168.29.205]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
debug1: Sending command: sudo /home/my-rails-project/x/pg_rsync_ralph07_to_ralph12_finish

The exact same line is in a bash script and I get

OpenSSH_7.2p2 Ubuntu-4ubuntu2.4, OpenSSL 1.0.2g  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 192.168.29.205 [192.168.29.205] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 192.168.29.205:22 as 'my-rails-project'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:EnDsn2kFQgiA56e4B2UuvDr3ajTLlN7/15lxLItnjUQ
debug1: Host '192.168.29.205' is known and matches the ECDSA host key.
debug1: Found key in /root/.ssh/known_hosts:1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Trying private key: /root/.ssh/id_ed25519
debug1: No more authentication methods to try.
Permission denied (publickey).

The two outputs diverge at the line (script)

debug1: Found key in /root/.ssh/known_hosts:1

(command line)

debug1: Found key in /home/my-rails-project/.ssh/known_hosts:1

I don't know if that divergence points to the problem.

So my question is:

Why is ssh looking at /root/.ssh/known_hosts when running from a script and looking at /home/my-rails-project/.ssh/known_hosts when run from the command line?

Answering my own question immediately above:

Ok, as I was writing this up the answer for the divergence became clear: I was running the script as

sudo myScript

So my further question is: How do I tell ssh to use /home/my-rails-project/.ssh/known_hosts for known_hosts?

Answering my own question immediately above

A bit of research led me to the answer in https://stackoverflow.com/questions/10765946/ssh-use-known-hosts-other-than-home-ssh-known-hosts

So now my command line now looks like

ssh -o UserKnownHostsFile=/home/my-rails-project/.ssh/known_hosts -t -v my-rails-project@192.168.29.205 sudo /home/my-rails-project/x/pg_rsync_ralph07_to_ralph12_finish

The command line immediately above again works when I do not have a sudo in front of it. It fails when I use a sudo in front of it. The verbose output is:

my-rails-project@my-rails-project:~$ sudo ssh -o UserKnownHostsFile=/home/my-rails-project/.ssh/known_hosts -t -v my-rails-project@192.168.29.205 sudo /home/my-rails-project/x/pg_rsync_ralph07_to_ralph12_finish
[sudo] password for my-rails-project: 
OpenSSH_7.2p2 Ubuntu-4ubuntu2.4, OpenSSL 1.0.2g  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 192.168.29.205 [192.168.29.205] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 192.168.29.205:22 as 'my-rails-project'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:EnDsn2kFQgiA56e4B2UuvDr3ajTLlN7/15lxLItnjUQ
debug1: Host '192.168.29.205' is known and matches the ECDSA host key.
debug1: Found key in /home/my-rails-project/.ssh/known_hosts:1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Trying private key: /root/.ssh/id_ed25519
debug1: No more authentication methods to try.
Permission denied (publickey).
my-rails-project@my-rails-project:~$ 

And the sudo and non-sudo verbose outputs diverge near the end of the verbose listing near

debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Trying private key: /root/.ssh/id_ed25519
debug1: No more authentication methods to try.
Permission denied (publickey).
my-rails-project@my-rails-project:~$ 

Question:

How do I tell ssh to use /home/my-rails-project/.ssh instead of /root/.ssh for my private key and still be sudo on the target system?

Answering my own question immediately above:

Looking at http://manpages.ubuntu.com/manpages/trusty/man1/ssh.1.html

So now the ssh command line is (adding a -i option)

ssh -o UserKnownHostsFile=/home/my-rails-project/.ssh/known_hosts -i /home/my-rails-project/.ssh/id_rsa -t -v my-rails-project@192.168.29.205 sudo /home/my-rails-project/x/pg_rsync_ralph07_to_ralph12_finish

And then I have success except something (ssh?) is asking for a password. The output now looks like:

my-rails-project@my-rails-project:~$ sudo ssh -o UserKnownHostsFile=/home/my-rails-project/.ssh/known_hosts -i /home/my-rails-project/.ssh/id_rsa -t -v my-rails-project@192.168.29.205 sudo /home/my-rails-project/x/pg_rsync_ralph07_to_ralph12_finish
OpenSSH_7.2p2 Ubuntu-4ubuntu2.4, OpenSSL 1.0.2g  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 192.168.29.205 [192.168.29.205] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /home/my-rails-project/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /home/my-rails-project/.ssh/id_rsa-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.2p2 Ubuntu-4ubuntu2.4
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu2.4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 192.168.29.205:22 as 'my-rails-project'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:EnDsn2kFQgiA56e4B2UuvDr3ajTLlN7/15lxLItnjUQ
debug1: Host '192.168.29.205' is known and matches the ECDSA host key.
debug1: Found key in /home/my-rails-project/.ssh/known_hosts:1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/my-rails-project/.ssh/id_rsa
debug1: Server accepts key: pkalg rsa-sha2-512 blen 279
Enter passphrase for key '/home/my-rails-project/.ssh/id_rsa': 
debug1: Authentication succeeded (publickey).
Authenticated to 192.168.29.205 ([192.168.29.205]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: pledge: network
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
debug1: Sending command: sudo /home/my-rails-project/x/pg_rsync_ralph07_to_ralph12_finish

Question:

I get the following prompt:

Enter passphrase for key '/home/my-rails-project/.ssh/id_rsa': 

How do I suppress this request for a password?

I have managed to suppress most of the requests for passwords by massaging /etc/sudoers.d/ralph on both my machines (Ralph07 and Ralph12)

# This script should only be run on Ralph07
my-rails-project ALL=(ALL:ALL) NOPASSWD: /home/my-rails-project/x/pg_rsync_ralph07_to_ralph12

# This script should only be run on Ralph12
my-rails-project ALL=(ALL:ALL) NOPASSWD: /home/my-rails-project/x/pg_rsync_ralph07_to_ralph12_finish
1

The 'Enter passphrase for key' prompt is displayed because your ssh key was created with a passphrase.

You can remove the passphrase from your ssh key with the following:

ssh-keygen -p -N '' -f ~/my-rails-project/.ssh/id_rsa

Or you can create a new key without a passphrase:

ssh-keygen -q -t rsa -b 4096 -N '' -C '' -f ~/my-rails-project/.ssh/id_rsa

You can also take a look at the sshpass tool which can be used to supply passphrases for ssh commands but it is not recommended as it opens up some security issues.

  • 1
    Oh wow! Thanks! I wish I had 15+ reputation points so I could up vote your answer. – RalphShnelvar Mar 10 '18 at 1:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.