Firstly, we wanna move the changes from one system to another system and for this, we have a shell script in synchfolders.sh file as follows

rsync -av --delete -e 'sshpass -p Wordpress@123 ssh -p 22' root@ /var/www/html/devsync/wp-content/plugins >> /var/www/html/devsync/wp-content/mysynclog.txt

and we want to execute this shell script in PHP file by shell_exec() and while executing this PHP file from a browser other than rsync command, all are executing but the rsync is not executing. We have searched the stuff in SO and we got the link https://stackoverflow.com/questions/30772816/php-exec-rsync-ssh-to-remote-server-not-working/30773063#30773063, as said here we have tried the PHP file execution from the command line and works perfect but not through the browser. Why, Please let us know where we did a mistake. Thanks in advance

  • 1
    Start by piping stdout and stderr into files and review those files after a run - most likely you'll see the reason there. – Eugen Rieck May 22 at 7:07
  • how can we add the stdout and stderr in file, will you provide us an example – user1039529 May 22 at 10:02

In general: in scripts that don't get executed from your usual interactive shell you need to ensure that you either use absolute paths (i.e. /usr/bin/rsync instead of rsync) or set up the correct environment with a good value for $PATH

As an additional improvement: rather than password based authentication you should really set up key based ssh authentication for use in scripts.

When you stop using passwords and start using keys you can lock down and secure the ssh server (disabling password authentication will stop brute force attacks) and more importantly you can add restrictions to what is allowed when a particular key is used for authentication, which is something you can't do with a password.

You can restrict the key used in your script so it can only be used for rsync from a specific host.

Then even if your script is compromised it won't be your root password (which grants full control to your server) that is stolen, but only a private key that grants limited access, if it can be used at all.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.