What is a good setup that allows automatic execution of a command or a script on a remote server with
root privileges using SSH?
I'm aware (only vaguely for some the options) of the following options:
- Allowing a direct login by
PermitRootLogin) (and possibly forcing key authentication).
sudonot to require a password (
sudoers) and TTY (
sudoto allow an execution of specific commands/scripts, when authenticated with a specific private key.
- Setting the script owner as
rootand setting setuid permission.
But first, I'm not sure what are security consequences of these. For example I know that allowing
root login is frowned upon. But I'm not sure, if that is not an obsolete point of view. From what I've understood, it looks like a password authentication is the danger. With public key authentication, the direct
root login might be ok. And for some of the options, particularly the
sudo, I'm not sure even about the configuration needed. While I am able to google all that, there might be security considerations that I may miss, that's why I'm asking for experts' opinion.
Note, that I'm asking for a server-side setup. The execution will be triggered by a program, not a tool like
ssh, so I'm not looking for things like automatic client authentication.
Background: Being active in
ssh tag on Stack Overflow, one of frequent questions that come up, are about various hacks that people attempt, while trying to execute a command/script (or even an SFTP server) over an SSH on a remote Unix/Linux server server using a
root account using various programming languages (C#, Java, VB.NET, Python, etc.) and SSH libraries (SSH.NET, JSch, Paramiko, etc.).
The implementations, that the people attempt, usually try using
sudo. These then prompt for a password. So the implementations then try to feed the password to the command input. As
sudo often require terminal emulation for the password prompt, the implementation have to require PTY. Which in turn causes further troubles, as sessions with the terminal emulation often employ interactive features, like ANSI escape codes, pagination, etc. All these lead to loads of further unreliable hacks that attempt to remove or even interpret the ANSI escape codes or simulate large enough terminal to avoid pagination.
Few examples out of many:
- “sudo” command executed with JSch requires password, even when the password is not required in an interactive SSH session
- Getting “must be run from a terminal” when switching to root user using Paramiko module in Python
- Executing command using “su -l” in SSH using Python
- Using JSch to SFTP when one must also switch user
While I usually can provide a help with implementing these hacks, I also usually add a suggestion that there are better ways than automating
su. But I'm not actually confident about providing details of those purported "better ways".
So I'm looking for a canonical answer from a Super User perspective, which can then be referred to and adapted for Stack Overflow purposes.