linux - RSYNC over SSH requesting password

06
2014-04
  • progAK

    I looked at numerous question but don't seem to find quite what I'm looking for.

    I've created a script in which I'm trying to run rsync over ssh, this will eventually be put into a cron job. The variables are all defined and the important part of the script reads:

    $RSYNC -az --stats -e "$SSH -i $KEY" $RUSER@RHOST:$RPATH $LPATH

    KEY points to my private key, with the public copied to RHOST and added to authorized users.

    Currently the permissions on RPATH are 775, when I try to run the script I'm prompted for RHOSTs password, which going into a cron job isn't very useful.

    If I however I change the permissions on RPATH to 755, the script runs without prompting for a password. Unfortunately I can't make this change permanently.

    So I have a three part question;
    First is this rsync or ssh causing me trouble?
    Second why does this behave this way? It doesn't make sense to me that allowing group write access to the directory should make the difference in being prompted for a password.
    Third and finally I'm looking for ideas on a way to resolve this. RUSER has sudo privileges. (I rather not embed the password in the command line.)

    Thanks in advance for the help!

    • Answers
  • MariusMatutiae

    According to the manual (man rsync), you are not using the correct -l option:

    If you need to specify a different remote-shell user, keep in mind that the user@ prefix in front of the host is specifying the rsync-user value (for a module that requires user-based authentication). This means that you must give the â-l userâ option to ssh when specifying the remote-shell, as in this example that uses the short version of the --rsh option:

           rsync -av -e "ssh -l ssh-user" rsync-user@host::module /dest

   The "ssh-user" will be used at the ssh level; the "rsync-user" will be used to log-in to the "module".
  • progAK

    So here's what I ended up doing, @MariusMatutiae got me headed in the right direction!

    Based on some other recommendations I found I'm running running rsync as sudo over ssh. I created a new user BKUPuser on remotehost and added this user to the RHOST group that owns the files I'm trying to backup.

    In sudoers I added two lines:
    BKUPuser ALL= NOPASSWD:/usr/bin/rsync this stopped the error: "sudo: no tty present and no askpass program specified" ( http://unix.stackexchange.com/questions/92123/rsync-all-files-of-remote-machine-over-ssh-without-root-user ) I understand this has some security vulnerabilities but neither machine is visible to the outside world.

    The second addition:
    Defaults:user !requiretty this stopped error: "sudo: sorry, you must have a tty to run sudo"

    Then the command ended up being:
    $RSYNC -e "$SSH -i $KEY -t -l BKUPuser" --rsync-path='sudo rsync'-az --stats BKUPuser@RHOST:$RPATH $LPATH

    The only problem I still have is getting an error "Psuedo-terminal will not be allocated because stdin is not a terminal." As rsync is backing up the files it's only an annoyance at this point. I tried using -t -t as suggested http://stackoverflow.com/questions/7114990/pseudo-terminal-will-not-be-allocated-because-stdin-is-not-a-terminal but no luck.


    • Related Question

    linux - MAC OSX 10.5.8 need to save rsync password with ssh-copy-id
  • Brady

    I'll start by saying I'm very new to MAC but comfortable in using the command line thanks to using a linux a lot.

    I currently have rsync setup to run between a MAC OSX 10.5.8 server to a Linux Centos 5.5 Server. This is the command I'm running on the MAC server:

    rsync -avhe ssh "/Path/To/Data" [email protected]:data/

    As it does it prompts for a password but I need it to save the password. After looking around I need to use:

    ssh-keygen -t dsa

    save the passkey and then move it over to the Linux server using:

    ssh-copy-id -i .ssh/id_dsa.pub [email protected]

    But ssh-copy-id doesnt seem to exist on the MAC server. How do I copy this key over? I've tried searching for the answer myself but the help seems to be all over the place for this..

    Any help is greatly appreciated.

    Scott


    • Related Answers
  • danmichaelo

    Yes, you need to add your public key (.ssh/id_dsa.pub) to the file .ssh/authorized_keys at the server. ssh-copy-id is just a simple shell script that does this for you. What it does is basically this:

    cat ~/.ssh/id_dsa.pub | ssh [email protected] "umask 077; test -d .ssh || mkdir .ssh; cat >> .ssh/authorized_keys"

    It pipes the key over ssh (you have to specify the password this time, but hopefully it is the last time) and creates the directory ".ssh" at the server if it doesn't exist.