View source for SSH Won't Work Via Shell Command in PHP


== Problem ==

I ran into a situation where I wanted to run a shell command from a web page to ssh into another server and run a script that gathered system stats. It simply wasn't working, and I didn't know why. After a couple hours of troubleshooting, I discovered the problem was with accepting the ssh key fingerprint for the user <i>www-data</i>.

First, I installed a program called <code>sshpass</code>. It allows you to use ssh non-interactively.
<pre>
sudo apt-get install sshpass
</pre><i>Your command will be different depending on the package manager used by your Linux distro.</i>
<br/>
In PHP, I wrote something like this:
<syntaxhighlight lang="php">
if ($output = shell_exec(escapeshellcmd('sshpass -p "Pa$$w0rd" ssh username@hostname "/scripts/status.sh"')))
{
  echo "<pre>$output</pre></br></br>";
}
else
{
  echo "Failed to load stats.";
}
</syntaxhighlight>

I was only getting the message "Failed to load stats." because the shell command was simply producing no output.

== Solution ==

First, take note of the current shell for the <i>www-data</i> user. Also take note of the home folder:
<pre>
cat /etc/passwd | grep www-data
</pre>

On my system, I see this:
<pre class="result">
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
</pre>

the default shell is <code>/usr/sbin/nologin</code> and the home folder is <code>/var/www</code>.

Now change the shell to something else:
<pre>
sudo usermod www-data -s /bin/bash
</pre>

Create a new folder in the <i>www-data</i> user's home folder and change the ownership:
<pre>
sudo mkdir /var/www/.ssh
sudo chown www-data:www-data /var/www/.ssh
</pre>

Now, login as <i>www-data</i>:
<pre>
sudo su www-data
</pre>

As the <i>www-data</i> user, individually ssh into every host that you want to be able to ssh into via web and enter "yes" to accept the key fingerprint:
<pre>
ssh username@hostname
The authenticity of host 'hostname (10.0.0.2)' can't be established.
ECDSA key fingerprint is ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff.
Are you sure you want to continue connecting (yes/no)? yes
</pre>

The fingerprint is now stored in /var/www/.ssh/known_hosts (on my system /var/www is the home folder for the www-data user).

Log out <i>www-data</i>:
<pre>
exit
</pre>

And change the <i>www-data</i> user's shell back to the way it was:
<pre>
sudo usermod www-data -s /usr/sbin/nologin
</pre>

The shell command in PHP now works!

=== Another Way ===

You can also copy the "known_hosts" file from another user into <code>/var/www/.ssh</code> and change the permissions.