Ssh – How to sudo over sshfs

sshsshfssudo

On my local host alpha I have a directory foo that is mapped via sshfs to host bravo as follows:

$ sshfs charlie@bravo:/home/charlie ~/foo

However, on host bravo there is another user, delta, that I want to sudo /bin/su as, so that I can do work in bravo:/home/delta. delta may not be logged into via ssh; for reasons which I cannot change, you can only sudo over to delta once you're on the machine.

Normally I'd ssh into bravo, then sudo to delta, but I'm wondering if there's any way that I can do that when I've got charlie's home dir mounted via ssh.

Best Answer

This will vary depending on the OS of the server you are connecting to. For centOS 5 you would add to the sshfs mount options:

-o sftp_server="/usr/bin/sudo /usr/libexec/openssh/sftp-server"

For Ubuntu 9.10 (I think, might be 9.04, but it's probably the same for both) or Debian you would add:

-o sftp_server="/usr/bin/sudo /usr/lib/openssh/sftp-server".

To find an the correct path for other systems running openSSH run

sudo grep Subsystem /etc/ssh/sshd_config

and look for the location of the sftp-server binary.

You might need to setup sudo with NOPASS:{path to sftp-server} or prevalidate with ssh user@host sudo -v so that sudo has a updated timestamp for notty. In my case, my two commands were:

ssh login_user@host sudo -v
sshfs login_user@host:remote_path local_path -o sftp_server="/usr/bin/sudo -u as_user /usr/lib/ssh/sftp-server"

Related Solutions

Ubuntu – Permission Denied for User with Sudo Privileges

Could you run

sudo -s
id

And post the output? I want to see if it's actually making you the user you think.

Also, try

sudo cat /etc/sudoers

The output of id here is quite enlightening. When you ran sudo -s, you were given a UID of 1, while the only UID that the kernel will recognize as having root privileges is UID 0.

Try running

getent passwd | grep ':0:'

and see if any entries have that 0 in their first numeric field, the UID. Whatever account that is is the real superuser on the system, while root is a fake. Once you know the name, you can try

sudo -s -u username

to get a shell as that user.

You should also post the output of

getent passwd root

The bigger issue here is how such a condition came to pass.

Is this machine offering any network services? If so, someone may have broken into it and taken it over. In that case, you should probably back up the data, do a clean re-install, and audit anything that goes back on it.

If it's more of a personal machine, might there be a knowledgeable prankster who's had access to it recently?

Edit: your comment to another answer suggests that this is a server. I would highly recommend taking it offline ASAP and imaging its disks for forensic purposes. Unless you can identify a benign cause for this in short order, you've probably had your server cracked.

Sshfs mount using public key authentication: execvp: No such file or directory

Since I had the same problem on CentOS, I was running with the assumption that ssh_command doesn't work as advertised (also meaning that it doesn't work the same as most other things that can hook into SSH -- rsync, for example). I began looking for ways that I could configure SSH to set the options I need without requiring for me to feed input from the command line to sshfs, and I found the combination that works.

I added to /etc/ssh/ssh_config the following lines:

Host remotehost
HostName 192.168.1.1
User user
IdentityFile /home/me/.ssh/myKey

After doing that, I no longer needed to feed any command line options to SSH through sshfs and ended up with this command:

sshfs user@remotehost:/remote/dir /local/dir

It should be noted that remotehost in the sshfs command is the exact value that was defined for the Host key in ssh_config.

If someone knows of a way to perform this task using command line options, I am still interested as I don't think that it's right that it should require a system-wide configuration change to make this work as the documentation claims. Until then, I at least have a work-around. I hope this helps someone else avoid the hours I spent on it.

FWIW, post 4 on this thread was the source of my inspiration. Post 5 looks promising as a way to be able to avoid altering the system-wide configuration, but that lead to the error execvp: Permission denied

Best Answer

Related Solutions

Ubuntu – Permission Denied for User with Sudo Privileges

Sshfs mount using public key authentication: execvp: No such file or directory

Related Topic