Ubuntu – Need scp with www-data without the need for password

lamppasswordsshUbuntuwww-data

I have a DMZ with a web server running Ubuntu 11.04 and an application server running Ubuntu 11.10. I have set things up so that I can scp from the web server to the application server by running

ssh-keygen
ssh-copy-id peter@192.168.1.6

where 192.168.1.6 is the local IP address of the app. server and peter is my login account name. However, I would like to copy the files in response to a call through a LAMP-based web site using a command in a PHP file. My problem is that the "user" of my web applications is www-data which is not a real user so I cannot create keys for it.

I tried the procedure outlined here. I then did

su
su www-data

on the web server (I guess the "server" per the Berkeley discussion). Unfortunately, I still get asked for the password when I try to scp to the application server/client.

I tried

scp -vv /var/www/Src/*.txt 192.168.1.6:/var/www/Dest

The output was much the same as when I (successfully) scp from the peter account. However, these last few lines are different.

debug1: Authentications that can continue: publickey,password
debug1: Offering DSA public key: /var/www/.ssh/id_dsa
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password
debug1: Offering ECDSA public key: /var/www/.ssh/id_ecdsa
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey,password
debug2: we did not send a packet, disable method
debug1: Next authentication method: password
www-data@192.168.1.6's password:

I would be most grateful if someone could tell me, or help me find, where the problem lies.

Best Answer

Having read the link you gave: make sure you use authorized_keys, not authorized_keys2. The latter has been deprecated for years and did not work at all in some versions of OpenSSH.

The easiest way to diagnose this is with a debugging instance of the SSH server. On the server, run:

# /usr/sbin/sshd -ddep 2222

... which runs the SSH daemon in debug mode, listening on port 2222. Redo your scp command with:

$ scp -o port=2222 ...

... and see what the server says.

To John's security concerns: if you decide to continue using the www-data account, you can limit its key to only certain actions (such as transferring certain files) using a "forced command" option in authorized_keys.

Related Topic