Mdthbs

I have the following task:

• the command has to be run as root on server remotely in bash script over ssh and the command output has to be fetched in variable.


• logging over ssh as root is disabled.


• sudo on server is disabled, so I have to use su.


• EDIT: since I want to make it as automated as possible in bash, the password has to be stored inside command

I have Googled for days, but it seems that I cannot find a solution for this.

Solution proposed here: ssh to server and switch user and change a directory

    ssh -t username@hostname "sudo su - otheruser -c "cd /path/to/directory && command""

does not work because sudo is disabled on server:

Does anyone have a solution to this?

Perhaps somewhat off topic but this could be achieved with Python and the paramiko module:

#!/usr/bin/python2

import time

import paramiko



ssh = paramiko.SSHClient()

ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())

ssh.connect('127.0.0.1', port=22, username='user', password='pass')



stdin, stdout, stderr = ssh.exec_command('su')

time.sleep(0.1) # some enviroment maybe need this.

stdin.write('root_password_goes_heren')



[ add extra code here to execute a command ]



stdin.flush()

print (stdout.readlines())

ssh.close()

It should be noted that storing passwords in script generally is a bad idea from a security perspective. Make sure you have proper permissions set to the script (e.g. chmod 740)

Login via SSH (as unprivileged user), then run the command su without any arguments to change to the root user. You will need the root password to do this. Then run whatever commands you want to run.
EDIT: If you want to do it in one line, you can use the following:
ssh username@hostname "su -c "code_here""

If this doesn't work, make sure the root password is enabled by running passwd as root. This will ask you for a new root password.
Extra: To run a command as another user besides root (Please note that this requires the target user's password):
ssh username@hostname "su - username_of_target -c "code_here""

So, after 4 hours of additional web crawling, I finally made it! Big thanks for @jeroen-it-nerdbox for giving me insights on this:

Task was to take data from smartctl (which requires root credentials), from server with disabled ssh-root and disabled sudo.
This will of course also work with sudo instead of su.

here is the full workable code in Python with Paramiko implementation.

#!/usr/bin/python2



import paramiko



ssh = paramiko.SSHClient()

ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())

ssh.connect('rootserver.domain.com', port=22, username='admin', password='adminpass')



stdin, stdout, stderr = ssh.exec_command('/bin/su root -c "smartctl -a /dev/sda > /tmp/smartctl_output"', get_pty=True)

stdin.write('rootpassn')



stdin.flush()

print (stdout.readlines())

ssh.close()

You can also used paramiko invoke shell command for interactive session.
https://www.youtube.com/watch?v=lLKdxIu3-A4

enter code here



import paramiko

from paramiko.channel import Channel

import time

ssh = paramiko.SSHClient()

ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())

ssh.connect('ip', port=22, username='non-root', password='non-root-password')



channel:Channel = ssh.invoke_shell()

print(type(channel))

channel_data = str()



while True:

   if channel.recv_ready():

       time.sleep(2)

       channel_data += str(channel.recv(999))

   else:

       continue



   channel.send("whoamin")

   time.sleep(2)

   channel_data += str(channel.recv(999))



   channel.send("sun")

   time.sleep(5)

   channel_data += str(channel.recv(999))



   # if "Password" in channel_data:

   channel.send("rootpaaswordn")

   time.sleep(2)

   channel_data += str(channel.recv(999))



   channel.send("whoamin")

   time.sleep(2)

   channel_data += str(channel.recv(999))



   # channel_data += str(channel.recv(999))

   break

print(channel_data)

For somewhat less of a security nightmare than putting the root password in a script, you can use a setuid executable.

setuid executables are run as root, no matter which user executes them.

The main advantage of this is that if someone steals your laptop, they can run smartctl -a /dev/sda as root, but otherwise only has your user privileges. Or even less, if you set up a public key with a forced command as mentioned later.

Write a simple C program, smartctl_wrapper.c, that simply runs the script or program you need, like this:

#include <unistd.h>



int main() {

    //depending on your use case, you may want 

    //setuid(0), setgid(0), and/or setegid(0) here

    execl("/full/path/to/smartctl","smartctl","-a","/dev/sda",(char*) NULL);

}

And compile it as gcc smartctl_wrapper.c -o smartctl_wrapper.

You then make this belong to root, and the group that should be able to run it. These commands should be run as root:

chown root:some_group smartctl_wrapper

Then make it a setuid executable. Also prevent any user from editing it:

chmod 4510 smartctl_wrapper

This is now an executable that can be run by any member of some_group with root permissions, without requiring any password.

Now you can simply run it with ssh:

ssh user@server.domain /path/to/smartctl_wrapper

If the server allows it, you can set up the ssh connection with a public key to allow connections without a password. You can also use forced commands so that this key isn't good for anything besides running this script.

If the server does not allow it, you can instead make a script with the ssh password in it. In this case, I would highly recommend you make a new user just for this with minimal permissions and a login shell of /sbin/nologin.

Alternatively, for your specific use case it may make more sense to avoid running commands as root over ssh entirely. You could, for example, schedule this command to run periodically using cron. You can edit root's crontab with:

su -c crontab -e -u root

and adding the line:

5 0 * * sun smartctl -a /dev/sda >> /some/path/to/log/some/non/root/user/can/read

The line given will run the command once weekly, 5 minutes after midnight on Sunday. You can tweak this to your liking, following the directions in crontab(5).

Then you can use ssh just to read the logs.