mjhjmtu

I made a sshfs mount point in my fstab, using sshpass to send the password (I need to do this because key authentification is not available on the remote server).

Mounting the folder logged as root works well. But when mounting as another account (www-data), the mount hangs forever.

In the example below, I mount on my own server (127.0.0.1), on my own ssh server. But the behavior is the same as the distant server.

# cat /etc/fstab
...
distantuser@127.0.0.1:/ /mount/mountpoint fuse.sshfs noauto,port=22,noatime,_netdev,user,idmap
=user,uid=www-data,gid=www-data,allow_other,ServerAliveInterval=5,ServerAliveCountMax=2,ssh_command=sshpass40-f40/usr/local/credentials/.sshfs-distant40ssh 0 0


# cat /usr/local/credentials/.sshfs-distant
<needed_password>


# ls -l /mount
drwxrwx--- 2 www-data www-data 4096 mars 15 17:00 mountpoint

If I enable debug on the mount line (adding debug,sshfs_debug,loglevel=debug options), I get:

# sudo -u www-data mount kcm-online-dev/
SSHFS version 2.8
FUSE library version: 2.9.7
nullpath_ok: 0
nopath: 0
utime_omit_ok: 0
executing <sshpass> <-f> </usr/local/credentials/.sshfs-distant> <ssh> <-x> <-a> <-oClearAllForwardings=yes> <-oport=22> <-oServerAliveInterval=5> <-oServerAliveCountMax=2> <-ologlevel=debug> <-2> <tolas@kcm-online.com@127.0.0.1> <-s> <sftp>
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 127.0.0.1 [127.0.0.1] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /var/www/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/www/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/www/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/www/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/www/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/www/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/www/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/www/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u2
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4p1
debug1: match: OpenSSH_7.4p1 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 127.0.0.1:22 as 'tolas@kcm-online.com'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: aes256-ctr MAC: umac-64-etm@openssh.com compression: none
debug1: kex: client->server cipher: aes256-ctr MAC: umac-64-etm@openssh.com compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:evn+V3Z0y+dY1+3EwwHPhRqy/5qQO9GtrRZrOespLzI
debug1: Host '127.0.0.1' is known and matches the ECDSA host key.
debug1: Found key in /var/www/.ssh/known_hosts:3
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /var/www/.ssh/id_rsa
debug1: Trying private key: /var/www/.ssh/id_dsa
debug1: Trying private key: /var/www/.ssh/id_ecdsa
debug1: Trying private key: /var/www/.ssh/id_ed25519
debug1: Next authentication method: password

Then it hangs.

Note: the remote server public key is known for www-data, as I made before a successfull ssh connection (sudo -u www-data ssh root@127.0.0.1)

Could you please tell me what am I missing??

Got it. The credential file was not accessible for www-data user...

To debug it, I launched sshpass manually, like this:

# sudo -u www-data /usr/bin/sshpass -v -f /usr/local/credentials/.sshfs-distant ssh distantuser@127.0.0.1 ls /tmp
SSHPASS searching for password prompt using match "assword"
SSHPASS read: distantuser@127.0.0.1's password:
SSHPASS detected prompt. Sending password.

(then wait forever)

With password in command-line:

# sudo -u www-data /usr/bin/sshpass -v -p '<needed_password>' -f /usr/local/credentials/.sshfs-distant ssh distantuser@127.0.0.1 ls /tmp
SSHPASS searching for password prompt using match "assword"
SSHPASS read: distantuser@127.0.0.1's password:
SSHPASS detected prompt. Sending password.
SSHPASS read:

(... ls tmp files)