Question

I’m trying to run a command on a remote server via SSH from a PHP script. Here’s the snippet:

    $ssh_command = "ssh -F keys/config -o UserKnownHostsFile=keys/known_hosts -i keys/deployment_key -p $ssh_port $r
    $git_fetch = "git --git-dir=$remote_path/.git --work-tree=$remote_path fetch 2>&1";
    exec("$ssh_command '$git_fetch' 2>&1", $out);

The script works fine if I run it from the command line, because it’s running as a user with a regular login shell and their own .ssh directory. When I try to run the script through the Web interface, it fails because SSH can’t create its .ssh directory in the Apache user’s home directory.

Is it possible to use SSH without the .ssh directory or is there another alternative for running SSH as the Apache user? I’d prefer not to create a .ssh folder for the Apache user.

Answer 1

I’d do it with phpseclib, a pure PHP SSH implementation:

<?php
include('Net/SSH2.php');

$key = new Crypt_RSA();
//$key->setPassword('whatever');
$key->loadKey(file_get_contents('privatekey'));

$ssh = new Net_SSH2('www.domain.tld');
if (!$ssh->login('username', $key)) {
    exit('Login Failed');
}

echo $ssh->read('username@username:~$');
$ssh->write("ls -la\n");
echo $ssh->read('username@username:~$');
?>

The only other thing I can imagine people referring to when they say PHP SSH library is the PECL extension. I’d personally recommend against using that as it’s pretty badly written. The fact that it’s hard to install and badly supported aside it requires you provide public and private keys. phpseclib only requires the private key. This makes sense because the private keys normally contain the public key embedded within them. The PECL SSH2 extension requires it be extracted separately, which is silly.

phpseclib also supports a ton more formats than the PECL SSH2 library does. phpseclib supports the PuTTY key format, XML Signatures keys, etc.