Net::SSH works from production rails console, AuthenticationFailed from production webapp

Question

I have a rails app where a user can submit a form and it goes off and connects to a remote server via ssh to call a script. Eventually I plan to use delayed_job or something like that but I can't get it to work in production with even a simple test.

The odd thing is, Net::SSH works just fine from the console in production, but it fails with AuthenticationFailed when I submit the form in production. Both the console and the webapp work fine in development.

The error:

Net::SSH::AuthenticationFailed (my_ssh_username):

app/models/branch.rb:69:in `ssh_to_machine'

app/controllers/branches_controller.rb:55:in `update'

Controller's update action:

  def update
    @branch = Branch.find(params[:id])
    if @branch.update_attributes(params[:branch])
      @branch.ssh_to_machine(@branch.hostname, @branch.user_name, @branch.command_to_run)
      redirect_to @branch, :notice  => "Update request now processing."
    else
      render :action => 'edit'
    end
  end

Method I'm calling, mostly copy/pasted from the Net::SSH api example:

def ssh_to_machine(host_name, user_name, command_to_run)
    require 'net/ssh'
    Net::SSH.start(host_name, user_name, { :verbose => Logger::DEBUG, :keys => %w{ /home/www-data/.ssh/my_ssh_username_id_rsa }, :auth_methods => %w{ publickey } }) do |ssh|
      # capture all stderr and stdout output from a remote process
      output = ssh.exec!("hostname")

      # run multiple processes in parallel to completion
      ssh.exec command_to_run
      ssh.loop
    end
end

I've tried it with and without :verbose, :keys, :auth_methods; being careful to restart apache each time, but in production it always works from the console (with RAILS_ENV=production exported before calling 'rails c') and never works from the webapp.

I would also welcome any recommendations on how to get enhanced logging when I do call it from the webapp - :verbose worked for me at the console but didn't add anything to my production.log.

Answer 1

When you run it from the console, you're using your own account, right?

This is kinda bizarre, but my guess is that your production web app is running under an account that doesn't have read access to "/home/www-data/.ssh/my_ssh_username_id_rsa".

From your description it almost has to be a permissions issue of some sort.