known_hosts file permissions issue when trying to git pull from PHP

Question

I'm trying to set up a simple PHP script that can do a git pull when you go to a particular URL on an AWS Amazon Linux 2 AMI test web server I have set up.

I ran into some issues trying to do that though, and have since been following this article to try to work things out: https://jondavidjohn.com/git-pull-from-a-php-script-not-so-simple/

I'm stuck on the step where the author says to run sudo -u www git pull.

In my system, apache is the Apache user that we need to do a git pull for in order to add the necessarily SSH key info, but it's not working. When I try to run the following:

sudo -u apache git pull

I get the following error:

Failed to add the host to the list of known hosts (/usr/share/httpd/.ssh/known_hosts).
Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

I don't know if this is an issue, but there is no .ssh directory under /usr/share/httpd. There is a known_hosts file under ~/.ssh, so maybe that's the one I need to worry about? I'm not really sure.

This very much feels like a permissions error (the error message suggests as much), but I'm really not sure what file where needs to be changed and how. Any advice would be greatly appreciated. Thank you.

Answer 1

Many thanks to ArSeN for walking me through the process in our comments back and forth above. What ultimately solved this for me was changing the permissions on the /usr/share/httpd dir where the apache user SSH key needs to go, and then copying the SSH key already in use by ec2-user over to that directory.

Here're the commands I ran:

sudo chown -R ec2-user:apache /usr/share/httpd
sudo chmod -R 777 /usr/share/httpd
sudo cp -r /home/ec2-user/.ssh/ /usr/share/httpd/.ssh/
sudo chown -R ec2-user:apache /usr/share/httpd
sudo chmod -R 755 /usr/share/httpd
sudo chown -R ec2-user:apache /var/www
cd /var/www/project-name/
sudo -u apache git pull
sudo chown -R ec2-user:apache /var/www

As you can see in the commands, for whatever reason, I had to run chown several times to get the user/group stuff set correctly, but ultimately it worked and I was able to get what I want. Thanks again, ArSeN.

Answer 2

Try removing know_hosts then re-try:

rm ~/.ssh/known_hosts

in case of insufficient permission:

sudo chmod -R 700  ~/.ssh/