I have public and private ssh keys on all of my three servers (dev, UAT, & production) so I can log in remotely, or from one to another. Everything is working perfectly for the ssh and scp commands.

It does not work, however, for Drush. If I execute drush @dev status from UAT, for example, I get the server's banner saying the system is "to be used by authorized users only blah blah blah", and then I get

Permission denied (publickey,password,keyboard-interactive).

My ~/.drush/aliases.drushrc.php file contains:

# Development #
$aliases['dev'] = array(
  'uri' => 'http://default',
  'root' => '/var/www/vhosts/dev.www.company.com/current/',
  'remote-host' => 'companya0.company.com',
  'remote-user' => 'myusername'

# UAT #
$aliases['uat'] = array(
  'uri' => 'http://default',
  'root' => '/var/www/vhosts/uat.www.company.com/current/',
  'remote-host' => 'companyc6.company.com',
  'remote-user' => 'myusername'

# Production #
$aliases['prod'] = array(
  'uri' => 'http://default',
  'root' => '/var/www/vhosts/www.company.com/current/',
  'remote-host' => 'companyc1.company.com',
  'remote-user' => 'myusername'

ONLY Drush has any problem using my ssh keys. What could be preventing it from working?

  • 3
    I guess it depends which user Drush is being run from. If Drush is being run by www-data (for example), then your SSH keys may be wrong/disallowed/non-whitelisted. – Chapabu Oct 5 '12 at 15:29
  • 4
    Run your drush commands with the -v or -s option to see the exact ssh command that Drush is generating for you. It should be clear from that what the difference is between the Drush invocation of ssh and your cli test of the same. – greg_1_anderson Oct 5 '12 at 16:32
  • @Chapabu: Yes, I have to use sudo before drush and it appears everything is running as root (a security hole I've alerted the sysadmin about). It appears that this is the problem. I'm currently looking for a solution while I wait for the sysadmin... – iconoclast Oct 5 '12 at 20:10

Put this line in your drushrc.php file:

$options['ssh-options'] = '-o PasswordAuthentication=no -i /home/YOURUSERNAME/.ssh/id_rsa';

This will cause Drush to pass these options along to ssh any time it calls your remote system, so you can continue to call Drush via sudo, and still use your login user credentials.

  • Dude you're awesome... – iconoclast Oct 8 '12 at 2:13
  • Example for Windows: $options['ssh-options'] = '-o PasswordAuthentication=no -i C:\users\laptop1\.ssh\id_rsa'; – Bryan Jiencke Oct 6 '14 at 1:33
  • if correctly understood, the "/home/YOURUSERNAME/.ssh/id_rsa" dir is local to where the drush command is executed. The "home/YOURUSERNAME" dir is the $HOME dir and id_rsa is the private key iteself generated via ssh-keygen – latvian Oct 23 '14 at 20:30

Check here: How to run Drush as Apache

By the sound of it you just need to get the owner/group changed for Drush on your server!

  • This might be the ideal solution... but I'll have to get the sysadmin to agree before I can get things set up this way. – iconoclast Oct 8 '12 at 2:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.