Unable to connect with Net_SSH2 from inside Apache

Question

I am attempting to SSH from PHP but I get the following error:

Notice: Cannot connect to [host]. Error 13. Permission denied in /usr/share/php/Net/SSH2.php on line 875

Here is the code:

<?PHP
error_reporting(E_ALL);
ini_set('display_errors', TRUE);
include_once('Net/SSH2.php');
define('NET_SSH2_LOGGING', NET_SSH2_LOG_COMPLEX);

$ssh = new Net_SSH2($host);

if( $ssh->login($id, $pw) )
{
  error_log("logged");
  $result['data'] = $ssh->exec('dir');
}
else
{
  error_log( $ssh->getLog() );
}
?>

But when I run this same code from the command line with apache out of the mix it runs fine.

I have the EXACT same problem with a python script that uses paramiko to SSH and is called from apache. It runs fine from command line but fails with a permission error when called from PHP in apache. Using this script was just a test; python will not be used in the final solution.

So, why is SSH working outside apache but not from within? I have used su to run the PHP code as apache from the command line and that also works, so it is not a user permission problem.

UPDATE:

AAaarrrggh! Bitten again by SELinux. This page had the solution: php run git got "ssh Permission denied"

The answer is:

setsebool -P httpd_can_network_connect=1

Basically, apache was not authorized to initiate network connections!?!?

I neglected to mention that this is on a CentOS system and as such fell under the watchful caring eye of SELinux, my mistake.

I'm confused. How is apache ever involved? Are you typing a url in the browser, and that url leads to this code? — Kirk, Jul 02 '14 at 19:29
The code is part if a password update in a web app and the 'dir' line will be replace with commands sent to an active directory server. WHY is the question... why the error with apache vs command line has me stumped. I am the developer and yes, a url is used to execute the code. — wesmat, Jul 03 '14 at 12:06

score 6 · Answer 1 · answered Jul 04 '14 at 15:07

6

The answer is:

setsebool -P httpd_can_network_connect=1

Basically, apache is not authorized to initiate network connections

answered Jul 04 '14 at 15:07

saintteift

69
1

1

Well, that's why you gotta add an answer yourself rather than just updating the question :-) – Spencer Williams Sep 15 '15 at 15:18

score 4 · Accepted Answer · answered Feb 01 '16 at 17:46

AAaarrrggh! Bitten again by SELinux. This page had the solution: php run git got "ssh Permission denied"

The answer is:

setsebool -P httpd_can_network_connect=1

Basically, apache was not authorized to initiate network connections!?!?

I neglected to mention that this is on a CentOS system and as such fell under the watchful caring eye of SELinux, my mistake.

Unable to connect with Net_SSH2 from inside Apache

2 Answers2