Running bash script from an user of the same group that connects to a server using SSH-key from another user of the same group

Question

I made a script like this one:

sync.sh
#!/bin/bash
#1st backup the file
scp user-1@ip-1:/directory/file1 /backup/location/
#2nd sync/overwrite my file to that server
scp /local/file2 user-1@ip-1:/directory/file1
#3rd restart service associated with that file
ssh -t user-1@IP-1 << EOF
  sudo systemctl restart some.service
EOF

the script permission and privileges is as following:

-rwxr-x--x. 1 user-1 group-1 ~/sync.sh

I have ssh-keys configured between user-1@local to user-1@IP-1, I have configured visudo to restart the service and everything works great if I run the script using user-1.

I want any other_user in group-1 be able to run this script, but the ssh-key doesn't work in this way, it tries to generate another key. What am I missing to do this?

Or should I use a different approach? I've seen that I could use rsync for moving files around but what about restarting the service?

thank you all.

Answer 1

This is not a secure way of doing things.

A key is what authenticates users.

1. Give each user their own key, or everyone can simply login as anyone else simply by using another username.

2. Modify your script so each username is fetched from the environment variable.

3. Use auth-agent to manage keys. This way you won't have to put paths to the keys in your script.

4. Lots of servers and lots of users?

   • You should probably look at Kerberos and PAM.

   • Another option is to make a script to add your list of users to the sudoers file, and pipe that script to a superuser shell on each server over ssh.