How do you create an ssh key for the apache user on Redhat?

Question

As the question asks, how do I generate an ssh key for the user apache on Redhat?

My use case, is that we have a mercurial server running under the apache user. We also have several web servers clustered that we need to log on to manually and do pulls from. Ideally, what we'd like to do is have the mercurial server push all changes to all the webservers in the cluster. To do this, we want to use ssh, as setting up http mercurial servers on each of the web servers seems like too much work, and far too heavy.

What I've tried to do is the following:

> sudo mkdir /var/www/.ssh
> sudo chown -R apache:nobody /var/www/.ssh
> su - apache -c "ssh-keygen -t rsa"
    This account is currently not available.

I found the above commands elsewhere, but I can only assume that Redhat has differences to whatever distro was used for the above. Is there a way I can generate an ssh-key for the apache user?

Solution

Ok, I wasn't far off and I found a great resource which steps through the exact steps.

http://www.boredworkers.com/2009/08/24/script-tips-ssh-key-for-apache/

> sudo mkdir /var/www/.ssh
> sudo chown -R apache:nobody /var/www/.ssh
> sudo -u apache ssh-keygen -t rsa

I think I need to investigate the correct switches to use instead of relying on blog posts.

Comments

[ScottZ]

Just an FYI, I assume your /var/www is available to the world. I highly recommend not putting your private key in that directory. There is no reason why it has to be under /var/www. Also there is no reason to over load the apache user for this syncing you are doing. I would use a different account that can also read the files or even use root. If you are pushing to each server using ssh all you need to do is add your public key into the authorized_keys for the accounts you are pushing to.

[Josh Smeaton]

@ScottZ The webserver on which I'm doing this is only on the private network, and it's not set up to serve anything other than HG. I don't believe .ssh is exposed, but I'll confirm that thanks. Unfortunately, apache is the user that does the pushing, which is triggered from an external push. It ssh's to a local account, but as far as I'm aware, since it is initiating the ssh, the key must be supplied by apache. If there was a way around having apache do the ssh, I'd take it!