Permission denied (publickey,password) on SSH connection when run as a service

Question

I have a bash script, /home/localuser/backup-script.sh, with this snippet inside of it:

rsync -avzh \
  -e "ssh -i /home/localuser/.ssh/id_ed25519" \
  /home/localuser/backups/file-to-backup.gz \
  [email protected]:/home/remoteuser/backups

If I run it directly from shell, everything works like a charm, while if I run it through a systemd service I configured, I get the error [email protected]: Permission denied (publickey,password).

This is the service (/etc/systemd/system/backup.service) I configured:

[Unit]
Description=Trigger script to perform backup

[Service]
Type=oneshot
User=localuser
ExecStart=/bin/bash /home/localuser/backup-script.sh

[Install]
WantedBy=multi-user.target

And I usually run it via a timer, but I also get the same error if I start it directly via sudo systemctl start backup.service

The ssh service is correctly setup, as confirmed by the success I have running the script directly, or also by launching ssh [email protected].

I cannot figure out what is going on... any clue?

Additional info: I get same error replacing rsync with scp

---

Edit:

Following the Stewart's comment I tried to directly launch the script by running this command env -i /bin/bash --norc --noprofile backup-script.sh and in this case I'm prompted for the ssh key passphrase, so the problem is exactly what Stewart's comments are pointing to.

To work-around the problem with a simple solution (so avoiding to add ssh-agent as service, automatic keys loading, and automatic passphrase entering on boot), I changed the rsync command in my script, replacing the second line (-e ...) with this one: --rsh="/usr/bin/sshpass -p remoteuser_pwd ssh -o StrictHostKeyChecking=no -l remoteuser":

The result is similar: if I launch it directly, it works fine. If I launch it via the service it doesn't work: but this time with no errors, it simply hangs. And if I launch it by env -i /bin/bash --norc --noprofile backup-script.sh it hangs too, in the same way.

Changing the backup.service by adding --login in this way ExecStart=/bin/bash --login /home/localuser/backup-script.sh won't solve the issue.

Answer 1

I don't have an answer to fix your specific problem, but you can add verbose output to the ssh command to debug more relating to its use of ssh keys:

rsync -avzh \
  -e "ssh -vvv -i /home/localuser/.ssh/id_ed25519" \
  /home/localuser/backups/file-to-backup.gz \
  [email protected]:/home/remoteuser/backups

The -vvv wil make ssh spew a bunch of output to stdout related to the connection, ssh config and ssh keys. Pipe the output from an interactive run that works to a file and then pipe the output of the service (not working) to a file. Read both files using a difference utility. I recommend vimdiff if you are comfortable with vim. This should at least give you an indication of where something differs and is going wrong.

EDIT: I think rsync defaults to ssh now, and you could put an entry for the remote host in ~/.ssh/config. This should configure any ssh session (including rsync) to use the provided identity/key and other host specific options you'd like.