[Bug 2206] New: ssh-copy-id fails with message 'Ambiguous output redirect.' with a non-sh style remote shell

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=2206

            Bug ID: 2206
           Summary: ssh-copy-id fails with message 'Ambiguous output
                    redirect.' with a non-sh style remote shell
           Product: Portable OpenSSH
           Version: 6.5p1
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: ssh-copy-id
          Assignee: unassigned-bugs at mindrot.org
          Reporter: plautrba at redhat.com

This is originally Fedora bug
https://bugzilla.redhat.com/show_bug.cgi?id=1045191 but it's also
applicable to the vanilla sources:

Description of problem:
When using ssh-copy-id to copy the ssh public key to a remote server,
if the account on the remote server uses a shell that is not based on
sh or bash (like tcsh), then the script will fail with the message
'Ambiguous output redirect.'. This message is caused by the redirection
of STDOUT and STDERR using the sh syntax 2>&1 which is invalid for
tcsh.

Specific details:
In the file /usr/bin/ssh-copy-id at line 275 we have the following:

if type restorecon >/dev/null 2>&1 ; then restorecon -F .ssh
.ssh/authorized_keys ; fi" \

This command is being executed on the remote machine using the default
shell of the remote account. If the remote shell is tcsh (or any other
shell that doesn't support the 2>&1 syntax), the
     if type restorecon >/dev/null 2>&1 ;
command fails.

Version-Release number of selected component (if applicable):
6.2p2-6.fc19

How reproducible:
Always

Steps to Reproduce:
1. Create an account on a remote machine using tcsh for the shell (or
any other shell that doesn't support the 2>&1 syntax)
2. Generate an ssh key on the local machine
    ssh-keygen -t rsa -b 2048
3. Run ssh-copy-id on the local machine (the command below assumes the
login id is the same on both machines
    ssh-copy-id x.x.x.x

Actual results:
The script exits with
    Ambiguous output redirect.

Expected results:
The script successfully runs with 
    Number of key(s) added: 1

    Now try logging into the machine, with: "ssh 'x.x.x.x'"
    and check to make sure that only the key(s) you wanted were added.

Additional info:
I was able to fix this bug by basically specifying that the ssh command
should use the sh shell instead of the default shell of the remote
account. The changes I made to the ssh-copy-id script are as follows:

Starting at line 273, change the lines
    umask 077 ;
    mkdir -p .ssh && cat >> .ssh/authorized_keys || exit 1 ;
    if type restorecon >/dev/null 2>&1 ; then restorecon -F .ssh
.ssh/authorized_keys ; fi" \

To the following single line - add "exec sh -c" at the beginning and
surround the commands in single quotes
    exec sh -c 'umask 077 ; mkdir -p .ssh && cat >>
.ssh/authorized_keys || exit 1 ; if type restorecon >/dev/null 2>&1 ;
then restorecon -F .ssh .ssh/authorized_keys ; fi'" \

I'm not sure if this is the best fix, but it works regardless of the
remote shell.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.