TriggerHappy and ssh

Question

SSH is enabled on my Pi. I'm trying to use my Pi as a remote control, where I hit a keyboard hotkey on my Pi, and my Pi sends a command to my Mac. For example: if I enter the following in terminal on my Pi, it launches an applescript on my Mac, and my Mac starts playing a New Music playlist in iTunes (I've even set up an ssh key so I don't need to enter my password):

/usr/bin/ssh Me@192.168.1.5 osascript Applescripts/iTunes/NEW_MUSIC.scpt

It works perfectly if I enter the above manually, but I can't figure out how to get it to work with the TriggerHappy daemon. /usr/bin/curl commands work like a charm for me with TriggerHappy. /usr/bin/ssh doesn't work and I can't figure out why.

Example: The following item in TriggerHappy turns on my Philips Hue lights when I type CTRL+1 on my Pi:

KEY_1+KEY_LEFTCTRL  1   /usr/bin/curl --request PUT --data "{\"scene\":\"Zq-7IOofWYEVAx6\"}" http://192.168.1.5/api/myhuelights/groups/0/action/

The above works, so why doesn't this?

KEY_1+KEY_LEFTCTRL  1   /usr/bin/ssh Me@192.168.1.5 osascript Applescripts/iTunes/NEW_MUSIC.scpt

Any idea what I'm doing wrong here?

EDIT: to be clear, I'm trying to figure out why this works on my Pi in terminal:

/usr/bin/ssh Me@192.168.1.5 osascript Applescripts/iTunes/NEW_MUSIC.scpt

...and this works on my Pi using TriggerHappy:

KEY_1+KEY_LEFTCTRL  1   /usr/bin/curl --request PUT --data "{\"scene\":\"Zq-7IOofWYEVAx6\"}" http://192.168.1.5/api/myhuelights/groups/0/action/

...but this doesn't work on my Pi using TriggerHappy:

KEY_1+KEY_LEFTCTRL  1   /usr/bin/ssh Me@192.168.1.5 osascript Applescripts/iTunes/NEW_MUSIC.scpt

I'm working with a new install of Raspbian on a new Raspberry Pi. Like I said, my curl commands work with TriggerHappy, but ssh commands don't. I feel like I'm probably overlooking something simple here. I hope?

Answer 1

You type ssh Me@192.168.1.5 and successfully log in to your Mac, but you didn't say how ssh gets access to the private key you need to log in. Typically it will either prompt you for the passphrase for your keyfile (which file it will then decrypt and load) or it will use a key that you've previously loaded into an agent.

The problem you're running into is that the TriggerHappy daemon, thd, is not running as you but is running as user nobody. Thus it doesn't have your environment (for example, $HOME is different) and, even if it could find the file with your key in it, it can't type a passphrase.

Fixing this without breaking SSH security isn't trivial. To do it properly you need to do the following:

1. Generate a new SSH private key that will be used only by user nobody on this particular host (your Raspberry Pi) and store it in a file without a passphrase:

ssh-keygen -b 2048 -C thd-pi-170416 -f thd-pi-170416.priv </dev/null

(Giving /dev/null as stdin avoids asking for a passphrase to encrypt the key, and you'll note I put the date in the comment to make the key easier to identify.) Note that this key isn't tied to any particular user; it's just a key that can be used with the -i option to ssh by any user that can read that file.

You'll also need the public key, which you can get with

ssh-keygen -y -f thd-pi-170416.priv

When you later insert it into authorized_keys files it's helpful to append a space and your key comment (from above) to the line to help identify the key more easily.

Put the private key file somewhere for thd to read; make sure that this file is readable by user nobody but not by anybody else, and ensure that nobody but root can write to any of the directories leading up to that file. You'll pass this key to ssh with the -i command-line option.

2. Edit the $HOME/.ssh/authorized_keys file on your Mac to add this key, but restrict what can be done with the key with a configuration similar to this:

no-port-forwarding,no-X11-forwarding,no-pty,from="192.168.1.4",command="osascript Applescripts/iTunes/NEW_MUSIC.scpt" 

This does the following:

• Disables port and X11 forwarding for reasons I won't get into here. (You're not using either of these features and aren't likely to in this application.)
• Disables pty allocation because you're expecting logins only from automated programs that don't need terminal handling.
• Restricts logins to come from only 192.168.1.4; you should replace this with the address of your Pi.
• Ignores whatever's specified on the ssh command line and runs only the command given by command=.

All of these things work together to minimize the damage that can be done if someone gets hold of that key. Remember that, because it's an automated program using that key file there's no passphrase on it, so anybody who can somehow manage to read that file then has that key and can attempt to use it for whatever they like.

If you need run two or three different commands you could make two or three different keys, but this would soon become tedious. Better is to write a small program that reads its standard input and very carefuly extracts information about what to run from that. For example, it might take commands such as play foo.mp3, being careful to make sure that there's nothing weird in the filename it's parsing and using. (You certainly don't want to write this in Bash, and you probably want to do things such as use only files from a specific directory and not allow slashes so people can't "sneak out" with a path like ../.ssh/id_rsa, play your (personal) private key over the radio, and then use clever tricks to guess your private key from that.)

Answer 2

I answered my own question. Change the triggerhappy default user to pi or root. On the Pi, it's at:

/etc/default/triggerhappy

Simply uncomment the user option to change it from nobody to root, as explained in the file:

# The Triggerhappy daemon (thd) drops its root privileges after
# startup and becomes "nobody". If you want it to retain its root
# status (e.g. to run commands only accessible to the system user),
# uncomment the following line or specifiy the user option yourself:
#
# DAEMON_OPTS="--user root"

Uncomment that last line & relaunch triggerhappy. It's as simple as that. This may not serve everyone's use, but in my case it's perfect because my Pi has only one purpose: It serves as a control, connecting my IoT stuff to a universal remote using a usb Flirc IR receiver. So, I press a button on my universal remote, and Flirc tells my Pi to do keystroke Control+1, which triggerhappy then turns into a command.

Answer 3

Not sure if I understand correctly your question, but it seems that you first need to enable SSH on you Raspberry Pi. Raspbian has the SSH server disabled by default.

Raspberry Pi has a great documentation about this specific issue. Follow it here: https://www.raspberrypi.org/documentation/remote-access/ssh/

Cheers,