Good.

ssh uses your ~/.ssh/id_rsa file to log in without a password. The server you want into compares that with a key you gave it. ssh is extremely particular about who is allowed to read this file -- for your webserver to use it, it needs its own copy that belongs to it and can't be read by anybody else. If it thinks the security is lax enough for the key to be stolen, ssh will refuse to operate passwordlessly.

In a root terminal, do this once:

Code:

# Create a safe place for apache to get the key.
mkdir /etc/apache-key
# Make sure it belongs to the web server.
chown apache:apache /etc/apache-key
# Copy the key.
cp /home/username/.ssh/id_rsa /etc/apache-key
# Make it belong to apache and nobody else.
chown apache:apache /etc/apache-key/id_rsa
# Make sure ONLY the apache can read it.
chmod 0400 /etc/apache-key/id_rsa
# Make sure ONLY apache can even get in.
chmod 0700 /etc/apache-key

It might be id_dsa instead of id_rsa, but dsa keys are old now.

Then, in your cgi script, you would run ssh -i /etc/apache-key/id_rsa username@host ls /dir/ and, if everything's where it belongs and has the right permissions, ssh should be able to get in without a password.