title: Why is EC2 not pulling updates from bitbucket/github via post-receive hook?
body: <p>Before moving to EC2, I would push commits to a bitbucket repo and have a post-receive hook pull them to the server: after a commit, the url <a href="http://mywebsite.com/update.php" rel="nofollow noreferrer">http://mywebsite.com/update.php</a> is called, where update.php is:</p>
  <pre><code>    &lt;?php `git pull`; ?&gt;
  </code></pre>
  <p>That used to work like a charm.  However, it's not working on EC2 and I'm not sure why.</p>
  <p>I tried the following:</p>
  <ol>
  <li><p><code>sudo chmod +x update.php</code> This should make update.php executable.</p>
  </li>
  <li><p>Changed update.php to</p>
  <pre><code> &lt;?php `sudo git pull`; ?&gt;
  </code></pre>
  </li>
  <li><p>Changed update.php to</p>
  <pre><code> &lt;?php `sudo -s`; `git pull`; ?&gt;
  </code></pre>
  </li>
  <li><p>Changed update.php to</p>
  <pre><code> &lt;?php `sudo -s git pull`; ?&gt;
  </code></pre>
  </li>
  </ol>
  <p>I think it has something to do with permissions, because when I'm on my instance via ssh, I can run &quot;git pull&quot; as ec2-user. Also, &quot;git pull&quot; works when I'm the root user.</p>
  <p>How can I get it to work? I think it was something to do with permissions.</p>
  <h2>Update</h2>
  <p>I did some troubleshooting (thanks for the tips @cyberx86) and found the following:</p>
  <p>I was able to execute the update hook on the command line by running <code>php update.php</code> and it worked why I was root, but not when I was ec2-user.  The error log showed</p>
  <blockquote>
  <p>error: cannot open .git/FETCH_HEAD: Permission denied</p>
  </blockquote>
  <p>so I ran the command <code>chmod -R 777 .git</code> as the root user.</p>
  <p>Now I'm able to pull updates via <code>git pull</code> and <code>php update.php</code> on the command line, but it's not working when I do it through the post-receive hook or when I point my browser to url/update.php.  The error log shows</p>
  <blockquote>
  <p>Host key verification failed.^M<br />
  fatal: The remote end hung up unexpectedly</p>
  </blockquote>
  <p>I think this means that whichever user runs the command when it's accessed via a browser doesn't have an ssh key set up, so it looks like the shell command is running, but the remote repository is not letting that user pull.</p>
  <p>As per @cyberx86's advice, I checked out the users in /etc/passwd and while there is no PHP user, there is an user named apache: <code>apache:x:48:48:Apache:/var/www:/sbin/nologin</code> and then I ran <code>sudo -u apache php -q update.php</code> and got the following message</p>
  <blockquote>
  <p>Could not create directory '/var/www/.ssh'.</p>
  <p>The authenticity of host 'bitbucket.org (207.223.240.181)' can't be established.</p>
  <p>RSA key fingerprint is REDACTED</p>
  <p>Are you sure you want to continue connecting (yes/no)? yes</p>
  <p>Failed to add the host to the list of known hosts (/var/www/.ssh/known_hosts).</p>
  <p>Permission denied (publickey).</p>
  <p>fatal: The remote end hung up unexpectedly</p>
  </blockquote>
  <p>So it seems like it's a matter of setting up a ssh key for the user (presumably apache) that runs the shell script via browser.</p>