Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A server allows SSH connections, but not using public key authentication. It's not within my power to change this at the moment (due to technical difficulties, not organizational) but I will get on it as soon as possible!

What I need now is to execute commands on the server using plain old account+password authentication from a script. That is, I need to do it in a non-interactive way. Is it possible? And how do I do it?

The client which will be executing the script runs Ubuntu Server 8.04. The server runs Cygwin and OpenSSH.

share|improve this question
2  
What are the technical difficulties with enabling key-based authentication? Perhaps you should be asking that question instead, or in addition to this one. –  Zoredache Apr 14 '10 at 18:18
1  
I am asking it. :-) serverfault.com/questions/125842/… I simply need an escape route for now, as I have been banging my head on that one for a while. But of course my goal is to get it working in the long run. –  Deleted Apr 14 '10 at 18:29

3 Answers 3

up vote 9 down vote accepted

There is a linux utility called sshpass. It allows you to do exactly what you want and will take a server password either as a command line argument, or from a file (i prefer this way, so i do not have my server password show up in shell history) and you use it like so:

sshpass -f file_with_password ssh user@server ls -la

This will ssh into a server and run ls -la. One thing, however, you have to manually ssh into a server first (if you haven't done so already), so the server gets added to your ~/.ssh/known_hosts. If you don't do that, sshpass will not work.

share|improve this answer
1  
This is not a standard part of OpenSSH, and literally none of my machines (Mac OS X 10.7, Ubuntu 12.04, FreeBSD 8, Debian 3.1) have it... –  voretaq7 Aug 2 '12 at 14:59
    
@voretaq7: sshpass is a SourceForge project: sourceforge.net/projects/sshpass –  kevinarpe Jan 24 '13 at 10:33
    
@KCArpe I think you missed my point ("The entire world isn't your Linux machine - try to pick solutions that work in other places"). Using the SSH_ASKPASS variable is a more generic solution that works on any system with OpenSSH, and doesn't require installing additional software. For some of us (in regulated industries) installing new software triggers a lot of administrative work. –  voretaq7 Jan 24 '13 at 16:23
    
@voretaq7 Using SSH_ASKPASS does not work on all systems. Even if the client supports it, it won't work if the server uses keyboard-interactive. I have actually faced that problem when writing a script to distribute an authorized_keys file to a number of embedded machines. –  kasperd Aug 17 at 19:55

You can use Expect to do this. Obviously, this isn't preferable from a security standpoint, because it will require you to use a script that contains your password in plaintext. (But I won't belabor that point since you said in your question that you plan to use public key authentication as soon as possible!)

share|improve this answer
    
This looks like it will solve my problem! I'll check it out tomorrow. It's not the final solution, but it offers some security. When I think about it, if the script user is the only one allowed to read the script. Then it will be as secure as my private key which is also "only" protected by file system permissions. Or did I miss something? –  Deleted Apr 14 '10 at 18:36
    
I'll get back with results tomorrow. :-) Thank you for answering! –  Deleted Apr 14 '10 at 18:36
    
It seems to work. But sshpass was easier for this specific case IMHO. –  Deleted Apr 19 '10 at 14:53

Depends a bit on the script language you use. I script almost everything in python now, where this is a non-issue. Both pyssh and Paramiko lets you simply script the password with no fuss.

If you intend to do it with (ba)sh scripts and use OpenSSH it gets harder. OpenSSH explicitly prevents you from putting passwords on the command line (as all users can see the command line using something like ps -fe, which is bad mojo). In this case you will have to interact directly with the ssh program and have two options:

  • You can write a considerable amount of support code, using something like Expect.
  • You make a hack using the SSH_ASKPASS variable, telling it to call an application returning your password and run it all as a batch job to prevent it from reading from the terminal.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.