Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am writing a script that will allow me to retrieve a file from all of my servers at once. I have SSH keys in place in order to log into my servers. My SSH key however requires a password.

The script I am writing will not be automated, it will only ever be run manually. So my script prompts the user for the SSH key password.

How can I send the password to the SSH key as it connects to each server. I am trying to avoid having to type my password in for each server.

I know I could use 'expect', but am hoping there is a simple way to do this. Maybe some environment variable?

Thanks.

share|improve this question

3 Answers 3

up vote 10 down vote accepted

Why not use ssh-agent for this?
See the man page for additional details. :)

share|improve this answer
    
To be honest, I've never felt that ssh-agent was a secure idea. I don't really like the idea of it storing my keys. I am probably being overly paranoid though. –  mhost Jan 26 '11 at 19:15
2  
The alternative you're proposing is providing a method of getting the encrypted key and password to decrypt it from the filesystem. I can't readily imagine a circumstance in which this is less secure than the unencrypted key being held within a program's memory. –  Jeff Ferland Jan 26 '11 at 19:17
    
Please describe your security concerns with ssh-agent. (ssh-agent doesn't "store" your key) –  Alex Holst Jan 26 '11 at 19:18
2  
the agent is at least as secure as putting your password in a file (more secure if the file isn't mode 600 or more restricted), and far more secure than letting it sit in a shell/environment variable :-) -- If you're paranoid you can always kill off the agent when your script is done. –  voretaq7 Jan 26 '11 at 19:18
    
I agree with voretaq7. Your passphrase will have to be stored in plaintext somewhere. At that point it's not more secure than having an unencrypted private key in the first place. –  SmallClanger Jan 26 '11 at 19:22

I would use a SSH key that doesn't have a passkey. It may be less secure, but any method that will allow unattended use will have the same flaw.

share|improve this answer

Expect is the solution that comes to mind first...

Check this script example, as it is close to what you're looking for.

share|improve this answer
    
Expect, and any other form of scripting, is a really poor solution to this problem. –  Alex Holst Jan 26 '11 at 19:13
    
Yeah I thought of that too, but I was just wondering if there was a simple way. Like you can do with gpg passwords. –  mhost Jan 26 '11 at 19:15
    
Obviously there are security issues in this case, but expect is a useful tool for people to know about. –  pjc50 Mar 2 '11 at 13:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.