up vote 2 down vote favorite
share [g+] share [fb]

I am writing a script that will allow me to retrieve a file from all of my servers at once. I have SSH keys in place in order to log into my servers. My SSH key however requires a password.

The script I am writing will not be automated, it will only ever be run manually. So my script prompts the user for the SSH key password.

How can I send the password to the SSH key as it connects to each server. I am trying to avoid having to type my password in for each server.

I know I could use 'expect', but am hoping there is a simple way to do this. Maybe some environment variable?

Thanks.

link|improve this question
67% accept rate
feedback

3 Answers

up vote 10 down vote accepted

Why not use ssh-agent for this?
See the man page for additional details. :)

link|improve this answer
To be honest, I've never felt that ssh-agent was a secure idea. I don't really like the idea of it storing my keys. I am probably being overly paranoid though. – mhost Jan 26 '11 at 19:15
2  
The alternative you're proposing is providing a method of getting the encrypted key and password to decrypt it from the filesystem. I can't readily imagine a circumstance in which this is less secure than the unencrypted key being held within a program's memory. – Jeff Ferland Jan 26 '11 at 19:17
Please describe your security concerns with ssh-agent. (ssh-agent doesn't "store" your key) – Alex Holst Jan 26 '11 at 19:18
2  
the agent is at least as secure as putting your password in a file (more secure if the file isn't mode 600 or more restricted), and far more secure than letting it sit in a shell/environment variable :-) -- If you're paranoid you can always kill off the agent when your script is done. – voretaq7♦ Jan 26 '11 at 19:18
I agree with voretaq7. Your passphrase will have to be stored in plaintext somewhere. At that point it's not more secure than having an unencrypted private key in the first place. – SmallClanger Jan 26 '11 at 19:22
show 3 more comments
feedback
up vote 1 down vote

I would use a SSH key that doesn't have a passkey. It may be less secure, but any method that will allow unattended use will have the same flaw.

link|improve this answer
feedback
up vote 0 down vote

Expect is the solution that comes to mind first...

Check this script example, as it is close to what you're looking for.

link|improve this answer
Expect, and any other form of scripting, is a really poor solution to this problem. – Alex Holst Jan 26 '11 at 19:13
Yeah I thought of that too, but I was just wondering if there was a simple way. Like you can do with gpg passwords. – mhost Jan 26 '11 at 19:15
Obviously there are security issues in this case, but expect is a useful tool for people to know about. – pjc50 Mar 2 '11 at 13:33
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.