5

I am writing a script that will allow me to retrieve a file from all of my servers at once. I have SSH keys in place in order to log into my servers. My SSH key however requires a password.

The script I am writing will not be automated, it will only ever be run manually. So my script prompts the user for the SSH key password.

How can I send the password to the SSH key as it connects to each server. I am trying to avoid having to type my password in for each server.

I know I could use 'expect', but am hoping there is a simple way to do this. Maybe some environment variable?

Thanks.

Improve this question

5 Answers 5

Reset to default
16

Why not use ssh-agent for this?
See the man page for additional details. :)

Improve this answer
8
  • To be honest, I've never felt that ssh-agent was a secure idea. I don't really like the idea of it storing my keys. I am probably being overly paranoid though.
    – mhost
    Jan 26, 2011 at 19:15
  • 2
    The alternative you're proposing is providing a method of getting the encrypted key and password to decrypt it from the filesystem. I can't readily imagine a circumstance in which this is less secure than the unencrypted key being held within a program's memory.
    – Jeff Ferland
    Jan 26, 2011 at 19:17
  • 1
    Please describe your security concerns with ssh-agent. (ssh-agent doesn't "store" your key)
    – Alex Holst
    Jan 26, 2011 at 19:18
  • 2
    the agent is at least as secure as putting your password in a file (more secure if the file isn't mode 600 or more restricted), and far more secure than letting it sit in a shell/environment variable :-) -- If you're paranoid you can always kill off the agent when your script is done.
    – voretaq7
    Jan 26, 2011 at 19:18
  • I agree with voretaq7. Your passphrase will have to be stored in plaintext somewhere. At that point it's not more secure than having an unencrypted private key in the first place.
    – SmallClanger
    Jan 26, 2011 at 19:22
1

I would use a SSH key that doesn't have a passkey. It may be less secure, but any method that will allow unattended use will have the same flaw.

Improve this answer
1

Here are my 2 cents!

  • I have a USB drive that is always with me (in my physical key chain).
  • I make a second partition of 5 insignificant MB in it. This partition is an encrypted ext4 partition.
  • I store my private key (without passkey) in that encrypted partition.
  • In my computer I store the password to decrypt this partition in the file manager (I use dolphin) so if I plug the USB drive I can mount the encrypted partition with two single clicks, and if I plug the USB drive in another computer I can mount it typing the password.
  • Again in my computer I have symlinked my private keys from it usually are (~/.ssh/id_rsa) to where they are when mounted with the USB drive. So once mounted I can make a usual ssh without password.
  • If I am in another computer I can tell ssh where my key is with the -i flag

This way I can:

  • Login comfortably from my everyday computer
  • Log in with a single password from any linux machine
  • Have my private keys always safe with me and in a encrypted filesystem
Improve this answer
0

Expect is the solution that comes to mind first...

Check this script example, as it is close to what you're looking for.

Improve this answer
3
  • Expect, and any other form of scripting, is a really poor solution to this problem.
    – Alex Holst
    Jan 26, 2011 at 19:13
  • Yeah I thought of that too, but I was just wondering if there was a simple way. Like you can do with gpg passwords.
    – mhost
    Jan 26, 2011 at 19:15
  • Obviously there are security issues in this case, but expect is a useful tool for people to know about.
    – pjc50
    Mar 2, 2011 at 13:33
0

Easiest solution is installing package sshpass and use it like:
sshpass -p password ssh -i keyfile.pem user@server

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .