How to pass password to scp command used in bash script?

Question

I have a bash script that makes dump of DB then copies file from one server to another but it always asks for password before connection.

scp file.tar.gz root@xxx.xxx.xxx.194:/backup

Is there a way to pass password directly into script ?

Answer 1

Rather than using root create an account just for this job. Use public keys without a passphrase instead of passwords.

scp -i /home/backupuser/.ssh/id_rsa backupuser@xxx.xxx.xxx.194:/backup

By using a special account for the backup on the destination system you are not exposing your root password.

Answer 2

scp uses SSH to tunnel to a remote server and transfer files. SSH can authenticate users with a password, an SSH key or both (recommended).

To transfer files without a password, create an SSH key for the user you're going to use (root is not recommended, use an unprivileged user instead and have a job on the target server as root to perform the privileged action).

Then you need to configure the target system's SSH daemon to accept SSH key connections (also in above link).

Bear in mind that compromised SSH keys without a password are the same as compromised passwords - anybody can get in. For real users, it's better to double the security and require the key and a password.

Answer 3

pscp allows you to pass the password to it directly - just use the -p arguement. Alternately, and this is a better idea, use ssh agent and set up key based logon - this is more secure. There's a howto on setting up ssh to use key based logon here

You can use the yes command to send a yes to the program.

Answer 4

The usual way to do this is to setup keys appropriately ahead of time. Passing a password on a command line or in a shell script is generally considered quite insecure, as (depending on the system), the password may be visible to anyone who does a 'ps' on the system.

If you really can't setup keys, and you've arranged things on both ends such that you don't care if someone gets the password, then you could try passing it to the input of scp like this:

echo "mypassword" | scp file.tar.gz root@<whatever>:/backup

However, given that you've got the root account as your target, I'm gonna say this is a REALLY bad idea, because scp runs over-top of the ssh protocol, which means anyone who can scp files in there can usually log in using ssh with the same password.

Instead, you should be setting up a set of private keys that allow the server doing the scp to push files to a particular directory on the target server. I'd also recommend NOT using the root account on the target server - instead, create a separate account that has minimum privileges, and is just used to receive these transfers. That minimizes your exposure on the target box in case of something going wrong.

Answer 5

It's better to set up ssh to used key-based authentication rather than trying to figure out how to send text to the login process with something like expect.

Take a look at:

https://help.ubuntu.com/community/SSH/OpenSSH/Keys

So, basically, run ssh-keygen -t dsa on the machine that will run your script. When it asks you for a passphrase, hit ENTER to accept a blank. You will get two files. If you followed the default suggestions, the files will be ~/.ssh/id_dsa and ~/.ssh/id_dsa.pub. The first one is the private key. The second one is the public key.

Copy the public key to the second server using ssh-copy-id user@server2. This will add the public key to the authorized_keys file of the user on server2.

You should now be able to run ssh from the first machine and log in without a password.

For copying the files, scp or rsync are fine. It depends on what you're doing. rsync will use ssh by default, so will use the key-based authentication you just set up.

Answer 6

You should not use password-less ssh-keys for security reasons.

The tool keychain can help you re-use the ssh-agent and run rsync over ssh in scripts without being prompted for passwords.

To install it on a Ubuntu machine just run the following command.

sudo apt-get install keychain

Check out the manpage for keychain for more information on how to use it.