Connect through SSH and type in password automatically, without using a public key

Question

A server allows SSH connections, but not using public key authentication. It's not within my power to change this at the moment (due to technical difficulties, not organizational) but I will get on it as soon as possible!

What I need now is to execute commands on the server using plain old account+password authentication from a script. That is, I need to do it in a non-interactive way. Is it possible? And how do I do it?

The client which will be executing the script runs Ubuntu Server 8.04. The server runs Cygwin and OpenSSH.

Answer 1

There is a linux utility called sshpass. It allows you to do exactly what you want and will take a server password either as a command line argument, or from a file (i prefer this way, so i do not have my server password show up in shell history) and you use it like so:

sshpass -f file_with_password ssh user@server ls -la

This will ssh into a server and run ls -la. One thing, however, you have to manually ssh into a server first (if you haven't done so already), so the server gets added to your ~/.ssh/known_hosts. If you don't do that, sshpass will not work.

Answer 2

You can use Expect to do this. Obviously, this isn't preferable from a security standpoint, because it will require you to use a script that contains your password in plaintext. (But I won't belabor that point since you said in your question that you plan to use public key authentication as soon as possible!)

Answer 3

Depends a bit on the script language you use. I script almost everything in python now, where this is a non-issue. Both pyssh and Paramiko lets you simply script the password with no fuss.

If you intend to do it with (ba)sh scripts and use OpenSSH it gets harder. OpenSSH explicitly prevents you from putting passwords on the command line (as all users can see the command line using something like ps -fe, which is bad mojo). In this case you will have to interact directly with the ssh program and have two options:

• You can write a considerable amount of support code, using something like Expect.
• You make a hack using the SSH_ASKPASS variable, telling it to call an application returning your password and run it all as a batch job to prevent it from reading from the terminal.