A server allows SSH connections, but not using public key authentication. It's not within my power to change this at the moment (due to technical difficulties, not organizational) but I will get on it as soon as possible!

What I need now is to execute commands on the server using plain old account+password authentication from a script. That is, I need to do it in a non-interactive way. Is it possible? And how do I do it?

The client which will be executing the script runs Ubuntu Server 8.04. The server runs Cygwin and OpenSSH.

  • 2
    What are the technical difficulties with enabling key-based authentication? Perhaps you should be asking that question instead, or in addition to this one.
    – Zoredache
    Apr 14, 2010 at 18:18
  • 1
    I am asking it. :-) serverfault.com/questions/125842/… I simply need an escape route for now, as I have been banging my head on that one for a while. But of course my goal is to get it working in the long run.
    – Deleted
    Apr 14, 2010 at 18:29

3 Answers 3


There is a linux utility called sshpass. It allows you to do exactly what you want and will take a server password either as a command line argument, or from a file (i prefer this way, so i do not have my server password show up in shell history) and you use it like so:

sshpass -f file_with_password ssh user@server ls -la

This will ssh into a server and run ls -la. One thing, however, you have to manually ssh into a server first (if you haven't done so already), so the server gets added to your ~/.ssh/known_hosts. If you don't do that, sshpass will not work.

  • 2
    This is not a standard part of OpenSSH, and literally none of my machines (Mac OS X 10.7, Ubuntu 12.04, FreeBSD 8, Debian 3.1) have it...
    – voretaq7
    Aug 2, 2012 at 14:59
  • @voretaq7: sshpass is a SourceForge project: sourceforge.net/projects/sshpass
    – kevinarpe
    Jan 24, 2013 at 10:33
  • 1
    @KCArpe I think you missed my point ("The entire world isn't your Linux machine - try to pick solutions that work in other places"). Using the SSH_ASKPASS variable is a more generic solution that works on any system with OpenSSH, and doesn't require installing additional software. For some of us (in regulated industries) installing new software triggers a lot of administrative work.
    – voretaq7
    Jan 24, 2013 at 16:23
  • @voretaq7 Using SSH_ASKPASS does not work on all systems. Even if the client supports it, it won't work if the server uses keyboard-interactive. I have actually faced that problem when writing a script to distribute an authorized_keys file to a number of embedded machines.
    – kasperd
    Aug 17, 2014 at 19:55

You can use Expect to do this. Obviously, this isn't preferable from a security standpoint, because it will require you to use a script that contains your password in plaintext. (But I won't belabor that point since you said in your question that you plan to use public key authentication as soon as possible!)

  • This looks like it will solve my problem! I'll check it out tomorrow. It's not the final solution, but it offers some security. When I think about it, if the script user is the only one allowed to read the script. Then it will be as secure as my private key which is also "only" protected by file system permissions. Or did I miss something?
    – Deleted
    Apr 14, 2010 at 18:36
  • I'll get back with results tomorrow. :-) Thank you for answering!
    – Deleted
    Apr 14, 2010 at 18:36
  • It seems to work. But sshpass was easier for this specific case IMHO.
    – Deleted
    Apr 19, 2010 at 14:53

Depends a bit on the script language you use. I script almost everything in python now, where this is a non-issue. Both pyssh and Paramiko lets you simply script the password with no fuss.

If you intend to do it with (ba)sh scripts and use OpenSSH it gets harder. OpenSSH explicitly prevents you from putting passwords on the command line (as all users can see the command line using something like ps -fe, which is bad mojo). In this case you will have to interact directly with the ssh program and have two options:

  • You can write a considerable amount of support code, using something like Expect.
  • You make a hack using the SSH_ASKPASS variable, telling it to call an application returning your password and run it all as a batch job to prevent it from reading from the terminal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.