I am writing a script that will allow me to retrieve a file from all of my servers at once. I have SSH keys in place in order to log into my servers. My SSH key however requires a password.

The script I am writing will not be automated, it will only ever be run manually. So my script prompts the user for the SSH key password.

How can I send the password to the SSH key as it connects to each server. I am trying to avoid having to type my password in for each server.

I know I could use 'expect', but am hoping there is a simple way to do this. Maybe some environment variable?



Why not use ssh-agent for this?
See the man page for additional details. :)

  • To be honest, I've never felt that ssh-agent was a secure idea. I don't really like the idea of it storing my keys. I am probably being overly paranoid though. – mhost Jan 26 '11 at 19:15
  • 2
    The alternative you're proposing is providing a method of getting the encrypted key and password to decrypt it from the filesystem. I can't readily imagine a circumstance in which this is less secure than the unencrypted key being held within a program's memory. – Jeff Ferland Jan 26 '11 at 19:17
  • 1
    Please describe your security concerns with ssh-agent. (ssh-agent doesn't "store" your key) – Alex Holst Jan 26 '11 at 19:18
  • 2
    the agent is at least as secure as putting your password in a file (more secure if the file isn't mode 600 or more restricted), and far more secure than letting it sit in a shell/environment variable :-) -- If you're paranoid you can always kill off the agent when your script is done. – voretaq7 Jan 26 '11 at 19:18
  • I agree with voretaq7. Your passphrase will have to be stored in plaintext somewhere. At that point it's not more secure than having an unencrypted private key in the first place. – SmallClanger Jan 26 '11 at 19:22

I would use a SSH key that doesn't have a passkey. It may be less secure, but any method that will allow unattended use will have the same flaw.


Expect is the solution that comes to mind first...

Check this script example, as it is close to what you're looking for.

  • Expect, and any other form of scripting, is a really poor solution to this problem. – Alex Holst Jan 26 '11 at 19:13
  • Yeah I thought of that too, but I was just wondering if there was a simple way. Like you can do with gpg passwords. – mhost Jan 26 '11 at 19:15
  • Obviously there are security issues in this case, but expect is a useful tool for people to know about. – pjc50 Mar 2 '11 at 13:33

Here are my 2 cents!

  • I have a USB drive that is always with me (in my physical key chain).
  • I make a second partition of 5 insignificant MB in it. This partition is an encrypted ext4 partition.
  • I store my private key (without passkey) in that encrypted partition.
  • In my computer I store the password to decrypt this partition in the file manager (I use dolphin) so if I plug the USB drive I can mount the encrypted partition with two single clicks, and if I plug the USB drive in another computer I can mount it typing the password.
  • Again in my computer I have symlinked my private keys from it usually are (~/.ssh/id_rsa) to where they are when mounted with the USB drive. So once mounted I can make a usual ssh without password.
  • If I am in another computer I can tell ssh where my key is with the -i flag

This way I can:

  • Login comfortably from my everyday computer
  • Log in with a single password from any linux machine
  • Have my private keys always safe with me and in a encrypted filesystem

Easiest solution is installing package sshpass and use it like:
sshpass -p password ssh -i keyfile.pem user@server

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.