38

I'm using ubuntu 12.04. I'm using ssh for connecting to many servers daily, so I put their parameters in .ssh/config file; like this :

Host server1
User tux
Port 2202
HostName xxx.x.xx.x

Is there a way to put passwords in this file, for each connection? So when the server asks for a password, the terminal puts its pass and send it to the server, so I need not type the password each time. Also, I don't want to use public/private key pair.

  • 11
    This is what keypairs are for. – Michael Hampton Aug 30 '13 at 5:01
36

No, There is no method to specify or provide on the command line the password in a non-interactive manner for ssh authentication using a openssh built-in mechanism. At least not one what I know of. You could hardcode your password into expect script but it is not a good solution either.

You definitely would want to use keypairs for passwordless authentication as Michael stated, in the end private key is pretty much a big password in the file.

| improve this answer | |
  • 1
    The thing is, its my clients servers and they dont allow login using keys. Im writing a bash script using expect for login to all servers where the credentials are being stored n taken from a usb storage device. Thanks – Ajo Augustine Aug 30 '13 at 5:57
  • 1
    Quite insecure. The only thing to suggest in that script to lock that file with tough file permissions. – Danila Ladner Aug 30 '13 at 6:13
  • 2
    If they don't allow keys they misunderstand how ssh works - allowing password login opens you up to dictionary attacks etc (albeit very, very slow ones) - it is next to impossible to accomplish the same with a private key pair, and if they're worried about the keys falling in to the wrong hands you can password-encrypt the private part of the key so that you need two factors to be able to use it (the password can also be remembered in your keychain / by your ssh agent) – Alex Berry Oct 8 '19 at 15:44
  • Educate your clients. Explain them that is better to disable password authentication and only permit keys that the reverse. – Nikita Kipriyanov Oct 8 '19 at 16:29
25

To avoid the string of comments: Yes, this is insecure (not even arguably insecure). I would strongly recommend you only do it in a lab situation on an isolated network or a similiar situation that does not involve production servers or potentientially production server without a full reset/format.

I wanted to set this up as I don't think my 2950 switch supports private/public keys and I hope at some point to get that knowledge, but I am not there yet.

Using an alias and sshpass this can be accomplished.

  1. Install sshpass
  2. Alter your .ssh/config file to include the username as listed in the question
  3. Add an alias to your terminal (I used .bashrc and would recommend against gloabl settings)
  4. Use alias to log into the target

My example alias is:

alias ssc='sshpass -pcisco ssh'

Where "cisco" is the password. Note there is no space between the -p and the password.

Usage is (referencing the question):

ssc server1

Note: This answers the question in title only for those using search engines. If you are using servers like the question example, private/public key pairs and not this answer should be used

| improve this answer | |
  • 1
    The only feasible workaround, when you really cannot work with keys for whatever reason. – sjas Sep 29 '16 at 11:15
  • Works! Awesome. – Rahul Oct 13 '16 at 13:52
  • I would suggest replacing the alias by a complete shell script; that would give the opportunity to dynamically select what password file to use depending on the host parameter. – 7heo.tk Jun 14 '17 at 17:06
  • 1
    One may very well put a space between -p and the password, as it is often the case with cli programs... – masterxilo Sep 18 '18 at 17:21
21

Yes, as mentioned above there's no way to save the password simply. I would recommend using ssh key for authorization.

first, generate your key :

ssh-keygen

Then copy the key around on your servers/desktops :

ssh-copy-id -i .ssh/id_rsa.pub user@ip-address:

That's all. You will never be asked for the password again.

I also recommend removing password authorization in general but that's up to you.

| improve this answer | |
  • 1
    Thanks for the reference to ssh-copy-id! I used to use some contraption like sshpass -p $PASSWORD ssh $USERNAME@$HOST "echo `cat ~/.ssh/id_rsa` >> /home/$USERNAME/.ssh/authorized_keys" but this program is cleaner and makes the intention clear. – masterxilo Sep 18 '18 at 17:24
  • ssh-copy-id, nice!! – Udi Apr 1 at 1:05
  • This is a good way and the way I usually use. Unfortunately what's brought me here is accessing test servers spun up as one offs on k8s with a default insecure password. Since I'm likely to only use the server once this approach is less useful. I know it's not something that should be encouraged, but adding the password to a "Host *.k8s.test" section in ssh config really would have been ideal. Guess it'll have to be an alias instead. – Thor84no May 26 at 11:27
4

There's no way to do this with ssh, it's as insecure as it can get.

As Danila mentioned you could use expect scripts but I wouldn't bother.

I wonder what are you trying to achieve? Do you want to hop from one server to another? In this case you want to setup and use ssh-agent on your workstation and enable agent forwarding on the target hosts; this way the credential exchange with be routed to your local agent without having to copy your private key around.

| improve this answer | |
  • VisualStudio has the concept of personal access tokens which are like app specific passwords where this feature would be helpful. – spuder Apr 17 '18 at 17:37
4

I use this script from ~/.local/bin directory

#!/usr/bin/bash

ORIG_SSH=/usr/bin/ssh
HOST=$1

SSHPASS=$(grep -Pzo "Host $HOST"'\s*\n((?!Host).*\n)*#PS\s(\N+)\n' ~/.ssh/config|tail -n 2|head -n 1 | sed 's/#PS //')
if [ -n $SSHPASS ]; then
    export SSHPASS
    sshpass -e $ORIG_SSH $@
else
    $ORIG_SSH $@
fi

Which allows me to specify passphrase as #PS <password> in .ssh/config file.

But, as everybody says, it's better to use ssh-keys with ssh-agent when it's possible

| improve this answer | |
1

The correct way to handle this situation is to use a session-based ssh-agent. Here is how:

$ eval `ssh-agent`
$ ssh-add /home/user/.ssh/your_key
Enter passphrase for /home/user/.ssh/your_key:

The password will be then kept valid for the remainder of the session. You only need to run the first command once, and can add as many keys as you want after that. When the session is killed, so is the agent so there is no hard-coded storage of a password.

Shocked that after so long this answer wasn't here!

| improve this answer | |
  • 1
    The reason it wasn't there is probably that the poster specifically said he doesn't want to use public/private key pair. – Jenny D Mar 21 '19 at 16:08
  • 1
    I missed that, thank you. Then I'll add that not using a keypair for SSH is a really, really bad idea. It's more secure AND more convenient... I would urge the OP to reconsider. Using a keypair with no passphrase is far more secure than no keypair and a password. But, ideally, one would use a keypair with a passphrase and use the steps I provided if/when they are in a session that requires storage of their passphrase. – pranalli Apr 11 '19 at 14:38
-1

You can do this in safer way by using sshpass

  1. Set your password without history

    export PS=your_password ;history -d $(history 1)

  2. Set host alias as above in ~/.ssh/config

  3. Use ssh pass to use environment variable and login to required machine in single command

sshpass -p $PS ssh host_alias

Your environment is holding your password and it is risky that any scripts executing can leak this password if you don't know what you are running

| improve this answer | |
  • No that's not safe. And it's quite ugly. – 7heo.tk Jun 14 '17 at 17:07
  • Isn't that "solution" longer than the problem? All those extra steps, and you still need to type sshpass -p $PS ... – Dan H Feb 19 '19 at 21:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.