I'm using ubuntu 12.04. I'm using ssh for connecting to many servers daily, so I put their parameters in .ssh/config file; like this :

Host server1
User tux
Port 2202
HostName xxx.x.xx.x

I know we should use key-pair ensure security, however sometimes we can't add public key into the remote machine (e.g. a public SSH server which accepting password and execute a specific command, or an user without a home directory).

So, is there a way to put passwords in this file, for each connection? So when the server asks for a password, the terminal puts its pass and send it to the server, so I need not type the password each time.

  • 13
    This is what keypairs are for. Aug 30, 2013 at 5:01
  • @MichaelHampton RTFQ: I know we should use key-pair ensure security, however sometimes we can't add public key into the remote machine (e.g. a public SSH server which accepting password and execute a specific command, or an user without a home directory). Nov 10, 2021 at 11:25
  • There's always one.
    – mckenzm
    Nov 18, 2021 at 22:09

7 Answers 7


No, There is no method to specify or provide on the command line the password in a non-interactive manner for ssh authentication using a openssh built-in mechanism. At least not one what I know of. You could hardcode your password into expect script but it is not a good solution either.

You definitely would want to use keypairs for passwordless authentication as Michael stated, in the end private key is pretty much a big password in the file.

  • 1
    The thing is, its my clients servers and they dont allow login using keys. Im writing a bash script using expect for login to all servers where the credentials are being stored n taken from a usb storage device. Thanks Aug 30, 2013 at 5:57
  • 1
    Quite insecure. The only thing to suggest in that script to lock that file with tough file permissions. Aug 30, 2013 at 6:13
  • 4
    If they don't allow keys they misunderstand how ssh works - allowing password login opens you up to dictionary attacks etc (albeit very, very slow ones) - it is next to impossible to accomplish the same with a private key pair, and if they're worried about the keys falling in to the wrong hands you can password-encrypt the private part of the key so that you need two factors to be able to use it (the password can also be remembered in your keychain / by your ssh agent)
    – Alex Berry
    Oct 8, 2019 at 15:44
  • 1
    Educate your clients. Explain them that is better to disable password authentication and only permit keys that the reverse. Oct 8, 2019 at 16:29
  • Gotta love when you run into a stackoverflow question where the top answer is categorically wrong, and accepted, and you have to scroll down to find the real answers, provided by people that understand that sometimes you have to connect to a server where the admin is not willing to enable key login.
    – Mithaldu
    May 10, 2022 at 9:05

To avoid the string of comments: Yes, this is insecure (not even arguably insecure). I would strongly recommend you only do it in a lab situation on an isolated network or a similiar situation that does not involve production servers or potentientially production server without a full reset/format.

I wanted to set this up as I don't think my 2950 switch supports private/public keys and I hope at some point to get that knowledge, but I am not there yet.

Using an alias and sshpass this can be accomplished.

  1. Install sshpass
  2. Alter your .ssh/config file to include the username as listed in the question
  3. Add an alias to your terminal (I used .bashrc and would recommend against gloabl settings)
  4. Use alias to log into the target

My example alias is:

alias ssc='sshpass -pcisco ssh'

Where "cisco" is the password. Note there is no space between the -p and the password.

Usage is (referencing the question):

ssc server1

Note: This answers the question in title only for those using search engines. If you are using servers like the question example, private/public key pairs and not this answer should be used

  • 2
    The only feasible workaround, when you really cannot work with keys for whatever reason.
    – sjas
    Sep 29, 2016 at 11:15
  • 1
    I would suggest replacing the alias by a complete shell script; that would give the opportunity to dynamically select what password file to use depending on the host parameter.
    – 7heo.tk
    Jun 14, 2017 at 17:06
  • 1
    One may very well put a space between -p and the password, as it is often the case with cli programs...
    – masterxilo
    Sep 18, 2018 at 17:21

Yes, as mentioned above there's no way to save the password simply. I would recommend using ssh key for authorization.

first, generate your key :


Then copy the key around on your servers/desktops :

ssh-copy-id -i .ssh/id_rsa.pub user@ip-address:

That's all. You will never be asked for the password again.

I also recommend removing password authorization in general but that's up to you.

  • 2
    Thanks for the reference to ssh-copy-id! I used to use some contraption like sshpass -p $PASSWORD ssh $USERNAME@$HOST "echo `cat ~/.ssh/id_rsa` >> /home/$USERNAME/.ssh/authorized_keys" but this program is cleaner and makes the intention clear.
    – masterxilo
    Sep 18, 2018 at 17:24
  • ssh-copy-id, nice!!
    – Udi
    Apr 1, 2020 at 1:05
  • This is a good way and the way I usually use. Unfortunately what's brought me here is accessing test servers spun up as one offs on k8s with a default insecure password. Since I'm likely to only use the server once this approach is less useful. I know it's not something that should be encouraged, but adding the password to a "Host *.k8s.test" section in ssh config really would have been ideal. Guess it'll have to be an alias instead.
    – Vala
    May 26, 2020 at 11:27
  • Beware of just "copying the key around" this is worse that passwords because now you have copies of the key. It is important to create accounts. Too many shops just using ubuntu and ec2-user with hundreds of uncontrolled copies of the public key. Restrict it and change it frequently. Put it in a vault. I defy anyone to memorise half a dozen .pems ...
    – mckenzm
    Apr 21, 2022 at 5:32

I use this script from ~/.local/bin directory



SSHPASS=$(grep -Pzo "Host $HOST"'\s*\n((?!Host).*\n)*#PS\s(\N+)\n' ~/.ssh/config|tail -n 2|head -n 1 | sed 's/#PS //')
if [ -n $SSHPASS ]; then
    export SSHPASS
    sshpass -e $ORIG_SSH $@
    $ORIG_SSH $@

Which allows me to specify passphrase as #PS <password> in .ssh/config file.

But, as everybody says, it's better to use ssh-keys with ssh-agent when it's possible

  • 2
    What an awesome idea! I have to download files from an SFTP server controlled by a 3rd party occasionally, They hand out userid/password credentials, and since I don't control the server, I don't get to require that public keys be used. Jun 12, 2021 at 6:17
  • To include all config file in .ssh/config.d, I'm using the following grep: grep -rhPzo "Host $HOST"'\s*\n((?!Host).*\n)*#PS\s(\N+)\n' ~/.ssh/config*
    – thangdc94
    May 2, 2023 at 9:51

There's no way to do this with ssh, it's as insecure as it can get.

As Danila mentioned you could use expect scripts but I wouldn't bother.

I wonder what are you trying to achieve? Do you want to hop from one server to another? In this case you want to setup and use ssh-agent on your workstation and enable agent forwarding on the target hosts; this way the credential exchange with be routed to your local agent without having to copy your private key around.

  • VisualStudio has the concept of personal access tokens which are like app specific passwords where this feature would be helpful.
    – spuder
    Apr 17, 2018 at 17:37

The correct way to handle this situation is to use a session-based ssh-agent. Here is how:

$ eval `ssh-agent`
$ ssh-add /home/user/.ssh/your_key
Enter passphrase for /home/user/.ssh/your_key:

The password will be then kept valid for the remainder of the session. You only need to run the first command once, and can add as many keys as you want after that. When the session is killed, so is the agent so there is no hard-coded storage of a password.

Shocked that after so long this answer wasn't here!

  • 2
    The reason it wasn't there is probably that the poster specifically said he doesn't want to use public/private key pair.
    – Jenny D
    Mar 21, 2019 at 16:08
  • 1
    I missed that, thank you. Then I'll add that not using a keypair for SSH is a really, really bad idea. It's more secure AND more convenient... I would urge the OP to reconsider. Using a keypair with no passphrase is far more secure than no keypair and a password. But, ideally, one would use a keypair with a passphrase and use the steps I provided if/when they are in a session that requires storage of their passphrase.
    – pranalli
    Apr 11, 2019 at 14:38
  • But it's exactly what I was looking for:)
    – Jo Mo
    Jan 21, 2021 at 9:04
  • this is a good suggestion in general, but the OP clearly wrote that he/her can't use key pairs in this case. So it's a no go (sadly) Jan 25, 2021 at 10:01
  • You don't need a key to use an agent necessarily, and have a look at "plink" from PuTTY tools. We need to decide for ourselves what is meant by "safe". Too many classroom critics that fear the hose.
    – mckenzm
    Nov 18, 2021 at 22:17

You can do this in safer way by using sshpass

  1. Set your password without history

    export PS=your_password ;history -d $(history 1)

  2. Set host alias as above in ~/.ssh/config

  3. Use ssh pass to use environment variable and login to required machine in single command

sshpass -p $PS ssh host_alias

Your environment is holding your password and it is risky that any scripts executing can leak this password if you don't know what you are running

  • No that's not safe. And it's quite ugly.
    – 7heo.tk
    Jun 14, 2017 at 17:07
  • Isn't that "solution" longer than the problem? All those extra steps, and you still need to type sshpass -p $PS ...
    – Dan H
    Feb 19, 2019 at 21:30

Not the answer you're looking for? Browse other questions tagged .