How can you make SSH read the password from stdin, which it doesn't do by default?
8 Answers
based on this post you can do:
Create a command which open a ssh session using SSH_ASKPASS (seek SSH_ASKPASS on man ssh)
$ cat > ssh_session <<EOF
export SSH_ASKPASS="/path/to/script_returning_pass"
setsid ssh "your_user"@"your_host"
EOF
NOTE: To avoid ssh to try to ask on tty we use setsid
Create a script which returns your password (note echo "echo)
$ echo "echo your_ssh_password" > /path/to/script_returning_pass
Make them executable
$ chmod +x ssh_session
$ chmod +x /path/to/script_returning_pass
try it
$ ./ssh_session
Keep in mind that ssh stands for secure shell, and if you store your user, host and password in plain text files you are misleading the tool an creating a possible security gap
-
2Another requirement is that DISPLAY must be set. If you are running X, you won't notice. If you aren't, you will. To make the ssh_script above more portable, add this: export DISPLAY; DISPLAY=dummy– BlaineJan 6, 2015 at 3:18
-
furthermore (or if you don't have setsid) - in addition to setting DISPLAY and SSH_ASKPASS, you may also need to direct STDIN from /dev/null to convince ssh-add that it's not on a terminal: ssh-add /path/to/key < /dev/null– mikeDec 19, 2018 at 22:42
-
I used this idea for getting the passphrase from
pass
, to give tossh-add
in a generic way, generating the askpass script as needed. milosophical.me/blog/2018/ssh-pass.html– mikeDec 30, 2018 at 0:01 -
can someone update the solution to take in the suggestions from the comments? Feb 22, 2019 at 14:42
You can use sshpass which is for example in the offical debian repositories. Example:
$ apt-get install sshpass
$ sshpass -p 'password' ssh username@server
-
sadly this is the only solution I use, which isn't great for ssh jumphosts. The alternative is
expect
, which I'm guessing is more trouble than it's work. Dec 17, 2018 at 19:14 -
2Homebrew (macOS) has banned it :( " We won't add sshpass because it makes it too easy for novice SSH users to ruin SSH's security."– mikeDec 19, 2018 at 22:26
You can't with most SSH clients. You can work around it with by using SSH API's, like Paramiko for Python. Be careful not to overrule all security policies.
-
-
3It shouldn't work, because that would inspire junior sysadmins to write scripts with the SSH password entangled within the logic in the script. In an environment for network and system administration, there needs to be a clear separation between security-sensitive information on the one hand and getting things done on the other. Password authentication is just not safe enough. Since ssh is widely used in sysadmin contexts, trying to keep users away from password-only security is a good idea.– pvoostenDec 25, 2018 at 22:40
Distilling this answer leaves a simple and generic script:
#!/bin/bash
[[ $1 =~ password: ]] && cat || SSH_ASKPASS="$0" DISPLAY=nothing:0 exec setsid "$@"
Save it as pass
, do a chmod +x pass
and then use it like this:
$ echo mypass | pass ssh user@host ...
If its first argument contains password:
then it passes its input to its output (cat
) otherwise it launches whatver was presented after setting itself as the SSH_ASKPASS
program.
When ssh
encounters both SSH_ASKPASS
AND DISPLAY
set, it will launch the program referred to by SSH_ASKPASS
, passing it the prompt user@host's password:
-
You may need to also pass
-oStrictHostKeyChecking=no
to thessh
command, if you haven't SSH'd into this host before; otherwise it'll prompt the user for whether they trust the unknown host key. Obviously, only do this if you're sure that you trust the unknown host key.– villapxJul 17, 2018 at 22:34
FreeBSD mailing list recommends the expect library.
If you need a programmatic ssh login, you really ought to be using public key logins, however -- obviously there are a lot fewer security holes this way as compared to using an external library to pass a password through stdin
.
An old post reviving...
I found this one while looking for a solution to the exact same problem, I found something and I hope someone will one day find it useful:
- Install ssh-askpass program (apt-get, yum ...)
- Set the
SSH_ASKPASS
variable (export SSH_ASKPASS=/usr/bin/ssh-askpass
) - From a terminal open a new ssh connection without an undefined TERMINAL variable (
setsid ssh user@host
)
This looks simple enough to be secure but did not check yet (just using in a local secure context).
Here we are.
I'm not sure the reason you need this functionality but it seems you can get this behavior with ssh-keygen.
It allows you to login to a server without using a password by having a private RSA key on your computer and a public RSA key on the server.
a better sshpass
alternative is :
https://github.com/clarkwang/passh
I got problems with sshpass
, if ssh server is not added to my known_hosts
sshpass
will not show me any message, passh
do not have this problem.