How to automate SSH login with password? I'm configuring my test VM, so heavy security is not considered. SSH chosen for acceptable security with minimal configuration.
ex)
echo password | ssh id@server
This doesn't work.
I remember I did this with some tricks somebody guided me, but I can't remember now the trick I used...
Don't use a password. Generate a passphrase-less SSH key and push it to your VM.
If you already have an SSH key, you can skip this step… Just hit Enter for the key and both passphrases:
Copy your keys to the target server:
Now try logging into the machine, with
ssh 'id@server'
, and check-in:to make sure we haven’t added extra keys that you weren’t expecting.
Finally, check to log in…
You may also want to look into using
ssh-agent
if you want to try keeping your keys protected with a passphrase.While the correct answer for your question is sshpass (see other answer for details), there is a more secure way - SSH keys. You are just three easy steps away from the solution:
All the following commands are being run on the client side, i.e. your machine
Enter the following command to start generating a rsa keypair:
When the message 'Enter file in which to save the key' appears, just leave the filename blank by pressing Enter.
When the terminal asks you to enter a passphrase, just leave this blank (Warning: read below) too and press Enter.
Then copy the keypair onto the server with one simple command:
you can now log in without a password:
WARNING: Leaving SSH keys exposed without encrypting them is a not good practice even if you encrypt your whole drive. What is much safer is to actually enter a passphrase when generating keys and then use Keychain (MacOS, Linux) or SSH agent to remember the passphrase until you signout or suspend or timeout, depending on what you prefer.
Use expect:
Example:
SSH single sign-on is usually achieved with public key authentication and an authentication agent. You could easily add your test VM key to an existing auth agent (see example below). Other methods such as gssapi/kerberos exist but are more complex.
sshpass
In situations where
password
is the only authentication method available, sshpass can be used to automatically enter the password. Please pay particular attention to the SECURITY CONSIDERATIONS section of the man page. In all three options, the password is visible or stored in plaintext at some point:Anonymous pipe (recommended by sshpass)
It is quite cumbersome in bash, arguably easier with programming languages. Another process could attach to your pipe/fd before the password is written. The window of opportunity is quite short and limited to your processes or root.
Environment variable
You and root can read your process' environment variables (i.e. your password) while sshpass is running (
cat /proc/<pid>/environ | tr '\0' '\n' | grep ^SSHPASS=
). The window of opportunity is much longer but still limited to your own processes or root, not other users.Command-line argument (least secure)
This is convenient but less secure as described in the man page. Command line arguments are visible to all users (e.g.
ps -ef | grep sshpass
). sshpass attempts to hide the argument, but there is still a window during which all users can see your password passed by argument.Side note
Set your bash HISTCONTROL variable to
ignorespace
orignoreboth
and prefix your sensitive commands with a space. They won't be saved in history.SSH public key authentication
The passphrase is very important. Anyone somehow obtaining the private key file won't be able to use it without the passphrase.
Setup the SSH authentication agent
Connect as usual
The advantage is that your private key is encrypted and you only need to enter its passphrase once (via a safer input method too).
I am surprised nobody mentioned
plink
from theputty-tools
package in Ubuntu:It also available on Windows and the syntax is mostly compatible with the openssh client.
This might not be any use to you, but you can do it with Perl:
I prefer
passh
https://github.com/clarkwang/passhsshpass is broken by design.
when the ssh server is not added already in my
known_hosts
,sshpass
will not show me the message to add the server to my known hosts,passh
do not have this problem.Login to a remote server:
Sure you don't want to use SSH keys rather than passwords? That way it's both secure and automatic.
Depending on your automation needs, perhaps Ansible would be a good fit for you. It can nicely manage things like prompting for password, prompting for sudo password, various ways of changing use, securely using encrypted secrets (vault).
If that’s not suitable, I would suggest Expect, as suggested in another answer.