SnapOverflow

SnapOverflow Logo SnapOverflow Logo

SnapOverflow Navigation

  • Home
  • Server
  • Ubuntu

Mobile menu

Close
  • Home
  • System Administrators
    • Hot Questions
    • New Questions
    • Tags
  • Ubuntu
    • Hot Questions
    • New Questions
    • Tags
  • Help
Home / server / Questions / 241588
Accepted
Eonil
Eonil
Asked: 2011-03-02 03:07:12 +0800 CST2011-03-02 03:07:12 +0800 CST 2011-03-02 03:07:12 +0800 CST

How to automate SSH login with password?

  • 772

How to automate SSH login with password? I'm configuring my test VM, so heavy security is not considered. SSH chosen for acceptable security with minimal configuration.

ex)

echo password | ssh id@server

This doesn't work.

I remember I did this with some tricks somebody guided me, but I can't remember now the trick I used...

password ssh automation
  • 10 10 Answers
  • 1998510 Views

10 Answers

  • Voted
  1. weekens
    2013-06-01T01:08:28+08:002013-06-01T01:08:28+08:00
    $ sudo apt-get install sshpass
    $ sshpass -p your_password ssh user@hostname
    
    • 826
  2. Best Answer
    Cakemox
    2011-03-02T03:17:09+08:002011-03-02T03:17:09+08:00

    Don't use a password. Generate a passphrase-less SSH key and push it to your VM.

    If you already have an SSH key, you can skip this step… Just hit Enter for the key and both passphrases:

    $ ssh-keygen -t rsa -b 2048
    Generating public/private rsa key pair.
    Enter file in which to save the key (/home/username/.ssh/id_rsa):
    Enter passphrase (empty for no passphrase):
    Enter same passphrase again:
    Your identification has been saved in /home/username/.ssh/id_rsa.
    Your public key has been saved in /home/username/.ssh/id_rsa.pub.
    

    Copy your keys to the target server:

    $ ssh-copy-id id@server
    id@server's password:
    

    Now try logging into the machine, with ssh 'id@server', and check-in:

    .ssh/authorized_keys
    

    Note: If you don't have .ssh dir and authorized_keys file, you need to create it first

    to make sure we haven’t added extra keys that you weren’t expecting.

    Finally, check to log in…

    $ ssh id@server
    
    id@server:~$
    

    You may also want to look into using ssh-agent if you want to try keeping your keys protected with a passphrase.

    • 581
  3. lzap
    2011-11-15T04:57:13+08:002011-11-15T04:57:13+08:00

    While the correct answer for your question is sshpass (see other answer for details), there is a more secure way - SSH keys. You are just three easy steps away from the solution:

    All the following commands are being run on the client side, i.e. your machine

    Enter the following command to start generating a rsa keypair:

    # ssh-keygen
    

    When the message 'Enter file in which to save the key' appears, just leave the filename blank by pressing Enter.

    When the terminal asks you to enter a passphrase, just leave this blank (Warning: read below) too and press Enter.

    Then copy the keypair onto the server with one simple command:

    # ssh-copy-id userid@hostname
    

    you can now log in without a password:

    # ssh userid@hostname
    

    WARNING: Leaving SSH keys exposed without encrypting them is a not good practice even if you encrypt your whole drive. What is much safer is to actually enter a passphrase when generating keys and then use Keychain (MacOS, Linux) or SSH agent to remember the passphrase until you signout or suspend or timeout, depending on what you prefer.

    • 113
  4. ooshro
    2011-03-02T03:08:41+08:002011-03-02T03:08:41+08:00

    Use expect:

    #!/usr/bin/expect -f
    #  ./ssh.exp password 192.168.1.11 id
    set pass [lrange $argv 0 0]
    set server [lrange $argv 1 1]
    set name [lrange $argv 2 2]
    
    spawn ssh $name@$server
    match_max 100000
    expect "*?assword:*"
    send -- "$pass\r"
    send -- "\r"
    interact
    

    Example:

    # ./1.ex password localhost ooshro
    spawn ssh ooshro@localhost
    ooshro@localhost's password: 
    Linux ubuntu-1010-server-01 2.6.35-25-generic-pae #44-Ubuntu SMP Fri Jan 21 19:01:46 UTC 2011 i686 GNU/Linux
    Ubuntu 10.10
    
    Welcome to Ubuntu!
     * Documentation:  https://help.ubuntu.com/
    Last login: Tue Mar  1 12:41:12 2011 from localhost
    
    • 57
  5. nrolans
    2018-12-21T13:35:20+08:002018-12-21T13:35:20+08:00

    SSH single sign-on is usually achieved with public key authentication and an authentication agent. You could easily add your test VM key to an existing auth agent (see example below). Other methods such as gssapi/kerberos exist but are more complex.

    sshpass

    In situations where password is the only authentication method available, sshpass can be used to automatically enter the password. Please pay particular attention to the SECURITY CONSIDERATIONS section of the man page. In all three options, the password is visible or stored in plaintext at some point:

    Anonymous pipe (recommended by sshpass)

    # Create a pipe
    PIPE=$(mktemp -u)
    mkfifo -m 600 $PIPE
    # Attach it to file descriptior 3
    exec 3<>$PIPE
    # Delete the directory entry
    rm $PIPE
    # Write your password in the pipe
     echo 'my_secret_password' >&3
    # Connect with sshpass -d
    sshpass -d3 ssh user@host
    
    # Close the pipe when done
    exec 3>&-
    

    It is quite cumbersome in bash, arguably easier with programming languages. Another process could attach to your pipe/fd before the password is written. The window of opportunity is quite short and limited to your processes or root.

    Environment variable

    # Set your password in an environment variable
     export SSHPASS='my_secret_password'
    # Connect with sshpass -e
    sshpass -e ssh user@host
    

    You and root can read your process' environment variables (i.e. your password) while sshpass is running (cat /proc/<pid>/environ | tr '\0' '\n' | grep ^SSHPASS=). The window of opportunity is much longer but still limited to your own processes or root, not other users.

    Command-line argument (least secure)

     sshpass -p my_secret_password ssh user@host
    

    This is convenient but less secure as described in the man page. Command line arguments are visible to all users (e.g. ps -ef | grep sshpass). sshpass attempts to hide the argument, but there is still a window during which all users can see your password passed by argument.

    Side note

    Set your bash HISTCONTROL variable to ignorespace or ignoreboth and prefix your sensitive commands with a space. They won't be saved in history.


    SSH public key authentication

    # Generate a key pair
    # Do NOT leave the passphrase empty
    ssh-keygen
    # Copy it to the remote host (added to .ssh/authorized_keys)
    ssh-copy-id user@host
    

    The passphrase is very important. Anyone somehow obtaining the private key file won't be able to use it without the passphrase.

    Setup the SSH authentication agent

    # Start the agent
    eval `ssh-agent`
    # Add the identity (private key) to the agent
    ssh-add /path/to/private-key
    # Enter key passphrase (one time only, while the agent is running)
    

    Connect as usual

    ssh user@host
    

    The advantage is that your private key is encrypted and you only need to enter its passphrase once (via a safer input method too).

    • 46
  6. eadmaster
    2018-07-10T05:15:34+08:002018-07-10T05:15:34+08:00

    I am surprised nobody mentioned plink from the putty-tools package in Ubuntu:

    plink user@domain -pw mypass  [cmd]
    

    It also available on Windows and the syntax is mostly compatible with the openssh client.

    • 31
  7. James L
    2011-03-02T03:52:29+08:002011-03-02T03:52:29+08:00

    This might not be any use to you, but you can do it with Perl:

    \#!/usr/bin/perl  
    use warnings;  
    use strict;  
    
    use Net::SSH::Perl;  
    my $host = 'remote.serv.er';  
    my $user = 'root';  
    my $pass = 'hunter2';  
    my $ssh = Net::SSH::Perl->new('$host');  
    $ssh->login('$user', '$pass') or die "Oh noes! $!";
    
    • 21
  8. Badr Elmers
    2020-01-12T15:26:34+08:002020-01-12T15:26:34+08:00

    I prefer passh https://github.com/clarkwang/passh

    sshpass is broken by design.

    when the ssh server is not added already in my known_hosts, sshpass will not show me the message to add the server to my known hosts, passh do not have this problem.

    Login to a remote server:

    $ passh -p password ssh user@host
    
    • 8
  9. Coops
    2011-03-02T03:14:42+08:002011-03-02T03:14:42+08:00

    Sure you don't want to use SSH keys rather than passwords? That way it's both secure and automatic.

    • 7
  10. Cameron Kerr
    2018-11-23T00:30:37+08:002018-11-23T00:30:37+08:00

    Depending on your automation needs, perhaps Ansible would be a good fit for you. It can nicely manage things like prompting for password, prompting for sudo password, various ways of changing use, securely using encrypted secrets (vault).

    If that’s not suitable, I would suggest Expect, as suggested in another answer.

    • 6

Sidebar

Stats

  • Questions 681965
  • Answers 980273
  • Best Answers 280204
  • Users 287326
  • Popular
  • Answers
  • Marko Smith

    Ping a Specific Port

    • 18 Answers
  • Marko Smith

    Check if port is open or closed on a Linux server?

    • 7 Answers
  • Marko Smith

    How to automate SSH login with password?

    • 10 Answers
  • Marko Smith

    How do I tell Git for Windows where to find my private RSA key?

    • 30 Answers
  • Marko Smith

    What's the default superuser username/password for postgres after a new install?

    • 5 Answers
  • Marko Smith

    What port does SFTP use?

    • 6 Answers
  • Marko Smith

    Resolve host name from IP address

    • 8 Answers
  • Marko Smith

    Command line to list users in a Windows Active Directory group?

    • 9 Answers
  • Marko Smith

    What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

    • 3 Answers
  • Marko Smith

    How to determine if a bash variable is empty?

    • 15 Answers
  • Martin Hope
    Davie Ping a Specific Port 2009-10-09 01:57:50 +0800 CST
  • Martin Hope
    Smudge Our security auditor is an idiot. How do I give him the information he wants? 2011-07-23 14:44:34 +0800 CST
  • Martin Hope
    kernel Can scp copy directories recursively? 2011-04-29 20:24:45 +0800 CST
  • Martin Hope
    Robert ssh returns "Bad owner or permissions on ~/.ssh/config" 2011-03-30 10:15:48 +0800 CST
  • Martin Hope
    Eonil How to automate SSH login with password? 2011-03-02 03:07:12 +0800 CST
  • Martin Hope
    gunwin How do I deal with a compromised server? 2011-01-03 13:31:27 +0800 CST
  • Martin Hope
    Tom Feiner How can I sort du -h output by size 2009-02-26 05:42:42 +0800 CST
  • Martin Hope
    Noah Goodrich What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats? 2009-05-19 18:24:42 +0800 CST
  • Martin Hope
    Brent How to determine if a bash variable is empty? 2009-05-13 09:54:48 +0800 CST
  • Martin Hope
    cletus How do you find what process is holding a file open in Windows? 2009-05-01 16:47:16 +0800 CST

Related Questions

Trending Tags

linux nginx windows networking ubuntu domain-name-system amazon-web-services active-directory apache-2.4 ssh

Explore

  • Home
  • Questions
    • Hot Questions
    • New Questions
  • Tags
  • Help

Footer

SnapOverflow

About Us

  • About Us
  • Contact Us

Legal Stuff

  • Privacy Policy

Help

© 2022 SOF-TR. All Rights Reserve