Daniel J. Bernstein's ptyget toolset

Re:Daniel J. Bernstein's ptyget toolset by quesera on Thursday April 21, 2022 @04:16PM (#31114660)

There is also sshpass, which allows non-interactive ssh password auth.

You can provide the password on the command line, or in an environment variable:

  sshpass -p 'PASSWORD' ssh user@host /bin/id
  SSHPASS=PASSWORD sshpass -e ssh user@host /bin/id

Not ideal, but if you're working with inflexible third parties who don't understand public keys, sometimes it's acceptable.

Storing secrets in environment variables is a common practice in many mostly-reasonable orgs.

[ Parent | on HN ]

Re:Daniel J. Bernstein's ptyget toolset by bruce_one on Thursday April 21, 2022 @06:37PM (#31116042)

OpenSSH also supports using a script to get the password if using the `SSH_ASKPASS` environment variable, and being invoked under a non-tty input e.g.

  { echo '#!/bin/sh' ; echo 'echo my_password' ; } > password.sh # don't do it like this :-p
  chmod +x password.sh

  SSH_ASKPASS=./password.sh DISPLAY= setsid ssh user@host /bin/id

In newer SSH versions `DISPLAY` is not required (but there is a new `SSH_ASKPASS_REQUIRE` environment variable), but in older (e.g. 8.x) versions, then it needs to be set as the default ssh-ask-password was an X11 command, and I believe the logic assumed that scenario.

[ Parent | on HN ]