Seems overly complicated; sshpass works fine for me. (And the passh examples of why sshpass is broken seem contrived to me.)
Overly contrived examples are the hallmark of software zealots. I knew to stop reading after "its more correct variant".
Non-interactive SSH password authentication
11–20 of 128 posts
Re: Non-interactive SSH password authentication
#12Used 'expect' like 20 years ago...
I was waiting for the article to mention why the author chose not to employ that option. Though the author mentions in passing that one solution is brittle because it requires parsing output, I don't see why that's a problem. It's exactly what 'expects was designed to do.
Re: Non-interactive SSH password authentication
#13The author claims that sshpass is "broken by design" and goes on to show some examples of why, without ever explaining anything.
Can anyone enlighten me why sshpass is broken, or explain the examples on that page?
Re: Non-interactive SSH password authentication
#14I disable password login all my hosts but good to know people do this.
Can’t do that in some cases. Tacacs for example doesn’t allow for private keys
I’ve worked at more than one place where you SSH into a Linux host (often just for that datacenter) using certificate-based authentication, only to be printed a JIT (just in time) password for TACACS-based usage in that datacenter, and which is only valid for a few minutes.
Workarounds are many for network devices it seems!
Re: Non-interactive SSH password authentication
#15The author claims that sshpass is "broken by design" and goes on to show some examples of why, without ever explaining anything. Can anyone enlighten me why sshpass is broken, or explain the examples on that page?
I’ve always been told that ssh is not supposed to work non-interactively. Which is the whole reason for sshpass, to work non-interactively. Ie. Broken by design.
Re: Non-interactive SSH password authentication
#16Wait, why aren't we using SSH keys? I just did a search on the page for 'key' and didn't see an explanation for why that's not the best option.
It’s covered under footnote #1: > First, some vendors make it difficult to associate an SSH key with a user. Then, many vendors do not support certificate-based authentication, making it difficult to scale. Finally, interactions between public-key authentication and finer-grained authorization methods like TACACS+ and Radius are still uncharted territory Keys (with/without certs) are the best route, but not always po…
Honest question, unless it's mandated by your employer, or you don't personally care, why would you ever choose to use a service that doesn't offer that?
Re: Non-interactive SSH password authentication
#17The author claims that sshpass is "broken by design" and goes on to show some examples of why, without ever explaining anything. Can anyone enlighten me why sshpass is broken, or explain the examples on that page?
I’ve always been told that ssh is not supposed to work non-interactively. Which is the whole reason for sshpass, to work non-interactively. Ie. Broken by design.
What, how about scp and sshfs?
I can argue that SSH password auth only makes sense.as in interactive affair; for non-interactive auth cases, there are public keys, certificates, smart cards, etc.
Re: Non-interactive SSH password authentication
#18Earlier quoted context omitted.
It’s covered under footnote #1: > First, some vendors make it difficult to associate an SSH key with a user. Then, many vendors do not support certificate-based authentication, making it difficult to scale. Finally, interactions between public-key authentication and finer-grained authorization methods like TACACS+ and Radius are still uncharted territory Keys (with/without certs) are the best route, but not always po…
Honest question, unless it's mandated by your employer, or you don't personally care, why would you ever choose to use a service that doesn't offer that?
It may be a box configured and serviced by a vendor, and your org may be short on IT staff.
Re: Non-interactive SSH password authentication
#19Earlier quoted context omitted.
It’s covered under footnote #1: > First, some vendors make it difficult to associate an SSH key with a user. Then, many vendors do not support certificate-based authentication, making it difficult to scale. Finally, interactions between public-key authentication and finer-grained authorization methods like TACACS+ and Radius are still uncharted territory Keys (with/without certs) are the best route, but not always po…
Honest question, unless it's mandated by your employer, or you don't personally care, why would you ever choose to use a service that doesn't offer that?
You may be in a position where you must employ and interact with networked equipment that does not support pubkey authentication.
Re: Non-interactive SSH password authentication
#20I ran about 30k machines with sshpass and it worked just fine. Easy to script. I don’t understand at all why we need something else here.