Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Non-interactive SSH password authentication

vincent.bernat.ch

Post reply on HN
Print view View original

21–30 of 128 posts

Re: Non-interactive SSH password authentication

#21

Post by vbernat »

squeaky-clean wrote: post #16
infotogivenm wrote: post #10

Earlier quoted context omitted.

It’s covered under footnote #1: > First, some vendors make it difficult to associate an SSH key with a user. Then, many vendors do not support certificate-based authentication, making it difficult to scale. Finally, interactions between public-key authentication and finer-grained authorization methods like TACACS+ and Radius are still uncharted territory Keys (with/without certs) are the best route, but not always po…

Honest question, unless it's mandated by your employer, or you don't personally care, why would you ever choose to use a service that doesn't offer that?

There are not many network vendors. Check the link in the first footnote for an example how Cisco, the leader in the field, makes it difficult to deploy SSH keys. This is getting better. For example, Juniper (another network vendor) now supports SSH certificates.

Re: Non-interactive SSH password authentication

#22

Post by vbernat »

dark-star wrote: post #13

The author claims that sshpass is "broken by design" and goes on to show some examples of why, without ever explaining anything. Can anyone enlighten me why sshpass is broken, or explain the examples on that page?

Author here. I don't claim sshpass is "broken by design". I claim it is brittle as it relies on the detection of a password prompt. passh author has several examples here: https://github.com/clarkwang/passh/blob/master/sshpass-broke....

Re: Non-interactive SSH password authentication

#24

Post by vbernat »

latchkey wrote: post #20

I ran about 30k machines with sshpass and it worked just fine. Easy to script. I don’t understand at all why we need something else here.

What about: this is now somewhat builtin into SSH, so you don't need an additional tool (or more accurately, this additional tool could be far simpler and more robust).

Re: Non-interactive SSH password authentication

#26

Post by brewedDoritos »

Recently I tried to use an sftp script created with expect that ran fine on the command line, but the same script failed to run under cron. I made sure that all environment variables were properly set, but sftp didn't ask me for a password. I think it might have been an issue with the absence of a tty

sshpass didn't work, ended up rewriting the whole thing in Paramiko ... only to find out it doesn't respect the http_proxy environment variable.

That was not a good day

Re: Non-interactive SSH password authentication

#27

Post by latchkey »

vbernat wrote: post #24
latchkey wrote: post #20

I ran about 30k machines with sshpass and it worked just fine. Easy to script. I don’t understand at all why we need something else here.

What about: this is now somewhat builtin into SSH, so you don't need an additional tool (or more accurately, this additional tool could be far simpler and more robust).

Ok. That is helpful, but ssh server or client? No way I would bother upgrading the server on all those boxes just to get to a point that is already working with sshpass.

Re: Non-interactive SSH password authentication

#28

Post by vbernat »

latchkey wrote: post #27
vbernat wrote: post #24

Earlier quoted context omitted.

What about: this is now somewhat builtin into SSH, so you don't need an additional tool (or more accurately, this additional tool could be far simpler and more robust).

Ok. That is helpful, but ssh server or client? No way I would bother upgrading the server on all those boxes just to get to a point that is already working with sshpass.

Client. OpenSSH 8.4 has SSH_ASKPASS_REQUIRE that allows one to always invoke SSH_ASKPASS, notably when run from a terminal (previously, it was only invoked when there was no terminal to prompt the password).

Re: Non-interactive SSH password authentication

#29

Post by latchkey »

vbernat wrote: post #28
latchkey wrote: post #27

Earlier quoted context omitted.

Ok. That is helpful, but ssh server or client? No way I would bother upgrading the server on all those boxes just to get to a point that is already working with sshpass.

Client. OpenSSH 8.4 has SSH_ASKPASS_REQUIRE that allows one to always invoke SSH_ASKPASS, notably when run from a terminal (previously, it was only invoked when there was no terminal to prompt the password).

Interesting then! Makes sense. Thanks for the explanation.

Re: Non-interactive SSH password authentication

#30

Post by adontz »

I believe privileged access management is the proper way to manage access to a password protected systems.

It is basically a terminal server, proxy, bastion or anything similar. You log in there with federated identity (for example AD) and it logs you in into target system with some shared or temporary user. Usually it also records session and does other security/compliance related things.

Examples are Delinea (former Thycotic), CyberArk, To some extent Apache Guacamole can be used as PAM.

Post reply on HN