51–60 of 128 posts
Earlier quoted context omitted.
Why not use something like Kerberos (for example) and have the proper identity also on the system where you log in to via SSH?
Kerberos is a) relatively complex to set up properly if its not a Windows in AD b) an SSO, not federated ID. Which means reasking MFA is not possible.
Seems overly complicated; sshpass works fine for me. (And the passh examples of why sshpass is broken seem contrived to me.)
Overly contrived examples are the hallmark of software zealots. I knew to stop reading after "its more correct variant".
It's an extremely common attitude unfortunately - you can see it all over the place, especially in the Unix/Linux world e.g.
* People thinking sysvinit (janky Bash scripts) are fine.
* 50% of Linux software doesn't work if you have spaces in your path. GNU Make explicitly doesn't support that.
* Over use of text based APIs, e.g. /proc and /sys.
Earlier quoted context omitted.
Kerberos is a) relatively complex to set up properly if its not a Windows in AD b) an SSO, not federated ID. Which means reasking MFA is not possible.
> reasking MFA is not possible Isn't reasking MFA on purpose just a way to make people hate MFA? Shouldn't everything support a "Trust this device" option and then never ask again from it?
Recently I tried to use an sftp script created with expect that ran fine on the command line, but the same script failed to run under cron. I made sure that all environment variables were properly set, but sftp didn't ask me for a password. I think it might have been an issue with the absence of a tty sshpass didn't work, ended up rewriting the whole thing in Paramiko ... only to find out it doesn't respect the http_…
Working with less-than-stellar tools --- ahem ROS --- has taught me how to placate commands that assume interactivity and/or a tty. To wrap up the offending command with a "fake" `tty`, I do script -qfec "mycommand" /dev/null If the thing insists on interactive input, then I break out the big guns: https://manpages.debian.org/bookworm/expect/expect.1.en.html
I had enabled the debug option on expect and I couldn't see the password prompt when the program ran under cron (i was redirecting the script output to a log file). It did appear when running on the prompt though.
I couldn't figure how the sftp program was determining that it was running under cron. I suspect that it was inspecting if stdin was connected to a terminal or not, but I gave up around 4 am.
I believe privileged access management is the proper way to manage access to a password protected systems. It is basically a terminal server, proxy, bastion or anything similar. You log in there with federated identity (for example AD) and it logs you in into target system with some shared or temporary user. Usually it also records session and does other security/compliance related things. Examples are Delinea (forme…
Earlier quoted context omitted.
Working with less-than-stellar tools --- ahem ROS --- has taught me how to placate commands that assume interactivity and/or a tty. To wrap up the offending command with a "fake" `tty`, I do script -qfec "mycommand" /dev/null If the thing insists on interactive input, then I break out the big guns: https://manpages.debian.org/bookworm/expect/expect.1.en.html
I've actually tried script and expect, but they didn't work. I had enabled the debug option on expect and I couldn't see the password prompt when the program ran under cron (i was redirecting the script output to a log file). It did appear when running on the prompt though. I couldn't figure how the sftp program was determining that it was running under cron. I suspect that it was inspecting if stdin was connected to…
Earlier quoted context omitted.
Honest question, unless it's mandated by your employer, or you don't personally care, why would you ever choose to use a service that doesn't offer that?
You may be in a position where you must employ and interact with networked equipment that does not support pubkey authentication.
"All implementations MUST support this method"
I believe privileged access management is the proper way to manage access to a password protected systems. It is basically a terminal server, proxy, bastion or anything similar. You log in there with federated identity (for example AD) and it logs you in into target system with some shared or temporary user. Usually it also records session and does other security/compliance related things. Examples are Delinea (forme…
Earlier quoted context omitted.
You may be in a position where you must employ and interact with networked equipment that does not support pubkey authentication.
Public key authentication is actually a Must Implement for SSHv2. Since SSHv1 is long obsolete, any gear that doesn't have pubkey doesn't actually have a de jure SSH implementation. "All implementations MUST support this method"
Earlier quoted context omitted.
> I ran about 30k machines with sshpass and it worked just fine. Easy to script. I don’t understand at all why we need something else here. Do you keep all your passwords in one directory or in something more complicated?
User: user Pass: 1 Lol
I don't know if that is efficient for 30K machines though.