In Dropbear SSH client, you can provide the password with DROPBEAR_PASSWORD environment variable
Non-interactive SSH password authentication
91–100 of 128 posts
Re: Non-interactive SSH password authentication
#92Recently I tried to use an sftp script created with expect that ran fine on the command line, but the same script failed to run under cron. I made sure that all environment variables were properly set, but sftp didn't ask me for a password. I think it might have been an issue with the absence of a tty sshpass didn't work, ended up rewriting the whole thing in Paramiko ... only to find out it doesn't respect the http_…
Avoid sftp and use rsync instead (much better support for more types of metadata, more robust error handling).
Avoid passwords and use keys instead (easier to distribute, easier to generate, lets you lock them down to a single command).
The above avoids much unnecessary thinking.
If you really have to, there's always sshpass. And ssh -t to allocate a tty even if you are running without one. But this is seldom really necessary, first try harder do it the easy way.
Re: Non-interactive SSH password authentication
#93Recently I tried to use an sftp script created with expect that ran fine on the command line, but the same script failed to run under cron. I made sure that all environment variables were properly set, but sftp didn't ask me for a password. I think it might have been an issue with the absence of a tty sshpass didn't work, ended up rewriting the whole thing in Paramiko ... only to find out it doesn't respect the http_…
Avoid sftp and use rsync instead (much better support for more types of metadata, more robust error handling). Avoid passwords and use keys instead (easier to distribute, easier to generate, lets you lock them down to a single command). The above avoids much unnecessary thinking. If you really have to, there's always sshpass. And ssh -t to allocate a tty even if you are running without one. But this is seldom really…
> Avoid sftp and use rsync instead
I should have explored rsync better. I asked chatgpt some use cases and it made seem to be a bad fit because I needed to also delete some files on the destination machine. My prompt fu was probably a bit bad at the time.
> Avoid passwords and use keys instead .
The vendor only provides password authentication in this case
> If you really have to, there's always sshpass.
I´ve tried it, but sftp, when running under a cron script, detects that it is not running in interactive mode and does not issue the password prompt. The problem might have been caused by the TERM environment variable not being set as another reader suggested.
> And ssh -t to allocate a tty even if you are running without one. But this is seldom really necessary
I've used -o RequestTTY=force, but it also didn't work. Granted, it was close to 4 am and I might have missed a key aspect.
> first try harder do it the easy way.
Paramiko endep up being easier once I understood how to use the proxy command to interact with the company's http proxy.
Re: Non-interactive SSH password authentication
#94It's interesting.
So, I wonder the difference between this method and expect command?
Re: Non-interactive SSH password authentication
#95Earlier quoted context omitted.
You may be in a position where you must employ and interact with networked equipment that does not support pubkey authentication.
Public key authentication is actually a Must Implement for SSHv2. Since SSHv1 is long obsolete, any gear that doesn't have pubkey doesn't actually have a de jure SSH implementation. "All implementations MUST support this method"
And if you don't, anyway? Do you not get to use the SSH(TM) logo on your product? You're reading MUST a bit too literally.
Re: Non-interactive SSH password authentication
#96Earlier quoted context omitted.
That doesn't mean it's always easy to install and manage keys. For example, the author of the passh tool recommended by this post somehow managed to come away with the impression that OpenWRT's ssh server only supports password authentication.
Another example: Ubiquiti gateway consoles like the UDM-Pro. You can install an SSH key but these are erased on reboot. So after every reboot I have a script that uses the SSH user password to re-install an SSH key but this can’t be relied upon and I haven’t found a way to make an SSH key persist.
Re: Non-interactive SSH password authentication
#97Earlier quoted context omitted.
I'd rather reask credentials before elevating effective access level. Just like sudo reasks password. I don't mean reasking MFA to access corporate intranet website with a blog no one reads, I mean reasking for administrative access.
If you want a session with extra permissions you use an appropriate Kerberos principal, e.g. admin/...
I know. This practice of having two user accounts sucks.
Re: Non-interactive SSH password authentication
#98Earlier quoted context omitted.
Overly contrived examples are the hallmark of software zealots. I knew to stop reading after "its more correct variant".
Ignoring failures because they're moderately unlikely is the hallmark of a bad developer. It's an extremely common attitude unfortunately - you can see it all over the place, especially in the Unix/Linux world e.g. * People thinking sysvinit (janky Bash scripts) are fine. * 50% of Linux software doesn't work if you have spaces in your path. GNU Make explicitly doesn't support that. * Over use of text based APIs, e.g.…
1) How are shell scripts janky? Could you elaborate on that? Obviously if someone doesn't know shell very well they will write suboptimal scripts. Personally I use runit init, which uses shell scripts for services and it works well.
2) No idea where you got that from, I never had a problem with this (as a full-time Linux user)
3) Mixed opinions on this one. There's a ton of various info in /proc that could theoretically be exposed via different syscalls, or maybe a single syscall? But having a text-based API in this case isn't a big issue really.
Re: Non-interactive SSH password authentication
#99Earlier quoted context omitted.
Working with less-than-stellar tools --- ahem ROS --- has taught me how to placate commands that assume interactivity and/or a tty. To wrap up the offending command with a "fake" `tty`, I do script -qfec "mycommand" /dev/null If the thing insists on interactive input, then I break out the big guns: https://manpages.debian.org/bookworm/expect/expect.1.en.html
I've actually tried script and expect, but they didn't work. I had enabled the debug option on expect and I couldn't see the password prompt when the program ran under cron (i was redirecting the script output to a log file). It did appear when running on the prompt though. I couldn't figure how the sftp program was determining that it was running under cron. I suspect that it was inspecting if stdin was connected to…
It was probably checking for a 'controlling terminal' by e.g. opening /dev/tty.
Re: Non-interactive SSH password authentication
#100I believe privileged access management is the proper way to manage access to a password protected systems. It is basically a terminal server, proxy, bastion or anything similar. You log in there with federated identity (for example AD) and it logs you in into target system with some shared or temporary user. Usually it also records session and does other security/compliance related things. Examples are Delinea (forme…
Is there any tool out there that can provide this using short lived ssh certificates?