Sudo with password and append to file via SSH

Question

What i'm trying to do is the following.

SSH to remote host.

Append the public_keys in the logged in users authorized_keys file to all the users .ssh/authorized_keys file.

I've run into problem when trying to perform sudo & cat with password in one line. Anyone have an idea how to solve this?

One of the ways i've tried achieving this.

ssh -t $userHost -p $remotePort \
"for localUser in $(ls /home | grep -v $USER); \ 
do sudo mkdir -p /home/$localUser/.ssh && \
cat /home/$USER/.ssh/authorized_keys | sudo tee --append \
/home/$localUser/.ssh/authorized_keys > /dev/null; done"

But the sudo command doesnt seem work as an ssh command. NOPASSWD in the sudoers file is not an option.

Answer 1

sudo with password will require a tty. The remote command execution will not have a tty assigned to it. Hence it will not work unless you have NOPASSWD allowed.

Instead consider having a captive account on the remote server, with a script being the shell and your script running the command. You login to the captive account with key-based authentication to circumvent typing password twice, run the script automatically. On the last line of your script, issue an exit command to log out. Since this will essentially be an interactive session, it will have a tty and will allow you to type the password, while the number of keystrokes you have to make staying the same.

I can't think of any other way, unless there is a new feature in sudo that I am not aware of

Answer 2

This is how i solved it.

#!/bin/bash

userHost="user@host.example"
remotePort="1234"
password="password"

# Send public key to remote host
echo "Sending public key to remote host..."
cat "$HOME/.ssh/id_rsa.pub" | ssh $userHost \ 
-p $remotePort "cat >> ~/.ssh/authorized_keys"

# Add the public key to all users on the remote system
ssh $userHost -p $remotePort 'echo '"$password"' | sudo -S \
ls /home/ && for localUser in $(ls /home | grep -v $USER); \
do sudo mkdir -p /home/$localUser/.ssh && \
sudo touch /home/$localUser/.ssh/authorized_keys && \
sudo chown "$localUser:$localUser" /home/$localUser/.ssh/authorized_keys && \
cat /home/$USER/.ssh/authorized_keys | sudo tee \
--append /home/$localUser/.ssh/authorized_keys > /dev/null; done'

I first use the echo '"$password"' | sudo -S ls /home/ garbage-command to read from stdin and cache the password on the remote host. Then proceed with the rest of the sudo commands.

Quite messy oneliner, but this script is only intended to be run once per remote host anyway.

Don't like the fact that i have to enter the SSH password two times , first to store it in a variable and second to proceed with the first login to the remote-host.