3

I have a script that needs to run without any user interaction and that needs to set up some SSH port forwarding. It shouldn't prompt for a password - if SSH needs a password to proceed, I'd like my script to error out instead.

Is there any way to get SSH to tell me if my SSH agent is set up correctly to connect to a particular host before attempting the connection?

Improve this question
2
  • Er... What you're really asking is for it to not prompt for a password. This doesn't necessarily have anything to do with agent forwarding.
    – Random832
    Commented May 6, 2016 at 13:36
  • Sort of. What I want is to know when it would prompt for a password ,so I can stop the script with an error.The mostly likely case is that I don't have my forwarding agent set up correctly (say I attached to tmux), or someone else (in my case, Jenkins) is running my script and doesn't have the credentials to open forwarding ports without logging in. I want that to be an error
    – Mark W
    Commented May 6, 2016 at 13:45

2 Answers 2

Reset to default
6

ssh has a "BatchMode" option which will make it simply fail rather than asking for a password. This seems much easier than having your script try to predict whether it will ask for a password. An answer to a similar question on SuperUser points out that merely disabling PasswordAuthentication won't always work because there are multiple different interactive authentication types, and it also doesn't look like it'll stop it from prompting for a passphrase on a key.

You can use ssh -o BatchMode=yes, or put it in your ssh_config for the host.

Also, ssh won't prompt for a password if there is no controlling terminal (it gets an error "read_passphrase: can't open /dev/tty: No such device or address") - you can start a process with no controlling tty with setsid, which you should ideally do when you start Jenkins rather than doing it specifically for the ssh command (this will also prevent sudo from prompting for a password, etc)

Note that if you run a process with setsid it will automatically run in the background (since the shell can't work with job control with processes in different sessions), so you need to be prepared for this by redirecting its stdout/stderr to a log file (and stdin to /dev/null). You can get strange results if a program run in setsid tries to read anything at all from standard input, since the usual mechanisms for preventing a background process from reading the terminal don't work.

Improve this answer
2
  • Perfect! This is exactly what I needed. Thank you.
    – Mark W
    Commented May 6, 2016 at 14:51
  • BatchMode is perfect for my script to run ssh-add if the key is not already loaded. [github.com/go2null/sshag]
    – go2null
    Commented Aug 17, 2017 at 23:11
2

You can't know if it's going to work without actually trying it. There are any number of things that can go wrong.

In your case, looking at the ssh_config man page, I see that there's a 'PasswordAuthentication' option which can be set to no. Looking at the ssh man page, I see that there's a '-o' option that you can use to send config options to the program.

Therefore, I think you can use that to turn off PasswordAuthentication and get what you want.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .