15

I'm creating a small backup script using sshfs:

sshfs backup_user@target_ip:/home /mnt/backup

Is there a way to include the password in this command?

Or is there another file transfer solution where the login password can be included other than FTP/SFTP?

  • 4
    You can use ssh-gkeygen to generate an RSA key pair then configure ssh (client and server) to use RSA authentication. Have you done this before for "regular" ssh authentication? – airhuff Jan 15 '17 at 0:22
  • yes but then I have to change the way servers are connecting via ssh .. as far I know authentication can be key based or login/password not both at the same time.. – Zaza Jan 15 '17 at 0:27
  • 2
    They can be both. They usually are. This way, a newly created user can push their key on the server by entering their password. Subsequently, they use their key. – xhienne Jan 15 '17 at 0:28
13

-o password_stdin do not seem to be working on all systems, for instance freeBSD. etc.

You can also use expect Interpreter, it should work with sshfs and should do the trick.

Another solution would be sshpass, for instance, let say your are backing up directory /var/www

Backing up:

name=$(date '+%y-%m-%d')
mkdir /backup/$name && tar -czvf /backup/$name/"$name.tar.gz" /var/www

uploading backup file to backup server

sshpass -p "your_password" scp -r backup_user@target_ip:/home/ /backup/$name

So it will upload directory with today's backup

But still, as it was said higher, best(safe and simple) way would be to use ssh key pair
The only inconvenience would be that you have to go through the key generation process once on every server you need to pair, but it is better than keeping a password in plain text format on all servers you want to back up :),

Generating a Key Pair the Proper way

  • On Local server

    ssh-keygen -t rsa
    
  • On remote Server

    ssh root@remote_servers_ip "mkdir -p .ssh"
    
  • Uploading Generated Public Keys to the Remote Server

    cat ~/.ssh/id_rsa.pub | ssh root@remote_servers_ip "cat >> ~/.ssh/authorized_keys"
    
  • Set Permissions on Remote server

    ssh root@remote_servers_ip "chmod 700 ~/.ssh; chmod 640 ~/.ssh/authorized_keys"
    
  • Login

    ssh root@remote_servers_ip
    
  • Enabling SSH Protocol v2

    uncomment "Protocol 2" in /etc/ssh/sshd_config

  • enabling public key authorization in sshd

    uncomment "PubkeyAuthentication yes" in /etc/ssh/sshd_config

  • If StrictModes is set to yes in /etc/ssh/sshd_config then

    restorecon -Rv ~/.ssh
    
| improve this answer | |
14

According to the manual, there is an option -o password_stdin which might allow to read the password from standard input, which can probably be a redirection. I have never used it, so I'm speculating.

That said, I strongly advise against such a solution which is inherently insecure.

ssh works very well with a system of private/public keys. It is simple and secure. No need to enter a password or to write it in clear in a shell script. Just push your public key on the server and you can connect immediately.

| improve this answer | |
  • Can anyone provide a working example of this solution? I'm trying the following, but it is not working: printf "my_password\n" | sshfs username@hostname:/remote_fs $HOME/local_dir – MikeyE Jul 10 '18 at 12:42
  • FYI, I should have mentioned I'm using a password protected SSH key. I was able to get it working using the answer provided by @nathan-s-watson-haigh found here: unix.stackexchange.com/questions/128974/… – MikeyE Jul 10 '18 at 13:07
  • I don't have any matching environment at hand that would allow me to test a ssfs-mount with a password protected SSH key. Anyway, what strikes me at first in your command is that I don't see any -o password_stdin option. – xhienne Jul 10 '18 at 14:09
  • Thanks for the input. I tried the following command just now, and it does not ask for a password, but it also does not return. Meaning, it just sits there waiting for the command to complete, no command prompt displayed. I tried the command: printf "my_password\n" | sshfs -o password_stdin user@hostname:/ $HOME/local_dir P.S. I'm on Debian Buster P.P.S. This works, but prompts for a password: sshfs -o password_stdin user@hostname:/ $HOME/local_dir – MikeyE Jul 13 '18 at 16:32
  • I disagree that using -o password_stdin is inherently insecure. You're making too many assumptions about how it is used. Sure, it can be abused by hardcoding passwords into shell scripts. Obviously that is insecure. But that's far from the only use case. There are plenty of ways to use this option that are no less secure than using the normal password prompt. Also, not every SFTP user has the option to use SSH keys. Furthermore, not every server needs to be hardened. Many of the test vms at my company use the same password because we want anyone in our local network to be able to login. – Drew May 20 at 20:02
12

Piping the 'sshfs password' with <<< to -o password_stdin works on bash:

sshfs -o password_stdin backup_user@target_ip:/home /mnt/backup <<< 'sshfs password'
| improve this answer | |
  • 4
    This should be the accepted answer .. works on any Linux OS. – argon Oct 27 '18 at 6:21
  • so, how to put it in the file mnt-media.mount for automatic mounting with systemd? – charles Feb 23 '19 at 12:20
  • One super minor comment: if your password has special BASH characters in it (like a bang(!)), then you should use single quotes instead of double quotes for the password. – Kyle Challis Aug 29 '19 at 0:13
8
echo 'password' | sshfs user@host:/dir /mnt -o password_stdin

The "-o password_stdin" option is what enables you to pipe your password.

That said, keys are a better option, unless your service provider doesn't let you use them for sftp. (This is one of WP Engine's notable failures.)

| improve this answer | |
  • Can you please clarify your answer. Only one line of code do not count in SE as good answer – Romeo Ninov Jun 6 '17 at 3:44
  • @RomeoNinov I'd say this post does answer the question well enough. Not everybody is inclined to write a novel explaining why the obvious is obvious. – Satō Katsura Jun 6 '17 at 6:48
  • @SatoKatsura Thanks. I'm up to the challenge, though. – iateadonut Jun 7 '17 at 5:39
2

one thing to keep in mind is that if you are using the -o password_stdin option, it might appear to not be working because sshfs will ask whether to connect to the host or not (if it is the first time you connect to it and it is not added to the known hosts file yet). If you are running it in a batch you will never see sshfs asking. Workarounds to avoid this are:

  1. add the -o StrictHostKeyChecking=no option to sshfs or
  2. run sshfs manually once to add the host to the known hosts file
| improve this answer | |
  • This was the final piece of the puzzle! Thank you! – IronEagle Mar 13 at 17:16
2

Mount script:

#!/bin/bash
server=<host>
user=<username>
pass=<password>
root=<hostpath>
mount=$(pwd)/sshfs

type sshfs >/dev/null 2>&1 || { echo >&2 "sshfs required"; exit 1; }
type sshpass >/dev/null 2>&1 || { echo >&2 "sshpass required"; exit 1; }

mkdir -p $mount

SSHPASS="$pass" sshfs $server:$root $mount -o ssh_command="sshpass -e ssh -l $user"

Unmount:

#!/bin/bash

mount=$(pwd)/sshfs

fusermount -u $mount
| improve this answer | |
0

Automatic script to connect sftp with sshfs

#!/bin/bash
expect <<END
spawn sshfs sftpuser@ip:/folder /mnt/folder -p 22 -o password_stdin
send "password\r"
expect eof
END
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.