120

I need to login to a user that I've created on a remote host running Ubuntu. I can't use an ssh key because the ssh login will happen from a bash script ran within a server that I won't have access to (think continuous integration server like Bamboo).

I understand this isn't an ideal practice, but I want to either set the remote host to not ask for the password or be able to login with something like ssh --passsword foobar user@host, kind of like MySQL allows you to do for logins.

I'm not finding this in man ssh and I'm open to any alternatives to getting around this issue.

Improve this question
3
  • serverfault.com/questions/241588/…
    – Ciro Santilli OurBigBook.com
    Nov 30, 2015 at 21:23
  • The secure way is to generate SSH key with ssh-keygen -t rsa -b 2048 and use this key to log into the remote server as alternative you can install "sshpash" and then you can ssh your machine with following command sshpass -p 'password' ssh username@servername
    – Vadim Sluzky
    Sep 8, 2016 at 14:40
  • 1
    The question this is redirected to is not the same as this one. This one is asking for a way to initiate an interactive session.
    – Chris Quenelle
    Feb 21, 2017 at 19:02

3 Answers 3

Reset to default
196

On Ubuntu, install the sshpass package, then use it like this: 

sshpass -p 'YourPassword' ssh user@host

sshpass also supports passing the keyboard-interactive password from a file or an environment variable, which might be a more appropriate option in any situation where security is relevant. See man sshpass for the details.

Improve this answer
12
  • 4
    Althought is not recommended and not a good practice this is exactly the answer to the question. Consider using keys as stated above. But if there's a major tech issue this is the solution asked
    – theist
    Mar 15, 2013 at 17:14
  • 20
    I only upvote the answer. Not "rational why don't you do it this way instead" answers. Just the answer. hence, I upvoted you :)
    – Henley
    Mar 2, 2014 at 1:05
  • 1
    I don't completely hate sshpass, in fact I'm using it on a temporary basis. However using '-p' is unnecessary and undesirable. Set the variable SSHPASS first and then do sshpass -e ssh <ssh-args>.
    – Andrew Wolfe
    Mar 23, 2015 at 19:59
  • 1
    @Brad If you have root on the box, you can install sshpass using yum --enablerepo=epel install sshpass.
    – likeitlikeit
    Oct 12, 2015 at 10:40
  • 1
    This answer also works on Manjaro (Arch-based).
    – Fabian Röling
    Jan 18, 2021 at 0:28
20

If your alternative is to put a password into a script or ssh command line or plain text file, then you're MUCH better off using an ssh key instead. Either way, anyone who has access to the account where the ssh client script is stored would be able to use that to get into the server, but at least in the case of an ssh key, OpenSSH supports it properly, you don't grant access by other means than ssh, it's more easily revoked if necessary, etc...

You will have to explain why you have a requirement to not use an ssh key.

Consider also using a forced command (command="..." in the .ssh/authorized_keys file) so that the client only has access to run the command they need on the server rather than a full shell.

Improve this answer
14
  • 6
    The remote host is actually a VM used by other engineers with no resources worth risking other than copies of test automation code. For the sake of the discussion, let say the only access I have is to add the script file, not add ssh keys in ~/.ssh/.
    – mmla
    May 16, 2012 at 0:20
  • 7
    That's highly contrived. A somewhat less contrived scenario would be that a misguided administrator of the server disabled ssh key logins (PubkeyAuthentication no in /etc/ssh/sshd_config). In either case, the better solution is to fix the underlying problem that prevents you from doing ssh key logins. Failing that, consult the question pointed to by Gilles.
    – Celada
    May 16, 2012 at 0:29
  • 3
    @MichaelM you dont have to add ssh keys in ~/.ssh/. Add the key wherever you want and use ssh -i /path/to/id_rsa
    – phemmer
    May 16, 2012 at 2:27
  • 8
    Stackexchanges answer should answer the question not argue the question is correct. I have a valid scenario for this. I need to setup my ~/.ssh/authorized_keys in 95 different boxes. I wrote a script to push my authorized_keys file automatically, but still prompts for password. Having the script to prompt for the password once in the beginning would be nicer.
    – L. Holanda
    Apr 26, 2017 at 23:33
  • 11
    I agree with flarn2006. You cannot say "this question is dumb so here's an answer to a different question because I think it's a better question and I know the answer to it".
    – Nick
    Dec 13, 2018 at 19:43
10

First of, like the other respondents, I recommend just using ssh keys. But I will assume that the person controlling the server is simply not going to allow you to use ssh key authentication and you must use password authentication.

You can use ControlMaster and ControlPath.

Let A be the server that you won't have access to (think continuous integration server like Bamboo) and C be the remote host running Ubuntu.

Now let B be some computer that you control. If you can not provide a suitable B computer, this answer will not work.

  1. Create a key pair and add the public part to B's authorized_keys file. Give A the private key. Now you can log into B from A without a password.
  2. On B manually ssh -M -S /tmp/controlpath C and enter your password at the prompt. After that you should be able to log into C from A without a password ssh -S /tmp/controlpath C.

In the script on A you can write ssh B ssh C dostuff.

Every time you reboot B, you will have to reestablish the connection ssh -M -S /tmp/controlpath C.

Improve this answer
0

Not the answer you're looking for? Browse other questions tagged or ask your own question.