3

Need ssh command to connect another linux box from a linux box and fetch a output of particular command but connection should be established forcibly without prompting any ssh key to save, cancel.

So far tried command to connect and fetch output but receiving prompt to save public ssh key

value=$(ssh -q -P $passwd $userid@$box "head -1 /users/SB1.txt")
2
  • 1
    ssh does not have an option for passing a password by argument or through standard input. This is by design. You can use key-pair authentication to easily do what you seek, or use a tool such as Ansible if for some reason keypairs are impermissible.
    – DopeGhoti
    Commented Oct 23, 2017 at 21:52
  • can you share the steps/command for key-pair authentication ? Commented Oct 23, 2017 at 21:53

4 Answers 4

4

You are looking to disable "Host Key Verification" and you need the following SSH options:

StrictHostKeyChecking no
UserKnownHostsFile /dev/null

If adding them to the command (rather than your ssh config file) then use

-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null

after the -q in your example command.

8
  • Note that, obviously, this reduces security by not checking the host keys and it might generate a warning for each ssh connection telling you that it wasn't possible to find the known hosts file.
    – Zip
    Commented Oct 23, 2017 at 22:06
  • 1
    command will be like value=$(ssh -q -P -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null $passwd $userid@$box "head -1 /users/SB1.txt") ? Commented Oct 23, 2017 at 22:08
  • It shouldn't generate a warning (because /dev/null does exist). But yes this runs the risk that an attacker might get you to run the command on their computer instead of your own. Commented Oct 23, 2017 at 22:09
  • @user8554534 Yes, except I don't know what the -P option is for. If you are trying to use it for a password then that is wrong as @DopeGhoti has said. Commented Oct 23, 2017 at 22:12
  • 1
    @user8554534+Mark: something in the form listfoos | while read foo; do ssh using $foo; done fails because the first ssh 'drains' the other foos from stdin leaving no more foos for the while loop; see #24260 #66154 #107800 and SO #3214512 #346445 Commented Oct 24, 2017 at 5:35
2

Prepare (once on your SSH client user and box): Create a key pair for public key authentication

ssh-keygen -N '' -t rsa -f ~/.ssh/id_rsa

Prepare (manually/interactively, once per user/server): Setup public key authentication, and accept host key without asking (this will ask you for $userid's password once):

ssh-copy-id -o "StrictHostKeyChecking = no" $userid@$box

Then run your remote command without any interaction:

value=$(ssh -o 'BatchMode = yes' $userid@$box "head -1 /users/SB1.txt")

Your SSH client already knows the server's SSH host key by now, since it was added when you ran ssh-copy-id.

1

There are two parts to this. To connect without a password prompt, assuming you want to use password authentication (as implied in your question), you should use the program sshpass. That is available to install via the package manager in many/most linux distros. From the manual page:

sshpass is a utility designed for running ssh using the mode referred to as "keyboard-interactive" password authentication, but in non-interactive mode.

Of course setting up an ssh key is preferable, but it's not possible to get your public key to the remote system at first without using the ssh password unless you have a different secure channel to do that with. Given you're going to need to use the password to put your key there, you might as well use the password to do the job if this is a one-off.

The second part is, you need to set an appropriate value for StrictHostKeyChecking to prevent a prompt to save the key if this is the first time. Typically you could use StrictHostKeyChecking=accept-new. Then ssh will automatically add new host keys to the user known hosts file without prompting.

So a typical command could be:

value=$(sshpass -p$passwd ssh -q -oStrictHostKeyChecking=accept-new $userid@$box "head -1 /users/SB1.txt")
-1

You should definitely not mess with hostkeys, that's a bad idea.

What you should do is utilize ssh-keygen(1) (see 'man ssh-keygen') and create a public and private key. Since you don't want a password prompt simply don't supply a password. You'll find the results in the .ssh directory of your home directory (~/.ssh).

Next: add the contents of ~/.ssh/id_rsa.pub to the ~/.ssh/authorized_keys file on the remote server (you'll probably need to make it yourself).

Finally: tell SSH (sshd) that users are allowed to authorize with remote keys. This could be a default setting, but I'm not fully sure about every Linux distribution out there. Look for the option PubkeyAuthentication and make sure it's enabled.

SO what is going to happen here: you'll still be authorizing yourself with a rather strong authentication (your external key, kept in ~/.ssh/id_rsa) but because you didn't provide a password none will be requested and it'll make the login procedure "instant".

However, without sacrificing any security (only originated from your machine because everyone who uses that specific account can log on to the remote server, but that should be obvious).

But once again: Messing with StrictHostKeyChecking is a bad idea, and totally unneeded.

2
  • Without disabling host key checking it will still prompt on first login "Do you want to connect?" which is what the asker has said he wishes to avoid. Adding authentication keypairs is probably also needed/desirable but is not what he asked about. Commented Oct 23, 2017 at 23:04
  • Well, we'll have to agree to disagree then. The OP literally asked for a connection "without prompting any ssh key to save" which could be open for interpretation but to me boils down to a seemingly log on without further prompting. And the way to do that is described in my comment.
    – ShelLuser
    Commented Oct 24, 2017 at 0:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .