"ssh" works but "sshpass" doesn't - how is this possible?

Question

I configured key pairs for SSH connection. It works but of course asks for the passphrase.

ssh [email protected]

So now I try to login with sshpass which I have installed. I tried with -p property but also and with -f property and nothing works - it just hangs.

verbose gives these info on the client side

sshpass -v -p "pass" ssh [email protected]
SSHPASS searching for password prompt using match "assword"
SSHPASS read:
SSHPASS read: Enter passphrase for key '/home/user1/.ssh/id_rsa':

On the server side I can see these information in the log:

Accepted key RSA SHA256:V/V29pA2Ps5k/lBgz2R5XFP6vaaaOUN5hj0hca+j8TI found at __PROGRAMDATA__/ssh/administrators_authoriz
ed_keys:1
debug3: mm_answer_keyallowed: publickey authentication test: RSA key is allowed
debug3: mm_request_send: entering, type 23
debug3: send packet: type 60 [preauth]
debug2: userauth_pubkey: authenticated 0 pkalg rsa-sha2-256 [preauth]
debug3: user_specific_delay: user specific delay 0.000ms [preauth]
debug3: ensure_minimum_time_since: elapsed 19.018ms, delaying 1.849ms (requested 5.217ms) [preauth]
Postponed publickey for user1 from 10.7.141.243 port 44750 ssh2 [preauth]

Thanks a lot for your kind assistance!

Answer 1

ssh prompts for and reads password (or passphrase) using the terminal (/dev/tty), not its stdin. This way you can pipe/redirect data to/from ssh and still be able to provide a password when asked. But to provide a password not via the terminal, one needs to present a "fake" terminal to ssh. This is what sshpass does.

When you sshpass … ssh …, sshpass runs ssh in a dedicated emulated terminal. This means ssh does not read directly from your terminal, sshpass does. And ssh does not print directly to your terminal, sshpass does. Eventually sshpass will act as a relay, so it will be as if ssh used your terminal. But before this happens, sshpass intercepts what ssh prints; it also injects the string you specify after -p, then ssh "sees" the string as coming from the terminal ssh is using (which is not your terminal). This way ssh can be fooled you typed the password, when it's sshpass who "typed".

By default sshpass waits for assword: (or assword¹?) to appear as a part of the prompt for password. E.g. if you didn't use a key and you didn't use sshpass, ssh would print:

[email protected]'s password:

and it would wait for you to type your password. If you used sshpass to provide your password, then sshpass would intercept this message and "type" the password for you. By waiting for the right prompt sshpass knows when ssh expects a password, only then it passes your password.

In your case the prompt was different. ssh did not ask for the password, it asked for the passphrase using a different prompt. The prompt from ssh was exactly Enter passphrase for key '/home/user1/.ssh/id_rsa':, there was nothing matching assword:, so sshpass kept waiting for the default prompt that never came.

Use -P to override the default.

-P
Set the password prompt. Sshpass searched for this prompt in the program's output to the TTY as an indication when to send the password. By default sshpass looks for the string assword: (which matches both Password: and password:). If your client's prompt does not fall under either of these, you can override the default with this option.

^{(source: man 1 sshpass)}

In your case it may be:

sshpass -P assphrase -p "pass" ssh [email protected]

Now if sshpass intercepts Enter passphrase … coming from the ssh, it will respond with whatever you specified after -p. Next it will sit as a relay between your terminal and the one ssh is using; it will become transparent.

In general sshpass can be used to provide a password (a string in general) to any tool that normally uses the terminal (as opposed to stdin+stdout+stderr) to prompt for and read the password. -P allows you to adjust the command to the prompt the tool uses.

---

¹ The manual says assword:, but the output from your sshpass -v says using match "assword". One way or another you need -P to properly pass a passphrase.