6

I've created a bash script that sometimes need me to enter some information (other machine password / username) when I run it.

Is there a way to prevent this by entering (hard-coding) this information in the code? In this way when I execute it, it will run smoothly without asking me to input anything.

This is the command:

scp /home/machine1/backup/test.txt /home/machine2/backup

Instead of typing the machine2 password, I want to hard code it in my script.

13

SSH key authentication is convenient and secure

Please do not hardcode a password into the shellscript, because it is easy for other people to read it.

  • Login with key authentication to ssh is what you need.

    This way you need no password, and it is more secure too. This is particularly important if the computer is visible on the internet. If you don't think it's important, try logging the login attempts you get for the next week.

    • Running

      ssh-keygen
      

      you will probably be offered to protect the key with a passphrase.

    • Don't do it (press Enter to continue without a passphrase when ssh-keygen asks), because you don't want to type any password or passphrase when you run the script and arrive at the scp command line.

      Without key authentication and with clear-text passwords, it is very important to have strict permissions on the shellscript and it is a good idea also for security related shellscripts without a clear-text passphrase. The default permissions for a script file (when created somewhere in your home directory) is probably 644

      $ ls -l shellscript 
      -rw-r--r-- 1 sudodus sudodus 349 dec 23 10:54 shellscript
      

      and you may give your script files execute permissions for everybody, 755

      $ chmod 755 shellscript
      $ ls -l shellscript 
      -rwxr-xr-x 1 sudodus sudodus 349 dec 23 10:54 shellscript
      

      but you had better cut it down to 600, no permission except for your own userID, and no execute permission at all

      $ chmod 600 shellscript 
      $ ls -l shellscript
      -rw------- 1 sudodus sudodus 349 dec 23 10:54 shellscript
      

      and you cannot run it directly with ./shellscript, so use

      bash shellscript       # when shellscript in the current directory
      bash path-to-shellscript/shellscript  # from other directories
      
    • Do it (enter a passphrase when ssh-keygen asks) if you want higher security, because your private key will be protected (encrypted with the passphrase), but then you have to type the passphrase, when you run the script with scp.

    • You must copy a key file, for example with

      ssh-copy-id <username>@<host>
      
    • scp uses ssh for data transfer. So when the keys are in place, it should work without a password.


  • Every linux machine can be made an ssh server by installing openssh-server, in Ubuntu with apt,

    sudo apt update
    sudo apt install openssh-server
    

  • 1
    "it is easy for other people to read it"... LIke who? As long as you're not including the password in a command argument (which is possible to avoid), why is a +600 script more vulnerable than somebody just copying your private key? – Oli Dec 24 '18 at 15:19
  • @Oli, I have edited the answer in response to your comment: "Without a passphrase it is important to have strict permissions on the shellscript ..." and added "Do it (enter a passphrase when ssh-keygen asks) if you want higher security ...". Is there something [else] that you want me to add or modify? – sudodus Dec 25 '18 at 10:28
  • 2
    To get the best of both worlds, provide a password for ssh-keygen, then use ssh-agent to unlock your key, where you have to provide your password once, and then you can use the key multiple times within the same session without having to provide a password. Won't do when not running the script interactively, of course, like in a cron job. – Alex Dec 27 '18 at 18:17
  • 1
    You may want to mention ssh-add which allows you to protect your key but enter the password only once per session. – Raphael Jan 4 at 9:26
  • @Raphael, Thanks for mentioning ssh-add :-) – sudodus Jan 4 at 9:31
1

Set up ssh access to your server with an rsa public/private key pair. Keep your private key loaded in memory. Then you can scp or ssh into the server without a password (besides making life easier, key file authentication is significantly more secure than password authentication)

Here's how to set up ssh for key file authentication: https://www.digitalocean.com/community/tutorials/how-to-set-up-ssh-keys--2

0

Use sshpass. In Ubuntu, you can install it with sudo apt install sshpass.

This general syntax should do the trick:

sshpass -p<password> <source> <destination>

But this is not secure. Let's not put convenience too far ahead of basic security. Any other user on the system can see the commands and arguments being run by other users. To protect against that you can have sshpass read from an environment variable.

export SSHPASS=<password>
sshpass -e scp <source> <destination>

I would also recommend running unset SSHPASS if anything else in your script isn't trusted.

  • 4
    The -p option should be considered the least secure of all of sshpass's options. All system users can see the password in the command line with a simple "ps" command. Sshpass makes a minimal attempt to hide the password, but such attempts are doomed to create race conditions without actually solving the problem. Users of sshpass are encouraged to use one of the other password passing techniques, which are all more secure. – Elder Geek Dec 22 '18 at 15:12
  • you might wish to refer to the man page for sshpass and review the section on security considerations which is where this comment cam from. – Elder Geek Dec 27 '18 at 17:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.