Shell Programming and Scripting

Dear folks,

The title of my thread says mostly all of what I want to do. Basically I want to auto-ssh to a remote host, and run a program on it (VLC is just an example). I wrote a script which calls xterm and then runs expect on it. The code is as follow

Code:

#!/bin/bash

export PASS="xxxxxxx"
xterm -T VLC -e "(expect -c \"
set timeout -1
spawn ssh -X user@192.168.1.2 \\\"vlc\\\"
match_max 100000
expect \\\"*?assword:*\\\"
send -- \\\"$PASS\\r\\\"
send -- \\\"\\r\\\"
interact\") &> /dev/null"

Obviously, one can use ps to reveal what is happening

Code:

$ ps -elf | grep vlc
0 S user 11371 11370  0  80   0 -  2599 select 16:14 pts/1    00:00:00 xterm -T VLC -e (expect -c "?set timeout -1?spawn ssh -X user@192.168.1.2 \"vlc\"?match_max 100000?expect \"*?assword:*\"?send -- \"xxxxxxx\r\"?send -- \"\r\"?interact") &> /dev/null
0 S user 11372 11371  0  80   0 -  1111 wait   16:14 pts/2    00:00:00 bash -c (expect -c "?set timeout -1?spawn ssh -X user@192.168.1.2 \"vlc\"?match_max 100000?expect \"*?assword:*\"?send -- \"xxxxxxx\r\"?send -- \"\r\"?interact") &> /dev/null
0 S user 11373 11372  0  80   0 -  2982 futex_ 16:14 pts/2    00:00:00 expect -c ?set timeout -1?spawn ssh -X user@192.168.1.2 "vlc"?match_max 100000?expect "*?assword:*"?send -- "xxxxxxx\r"?send -- "\r"?interact
0 S user 11375 11373  0  80   0 -  1363 select 16:14 pts/3    00:00:00 ssh -X user@192.168.1.2 vlc
0 S user 11398 11381  0  80   0 -   834 pipe_w 16:14 pts/4    00:00:00 grep vlc

and then one can easily see the password I put in the code.

The primary reason for the code is to create a ready-to-run program for non-tech people (who have no idea about unix, about ssh, and who are not given ssh account as well), and of course I do not want them to know my password. Of course, they might be so novice that they might not know that ps command, but I just want to have some security for myself.

Any idea or advice will be greatly appreciated,

PS: the host is linux (red hat), and clients are Mac OS X (so expect and ssh can be used)

D.

Use public/private key authentication. See Google Search Results for private key authentication | The UNIX and Linux Forums

Thanks danmero for your suggestion. I want to avoid this as well, because I want to create a ready-to-run program, no need to type anything else (pass phrase for example).

D.

Whenever I post a script on my blog and include my email address, I obfuscate it with the tr command to thwart spambots. It could be used here too. If the pass was LinuxRules you could use

Code:

pass=$(echo "LinZxRZles | tr "Z" "u")'

You could also use parameter expansion to pick out the password from a longer random-looking string. None of this provides security, just a little confusion for curious novices.

You can create a key pair whithout passphrase. You'll only need to give the password once for the key transfer.

Your tr'ing way is interesting fubaya. Honestly I have not heard of tr before. Anyway, that is just to protect the bash script itself, not the information produced by ps. The second way (which I thought of as well, by creating a complicated script to select the password that I want) does not help in case of ps either.

D.

---------- Post updated at 08:15 PM ---------- Previous update was at 08:12 PM ----------

shc is great, I just tried it and it works great for its purposes. Thanks for this information danmero, although again, it helps protecting the bash script, but the password still shows up when ps'ing.

D.

---------- Post updated at 08:23 PM ---------- Previous update was at 08:15 PM ----------

I am not sure if I miss something, but I am also using ssh without password in another box. Some points should be pointed out:

* This method needs some setups on clients (creat and copy ssh key etc...)
* This method needs passphrase each time a new shell is created on host (or first time user logs in), which is my case. Our remote host is a cluster, and each time I log on, a new shell is created.

The first point alone needs a lot of works, which is opposed to what I want to do: my program should be ready to run in any new client in the network without any complicated setup.

Thanks,

D.

---------- Post updated at 08:41 PM ---------- Previous update was at 08:23 PM ----------

I think of some solutions:

* fool ps so that the processes showed by ps'ing (xterm, bash... ) are something else (fake name) or without parameters (such as xterm, or expect or bash only)

* temporary disable ps (by chmod 500 `which ps` for example, which needs root privilege) or temporary link ps to a modified ps which does not show the processes I want to hide)

* encrypted password so that ps shows only weird characters on password fields (not sure if this is doable)

Google gave me some *change name or title of processes*, but it seems to me that those work only for the script, not the processes called by the script (like ssh, expect etc...)

Any other ideas?

Thanks,

D.