UNIX for Dummies Questions & Answers

Hi Admin

I'm trying to execute on a script which in my production server. The production server has to phase login.

First, we need to login to a Taxi server by opening a putty session from there we need to login to production server. Both servers using same LDAP id so I am able to login with same user id.

Currently I am login with public key so that while doing SSH it won't ask for password.

I'm trying to SSH from Taxi to production servers, using user name and password from one text file. But I'm unable to get an idea how i can perform that.

Could you please help me in doing SSH and taking user name and password from a text file....? Is it possible to do so?

Current script i am using which works fine with my ID.

Code:

#!/bin/ksh
SSH_OPTS="-o ConnectTimeout=15 -o BatchMode=yes -o StrictHostKeyChecking=no -o LogLevel=quiet"
echo "$1"  | tr '|' '\n' | while read box
do
  ssh $SSH_OPTS -n $box -l $2 'ksh /home/user/cert.ksh "$2"' >> OUT.log
done

You can use expect command to login to the server

Code:

VAR=$(expect -c 2> /dev/null "
    spawn ssh -n -T -o StrictHostKeyChecking=no $user@$host
    expect \"*?assword:*\"
    send -- \"$passwd\r\"
    send -- \"\r\"
    expect eof
    ")

here user is the user id
host is ip address
and passwd is password...

Please let me know if u need any other help..

The reason why providing passwords to ssh (and similar commands, like passwd) is difficult ist, that - for security reasons - such programs clear <stdin>. A simple redirection program < /some/file or something to that effect will fail therefore.

Using expect or similar tools is possible, but the best solution is to stick with the key provided by the keyfile. Everything else is less secure and more error prone. It will always mean to store the password in a file and at some point of the execution to decrypt it (if it ever was encrypted in first place). If such a process provides enough security for you one has to wonder what you need passwords at all for.

I hope this helps.

bakunin

This is the recommended method, yes. What's wrong with it?

@temp_user

How to use this, could you please explain how to include this in the script.
Is it

Code:

expect \"*?assword:*\"

correct one?

@bakunin

Yes i am using the openssl, so i guess its secured

Code:

passwd=`echo $passwd | openssl enc -base64 -d`

@Corona688
I have an external WEB program through which i am executing a script in a directory which runs and extract the details for the user and display in their screen. To login to the server I want to use the user password and login name so from web they pass that to server and we will save in a file and encrypt and use it for login.

encoding a string in base64 does not make it secured. base64 is not encryption. use SSH keys and make sure you check all return codes.

That is as "secured" as storing the password in clear text. In your command you use the openssl utility only as an encoding tool.

I hope this helps.

bakunin