SSH autologin

ssh  is mostly a straightforward replacement of the rsh command and telnet.  Key difference in how ssh performs  is authentication. In addition SSH stored host keys. One side effect of this change is that autologin in not that easy. The simplest way to achive this is to use Passwordless SSH login

telnet Versus ssh

The telnet command is occasionally used in autologin mode. The following is a Korn shell script fragment that automates the telnet session:

 (
  sleep 2
  echo login 
  sleep 2
  echo password 
  sleep 2
  echo command 
  sleep 2
 ) | telnet hostname

Unlike telnet , this will not work with ssh . The Secure Shell client was programmed to ignore passwords that are passed in this manner, as shown in the following example.

$ ( sleep 2 ; echo "password^M"; sleep 2; ls;
 sleep 2 ) | ssh host -1 user
 Pseudo-terminal will not be allocated because
 stdin  is not a terminal.

 user@host's password: password
 Permission denied, please try again.
 Unable to find an authentication method

The ssh command can be tricked around this limitation by using Expect. The following is an example of a short Expect script to automate logins with passwords when using the Secure Shell:

 #!/usr/local/bin/expect
 #
 #
 spawn /usr/bin/ssh host -1 user
 expect {*password:}
 send "password\r"
 #
 expect {*home*} exit
 send "command\r"
 sleep 2
 #
 expect {*home*} exit

Automated Logins

Automating logins to a system requires the script to either possess or have access to the needed authentication credentials. The problem is protecting the destination host from compromised credentials. This requires safeguarding the credentials. A balance must be struck between security and cost in terms of scalability and maintenance. There is no perfect solution.

Secure Shell provides several choices of credentials:

• Embedded passwords
• Unencrypted identities
• Embedded passphrases for encrypted user identities (discussed in Chapter 6)
• Agents

Each choice has drawbacks:

The most resistant solution is to use agents with manually loaded keys. The problem here is twofold: maintenance and scalability. Humans are neither completely reliable nor completely dependable. The operator must be present to reload keys into the agent in the case of a failure (for example, a system crash or power loss). The operator does not scale well either. This solution requires a central machine or small cluster of machines from which remote jobs are started. A potential single-point-of-failure exists.

There is no easy, secure solution to the problem of automated remote access. A compromise solution is to use encrypted user identities in conjunction with RBAC. Secure Shell secures the network connection. The user identity limits the authorization points (the private key and passphrase must be copied first). RBAC also limits the privileges of the account.

Host Keys

The major difference in Secure Shell being a drop-in replacement for the Berkeley r-commands is host key management. Before the user can be authenticated, the destination host's Secure Shell daemon must be authenticated to the client. This is done by matching a locally stored host key copy to the host key offered by the Secure Shell daemon.

When there is no locally-stored copy, both the Solaris Secure Shell software and OpenSSH default to asking whether or not to accept the newly encountered key. This adds complexity to a script, as shown in the following example.

 $ ssh host
 The authenticity of host 'host' can't be established.
 RSA key fingerprint in md5 is:
 7a:71:ff:d9:6d:19:d6:d9:ef:f9:4d:3f:92:7a:77:7b
 Are you sure you want to continue connecting(yes/no)?

The least secure method to remove this complexity is to turn off host key checking by setting StrictHostKeyChecking to no in ~/.ssh/config. The most secure solution is to acquire all of the host keys ahead of time and place them in ~./ssh/known_hosts.

rsh Versus ssh

In basic usage, the ssh command is a direct replacement for the rsh command. The major difference between them is authentication. If an ssh command is issued and a password or passphrase is needed, it will be prompted for, then the command will be executed. In this case, the rsh command will fail with a permission denied error.

$ rsh host -1 user cat /etc/passwd
 permission denied
 $ ssh host -1 user cat /etc/passwd
 user@host's password: password
 root:x:0:1:Super-User:/:/sbin/sh
 daemon:x:1:1::/:
 bin:x:2:2::/usr/bin:
 sys:x:3:3::/:
 adm:x:4:4:Admin:/var/adm:
 lp:x:71:8:Line Printer Admin:/usr/spool/lp:
 uucp:x:5:5:uucp Admin:/usr/lib/uucp:
 nuucp:x:9:9:uucp Admin:/var/spool/uucppublic:/usr
/lib/uucp/uucico
 smmsp:x:25:25:SendMail Message Submission Program:/:
 listen:x:37:4:Network Admin:/usr/net/nls:
 nobody:x:60001:60001:Nobody:/:
 noaccess:x:60002:60002:No Access User:/:
 nobody4:x:65534:65534:SunOS 4.x Nobody:/:

For background jobs, ssh also supports the -n option to set standard input to /dev/null. Alternatively,-f sets standard input to /dev/null after password or passphrase requests, but before command execution. If no remote execution is required and only port forwarding requested, the -N option can be used (Protocol 2 only).

rcp Versus scp

The rcp command has the same authentication problem as the rsh command. As with ssh , the scp command will prompt for passphrases and passwords as needed. Unlike the rcp command, scp displays a progress meter as it copies the file. This behavior can be disabled with the -q option. The scp command can also optionally compress the data stream using the-C option.

The following example shows the rcp authentication problem and thescp command's progress meter.

 rcp user@host:/etc/passwd /tmp
 permission denied
 $ scp user@host:/etc/passwd /tmp
 user@host's password: password
 passwd 100% |*****************************| 1044 
    00:00

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: March, 12, 2019