Softpanorama

May the source be with you, but remember the KISS principle ;-)
Home Switchboard Unix Administration Red Hat TCP/IP Networks Neoliberalism Toxic Managers
(slightly skeptical) Educational society promoting "Back to basics" movement against IT overcomplexity and  bastardization of classic Unix

SSH autologin

News SSH Recommended Links Reference ssh-keygen SSH autologin Passwordless SSH login
Private and Public key management SCP sftp Mini-tutorial Tips Humor Etc

ssh  is mostly a straightforward replacement of the rsh command and telnet.  Key difference in how ssh performs  is authentication. In addition SSH stored host keys. One side effect of this change is that autologin in not that easy. The simplest way to achive this is to use Passwordless SSH login

telnet Versus ssh

The telnet command is occasionally used in autologin mode. The following is a Korn shell script fragment that automates the telnet session:

 (
  sleep 2
  echo login 
  sleep 2
  echo password 
  sleep 2
  echo command 
  sleep 2
 ) | telnet hostname

Unlike telnet , this will not work with ssh . The Secure Shell client was programmed to ignore passwords that are passed in this manner, as shown in the following example.

$ ( sleep 2 ; echo "password^M"; sleep 2; ls;
 sleep 2 ) | ssh host -1 user
 Pseudo-terminal will not be allocated because
 stdin  is not a terminal.

 user@host's password: password
 Permission denied, please try again.
 Unable to find an authentication method

The ssh command can be tricked around this limitation by using Expect. The following is an example of a short Expect script to automate logins with passwords when using the Secure Shell:

 #!/usr/local/bin/expect
 #
 #
 spawn /usr/bin/ssh host -1 user
 expect {*password:}
 send "password\r"
 #
 expect {*home*} exit
 send "command\r"
 sleep 2
 #
 expect {*home*} exit

Automated Logins

Automating logins to a system requires the script to either possess or have access to the needed authentication credentials. The problem is protecting the destination host from compromised credentials. This requires safeguarding the credentials. A balance must be struck between security and cost in terms of scalability and maintenance. There is no perfect solution.

Secure Shell provides several choices of credentials:

Each choice has drawbacks:

Method Problem
Embedded passwords Compromised by reading the script source code
Unencrypted user identities Compromised by copying the private identity key
Embedded passphrases for encrypted user identities Compromised by reading the script source code
Agents Requires loading of the agent

The most resistant solution is to use agents with manually loaded keys. The problem here is twofold: maintenance and scalability. Humans are neither completely reliable nor completely dependable. The operator must be present to reload keys into the agent in the case of a failure (for example, a system crash or power loss). The operator does not scale well either. This solution requires a central machine or small cluster of machines from which remote jobs are started. A potential single-point-of-failure exists.

There is no easy, secure solution to the problem of automated remote access. A compromise solution is to use encrypted user identities in conjunction with RBAC. Secure Shell secures the network connection. The user identity limits the authorization points (the private key and passphrase must be copied first). RBAC also limits the privileges of the account.

Host Keys

The major difference in Secure Shell being a drop-in replacement for the Berkeley r-commands is host key management. Before the user can be authenticated, the destination host's Secure Shell daemon must be authenticated to the client. This is done by matching a locally stored host key copy to the host key offered by the Secure Shell daemon.

When there is no locally-stored copy, both the Solaris Secure Shell software and OpenSSH default to asking whether or not to accept the newly encountered key. This adds complexity to a script, as shown in the following example.

 $ ssh host
 The authenticity of host 'host' can't be established.
 RSA key fingerprint in md5 is:
 7a:71:ff:d9:6d:19:d6:d9:ef:f9:4d:3f:92:7a:77:7b
 Are you sure you want to continue connecting(yes/no)?

The least secure method to remove this complexity is to turn off host key checking by setting StrictHostKeyChecking to no in ~/.ssh/config. The most secure solution is to acquire all of the host keys ahead of time and place them in ~./ssh/known_hosts.

rsh Versus ssh

In basic usage, the ssh command is a direct replacement for the rsh command. The major difference between them is authentication. If an ssh command is issued and a password or passphrase is needed, it will be prompted for, then the command will be executed. In this case, the rsh command will fail with a permission denied error.

$ rsh host -1 user cat /etc/passwd
 permission denied
 $ ssh host -1 user cat /etc/passwd
 user@host's password: password
 root:x:0:1:Super-User:/:/sbin/sh
 daemon:x:1:1::/:
 bin:x:2:2::/usr/bin:
 sys:x:3:3::/:
 adm:x:4:4:Admin:/var/adm:
 lp:x:71:8:Line Printer Admin:/usr/spool/lp:
 uucp:x:5:5:uucp Admin:/usr/lib/uucp:
 nuucp:x:9:9:uucp Admin:/var/spool/uucppublic:/usr
/lib/uucp/uucico
 smmsp:x:25:25:SendMail Message Submission Program:/:
 listen:x:37:4:Network Admin:/usr/net/nls:
 nobody:x:60001:60001:Nobody:/:
 noaccess:x:60002:60002:No Access User:/:
 nobody4:x:65534:65534:SunOS 4.x Nobody:/:

For background jobs, ssh also supports the -n option to set standard input to /dev/null. Alternatively,-f sets standard input to /dev/null after password or passphrase requests, but before command execution. If no remote execution is required and only port forwarding requested, the -N option can be used (Protocol 2 only).

rcp Versus scp

The rcp command has the same authentication problem as the rsh command. As with ssh , the scp command will prompt for passphrases and passwords as needed. Unlike the rcp command, scp displays a progress meter as it copies the file. This behavior can be disabled with the -q option. The scp command can also optionally compress the data stream using the-C option.

The following example shows the rcp authentication problem and thescp command's progress meter.

 rcp user@host:/etc/passwd /tmp
 permission denied
 $ scp user@host:/etc/passwd /tmp
 user@host's password: password
 passwd 100% |*****************************| 1044 
    00:00



Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotesSomerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose BierceBernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOSProgramming Languages History : PL/1 : Simula 67 : C : History of GCC developmentScripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-MonthHow to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D


Copyright © 1996-2021 by Softpanorama Society. www.softpanorama.org was initially created as a service to the (now defunct) UN Sustainable Development Networking Programme (SDNP) without any remuneration. This document is an industrial compilation designed and created exclusively for educational use and is distributed under the Softpanorama Content License. Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.

FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available to advance understanding of computer science, IT technology, economic, scientific, and social issues. We believe this constitutes a 'fair use' of any such copyrighted material as provided by section 107 of the US Copyright Law according to which such material can be distributed without profit exclusively for research and educational purposes.

This is a Spartan WHYFF (We Help You For Free) site written by people for whom English is not a native language. Grammar and spelling errors should be expected. The site contain some broken links as it develops like a living tree...

You can use PayPal to to buy a cup of coffee for authors of this site

Disclaimer:

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: March, 12, 2019