How Can I Automate SSH Login?

SSH single sign-on is usually achieved with public key authentication and an authentication agent. You could easily add your test VM key to an existing auth agent (see example below). Other methods such as gssapi/kerberos exist but are more complex.

sshpass

In situations where password is the only authentication method available, sshpass can be used to automatically enter the password. In all three options, the password is visible or stored in plaintext at some point:

Anonymous pipe (recommended by sshpass)

# Create a pipe
PIPE=$(mktemp -u)
mkfifo -m 600 $PIPE
# Attach it to file descriptior 3
exec 3<>$PIPE
# Delete the directory entry
rm $PIPE
# Write your password in the pipe
 echo 'my_secret_password' >&3
# Connect with sshpass -d
sshpass -d3 ssh user@host

# Close the pipe when done
exec 3>&-

It is quite cumbersome in bash, arguably easier with programming languages. Another process could attach to your pipe/fd before the password is written. The window of opportunity is quite short and limited to your processes or root.

Environment variable

# Set your password in an environment variable
 export SSHPASS='my_secret_password'
# Connect with sshpass -e
sshpass -e ssh user@host

You and root can read your process' environment variables (i.e. your password) while sshpass is running (cat /proc/<pid>/environ | tr '\0' '\n' | grep ^SSHPASS=). The window of opportunity is much longer but still limited to your own processes or root, not other users.

Command-line argument (least secure)

 sshpass -p my_secret_password ssh user@host

This is convenient but less secure as described in the man page. Command line arguments are visible to all users (e.g. ps -ef | grep sshpass). sshpass attempts to hide the argument, but there is still a window during which all users can see your password passed by argument.

Side note

Set your bash HISTCONTROL variable to ignorespace or ignoreboth and prefix your sensitive commands with a space. They won't be saved in history.


SSH public key authentication

# Generate a key pair
# Do NOT leave the passphrase empty
ssh-keygen
# Copy it to the remote host (added to .ssh/authorized_keys)
ssh-copy-id user@host

The passphrase is very important. Anyone somehow obtaining the private key file won't be able to use it without the passphrase.

Setup the SSH authentication agent

# Start the agent
eval `ssh-agent`
# Add the identity (private key) to the agent
ssh-add /path/to/private-key
# Enter key passphrase (one time only, while the agent is running)

Connect as usual

ssh user@host

The advantage is that your private key is encrypted and you only need to enter its passphrase once (via a safer input method too).

But, really, how far do you have to go? This is where risk management comes into play. Simplistically, this is the method of balancing expected risk against loss. Sysadmins do this when we decide which off-site location we want to put backups; bank safety deposit box vs an out-of-region datacenter. Figuring out how much of this list needs following is an exercise in risk-management.

In this case the assessment will start with a few things:

  • The expected skill level of the departed
  • The access of the departed
  • The expectation that evil was done
  • The potential damage of any evil
  • Regulatory requirements for reporting perpetrated evil vs preemptively found evil. Generally you have to report the former, but not the later.

The decision of how far down the above rabbit-hole to dive will depend on the answers to these questions. For routine admin departures where expectation of evil is very slight, the full circus is not required; changing admin-level passwords and re-keying any external-facing SSH hosts is probably sufficient. Again, corporate risk-management security posture determines this.

For admins who were terminated for cause, or evil cropped up after their otherwise normal departure, the circus becomes more needed. The worst-case scenario is a paranoid BOFH-type who has been notified that their position will be made redundant in 2 weeks, as that gives them plenty of time to get ready; in circumstances like these Kyle's idea of a generous severance package can mitigate all kind of problems. Even paranoids can forgive a lot of sins after a check containing 4 months pay arrives. That check will probably cost less than the cost of the security consultants needed to ferret out their evil.

But ultimately, it comes down to the cost of determining if evil was done versus the potential cost of any evil actually being done.

If you have any comments, feel free to post them below or find us on Twitter and Facebook!

Until next time!

January 24 2020

Add or review comments

Please leave your comment

Existing comments

Comments 69


Lbgsesse
pfizer viagra online <a href="http://genqpviag.com/#">discount viagra</a> viagra in ukВ  [url=http://genqpviag.com/]buying real viagra online[/url] ’
Jdbxsesse
viagra online free shipping australia <a href="http://llviabest.com/#">buy viagra with dapoxetine</a> how much do viagra cost [url=http://llviabest.com/]canada pfizer viagra[/url] ’
FvfcExole
northwest pharmacy/com <a href="http://hopeviagrin.com/ ">approved canadian online pharmacies</a> yahoo answers viagra
JbnbUript
canadianpharmacyusa24h <a href="http://online21rxon.com/ ">Super ED Trial Pack</a> buy prescription drugs from canada
Jbbvsesse
online medicine shopping <a href="http://canadianpharmnorx.com/ ">discount prescription drug</a> drugs from canada online
Ahkdsesse
canadian pharmacy online viagra <a href="http://storerxpharmcanada.com/ ">mexican online pharmacies</a> discount drugs online pharmacy
NncsExole
viagra gold 800 mg <a href="http://lightvigra.com/ ">discount harmones and viagra</a> viagra usa
Lbsxsesse
medical pharmacy <a href="https://ssviagriia.com/ ">viagra side effects</a> trust pharmacy canada
AqcfHemyinend
36 hour cialis <a href="http://cialisvja.com/ ">cialis nz online</a> brand cialis online
Kuikinend
viagra no prescriptin <a href="http://viagerkr.com/ ">viagra online ireland</a> can you get viagra sent to australia
Kbcxhifs
canada discount drug <a href="http://xuypharmacyonline.com/">approved canadian pharmacies online</a> canadian pharmacies-247
Fqhhsesse
trusted overseas pharmacies <a href="http://happyrxpharmacy21.com/ ">Cialis Oral Jelly (Orange)</a> discount canadian drugs
FbsgExole
cialis online mastecard <a href="http://llecialisjaw.com/ ">cialis none prescription</a> original cialis online
JbnvUript
payday loans poole dorset <a href="http://samcash21.com/ ">cash loan laurel ms</a> direct payday loan companies not brokers
Jbbnsesse
cialis enlarged prostate dosage <a href="http://ljcialishe.com/ ">prescrizione medica per il cialis</a> cialis for woman
Ahbzsesse
mobile money car loans <a href="http://daymoneygo.com/ ">instant cash loans of sc inc</a> half price payday loans
Kvaxhifs
start a payday loan company <a href="http://rirocash.com/ ">payday loan seattle washington</a> payday loans which is best
Kbbfinend
i do like to buy viagra from usa <a href="https://kloviagrli.com/ ">viagra 160 mg </a> trial .com and viagra
Fqbbsesse
payday loan collection scams 2012 <a href="http://ascashapply.com/ ">topcashback loans</a> cash loans safe
FjjuExole
goodrx viagra <a href="https://viagraonlinejc.com/ ">http://viagraonlinejc.com/ </a> viagra dosage
NbmoExole
viagra and cialis <a href="https://buycialisxz.com/ ">http://buycialisxz.com/ </a> cialis vs levitra vs viagra which one is better
Abgcsesse
[url=https://thesiswritingtob.com/]doctoral thesis database[/url] writing a thesis outline <a href="http://thesiswritingtob.com/ ">help with thesis statements</a> college thesis
Jvqqsesse
[url=https://dissertationahelp.com/]dissertations online[/url] dissertation format <a href="http://dissertationahelp.com/ ">proquest dissertation database</a> dissertation abstracts online
Abgcsesse
[url=https://thesiswritingtob.com/]thesiswritingtob.com[/url] thesis phd <a href="http://thesiswritingtob.com/ ">thesiswritingtob.com</a> thesis support
GvdbUript
tadalafil solubility [url=http://boxtadafil.com/ ]tadalafil 30 mg[/url] tadalafil xtenda
Fbsfsesse
Ventolin inhalator [url=http://uspharmus.com/ ]the canadian pharmacy[/url] Inderal
Abdgsesse
no prescription pharmacy https://canadianeve21.com/ pharmacy technician classes online free
RfvbExole
cialis daily use side effects http://cileve.com/ is generic cialis safe
LhdvExole
buy cialis by paypal [url=http://asciled.com/ ]cialis with diapoxetine[/url] cialis vs viagra reviews
Jbsdsesse
Zestoretic http://onlinecanda21.com/ canada prescription drugs
Bbdfhifs
viagra price http://gensitecil.com/ foods that enhance viagra
Lrbssesse
levitra 60 mg [url=https://uslevitraanna.com/ ]how long does levitra work[/url] levitra duration
RfvbExole
cheap cialis http://cileve.com/ do i need prescription for cialis in usa
Fbsfsesse
Isoptin SR https://uspharmus.com/ Viagra with Dapoxetine
Abdgsesse
indian pharmacy https://canadianeve21.com/ Sinequan
LhdvExole
online cialis https://asciled.com/ cialis on line new zealand
GtnbUript
viagra for men free samples http://jokviagra.com/ when did viagra come out
Fmrfsesse
mail order cialis http://cialisee.com/ cialis pro
Anoosesse
viagra bestellen per rechnung http://llviagra.com/ viagra online legal kaufen
LbsoExole
generic cialis with dapoxetine http://ucialisdas.com/ cheap cialis super active
Bbshhifs
cialis viagra [url=http://loxviagra.com/ ]generic viagra from canada[/url] viagra side effects
Lebnsesse
good pill pharmacy https://xlnpharmacy.com/ Cialis Soft Tabs
GtnbUript
substitute for viagra [url=https://jokviagra.com/ ]viagra vs cialis reddit[/url] best herbal viagra
Anoosesse
buy viagra manchester uk http://llviagra.com/ viagra etki mekanizmasД±
RebfExole
cialis online [url=https://rcialisgl.com/ ]viagra • cialis •[/url] best price for cialis 20mg
LbsoExole
but cialis overnight delivery http://ucialisdas.com/ order cialis with dapoxtine
Bbshhifs
natural viagra foods [url=https://loxviagra.com/ ]liquid viagra[/url] liquid viagra
Jebgsesse
Nizoral http://pharmacylo.com/ discount pharmaceuticals
Lebnsesse
pharmacy online australia free shipping https://xlnpharmacy.com/ canadian pharmacies online
Fmrfsesse
buy genereiccialis http://cialisee.com/ cheap cialis for sale
Anoosesse
what happens take viagra https://llviagra.com/ viagra packaging pfizer
RebfExole
soft gel cialis [url=https://rcialisgl.com/ ]cialis generika china[/url] where to buy cialis soft tabs
LbsoExole
generic cialis online pharmacy https://ucialisdas.com/ online buy cialis
Jebgsesse
canadian pharmacies https://pharmacylo.com/ list of online pharmacies
Fmrfsesse
cialis legal purchase http://cialisee.com/ cialis l\'espresso
Anoosesse
generic cialis viagra levitra online https://llviagra.com/ ver preço do viagra
RebfExole
cialis online mastecard http://rcialisgl.com/ brand cialis 20 mg
UriptAsd
cialis tablets in australia [url=https://cialisjla.com/ ]cialis generic[/url] order cialis with dapoxtine
sesseHtf
buy generic cialis online canada [url=https://cialishav.com/ ]cialis online in canada[/url] can you overdose on cialis
sesseAni
buying prescription drugs online [url=https://pharmacyken.com/ ]humana pharmacy store[/url] cvs pharmacy in store clinic
Danielnough
<a href="https://master-climat.com.ua">https://master-climat.com.ua</a>
ExoleVed
online pharmacy for cialis [url=https://krocialis.com/ ]liquid cialis side effects[/url] what is cialis good for
Exoleloh
cialis online shopping [url=https://rcialisgl.com/ ]pictures of penis on cialis[/url] cialis side effects
UriptAsd
cialis 10 mg [url=https://cialisjla.com/ ]cialis and dapoxetime tabs in usa[/url] cialis for sale canada
sesseHtf
cheap cialis 20mg [url=https://cialishav.com/ ]canadian cialis 20mg[/url] buy generic cialis 5mg
sesseAni
canadian pharmacy store [url=https://pharmacyken.com/ ]most reliable canadian online pharmacies[/url] online pharmacy canada reviews
sesseHtf
cialis 2.5 mg [url=https://cialishav.com/ ]cialis hard on[/url] cialis 10mg ireland
sesseAni
pharmacy rx one canada [url=https://pharmacyken.com/ ]the medicine store pharmacy[/url] best drugstore eyeliner
Wesleywopab
Hi, here on the forum guys advised a cool Dating site, be sure to register - you will not REGRET it [url=https://bit.ly/3xojcvB]https://bit.ly/3xojcvB[/url]