topic Re: SFTP using expect script in Operating System - HP-UX

SFTP using expect script

Dewa Negara_4 — Thu, 09 Sep 2004 03:29:48 GMT

Hi All,

I am running SFTP using expect script below :

#!/usr/local/bin/expect
spawn sftp -b batchFile @
expect "password:"
send "\n";
interact

Is there any way how to prevent from hard-code the password in the script? Can we hidden the password? I just want to mitigate the security risk for the script.

Pls help. High score will be given.

Thanks and Best Regards,
Negara

Re: SFTP using expect script

harry d brown jr — Thu, 09 Sep 2004 06:19:01 GMT

Make the script only readable and executable by root (chmod 500 scriptname) or write a C program that creates the script on the fly and then executes it, or write the program in perl and then compile (perlcc) it. You will have to make sure you don't put the passwd in a contiguous string.

live free or die
harry

Re: SFTP using expect script

Geoff Wild — Thu, 09 Sep 2004 07:32:36 GMT

That's the downside of sftp with expect - you need to hard code it.

Now, what you can do, is setup certificates between the sites.

Rgds...Geoff

Re: SFTP using expect script

Dewa Negara_4 — Thu, 09 Sep 2004 21:51:37 GMT

Hi Geoff / Harry,

Thanks.

Will the crtificate be able to avoid hard-coded passord?

What is the steps do configure the certificate? Sorry because this is really new for me.

Thanks.
Negara

Re: SFTP using expect script

Sridhar Bhaskarla — Thu, 09 Sep 2004 22:07:03 GMT

Hi Negara,

I believe Geoff meant public/private key authentication. All your problems will be simply vanished if you follow that procedures. Check one of your old threads and you will find the procedures posted by myself and others.

Also, look at the other thread where you mentioned about sftp working with .shosts/.rhosts. I asked you to override PreferredAuthentications options using the command line. I believe you are almost there.

-Sri

Re: SFTP using expect script

Dewa Negara_4 — Thu, 09 Sep 2004 22:57:13 GMT

Hi Sridhar,

Thanks. I got a new problem now. The remote server belongs to other company. So we not eligible to suggest them to modify their sshd_config. I have talked to my boss and he agreed to use expect script. But it will be better if the hard-coded password can be prevented. So I am trying to find how can we avoid the hard-coded password in the script.

Thanks for your help Sridhar.

Best Regards,
Negara

Re: SFTP using expect script

Sridhar Bhaskarla — Thu, 09 Sep 2004 23:34:32 GMT

Hi Negara,

You don't really have much choice other than what Harry already gave you if you are planning to use expect.

If you have to run it some user, then make sure the permissions are set to only 500 for the script so that others can't read the script.

If you have to share the password, then create a user say user and a group 'secgrp' with all the users that need to run the script in it. Then put it in a secured directory owned by 'secuser' but to be only read by 'secgrp'. In side that directory change the permissions to '4510' with 'secuser:secgrp' as the ownership. This way only secuser will be able to view the file. Members in secgrp will only be able to execute it as secuser but not read it.

-Sri

Re: SFTP using expect script

Dewa Negara_4 — Fri, 10 Sep 2004 02:04:58 GMT

Hi Sridhar,

Thanks alot.

Then I need to think alternatively using perl or C as suggested by Harry. At least I can make it more secure by compiling the script.

Thanks.
Negara

Re: SFTP using expect script

Michael Selvesteen_2 — Fri, 10 Sep 2004 04:28:26 GMT

You can encrypt your whole expect script with ccrypt utility. This is an enhanced version of standard unix crypt utility. It can encrypt and decrypt a file.

For more details on ccrypt

http://sourceforge.net/projects/ccrypt/

A pre compiled version for hp-ux is available
from following location

http://quasar.mathstat.uottawa.ca/~selinger/ccrypt/

After downloading, Just gunzip and untar the package. After setting proper permission (if required), encrypt your expect file.

for example

# ./ccrypt -e
Enter encryption key: < set your passphrase>
Enter encryption key: (repeat)

The encrypted file will be stored as "File_to_encrypt.cpt"

To decrypt

./ccrypt -d

The file will be retained to original format after you enter the passphrase.

For more ccrypt advanced options refer README

So, whenever you need to use sftp just decrypt your expect file on other time keep it as encrypted.

Hope this helps

Re: SFTP using expect script

Dewa Negara_4 — Wed, 15 Sep 2004 23:15:39 GMT

Hi Michael,

Thanks alot.

I have installed the software and it looks fine for me.

One more problem how can we make encryption/decryption of the script using batch file? Any idea?

Thanks and Best Regards,
Negara