stdin & ssh: "Pseudo-terminal will not be allocated..." error

[Haralambos]

Hi,

Is there a good way to programmatically pass my password or public key to ssh (OpenSsh 3.91)?

When I do either:

echo "mypasswd" > ssh myhost -l user

or

ssh myhost -l user << EOF
mypasswd
EOF

I get the following error:
"Pseudo-terminal will not be allocated because stdin is not a terminal"

So, the real question is how do I have scripts/applications use ssh without user intervention? Ok, I can use public key authentication with ssh-agents but in my environment do not have time for the users to enter data in the agent. I want the server to come up with no user input wharsoever.

regards,

haralambos

[Victor Fridyev]

Hi,

ssh_keygen -t dsa
scp ~.ssh/dsa_pub host:/root/.ssh/authorized_keys

The procedure for root, change it accordingly.

HTH

[Simon Hargrave]

The only way to have no interaction and not to have to use agents is to have passphraseless keys. Obviously these are less secure than keys with passphrases, however clearly they are many times more secure than rlogin! It's your call to weigh up convenience with security.

[TwoProc · Accepted solution]

If you don't want to generate a key as per the previous posting, you can use the program called "expect". It's at the HPUX porting archive. I've used it sucessfully for exactly what you're needing. http://hpux.cs.utah.edu/hppd/hpux/Tcl/expect-5.43/

[Haralambos]

Yeah!!!

I really want to keep my keys passphrase encrypted and at the same time have the convinience of no-human interaction at boot time. I mean, ssh-agents can be actually used but again the requirement is to not have the users enter the passphrase.

So, how can the "expect" scripts work in this case? Can you provide an example? When and how are they being kicked-off and how is the passphrase/passwd passed to them; is it hardcoded?

Regards,

Haralambos

[TwoProc]

It's a scripting language that has the ability to listen (to the screen I/O) and "wait-for" events, and then reply. Yes, you hard code the password in the expect script, so you have to watch the security level on the file very closely.

I don't have any working examples handy, but if you search these forums for "expect" you'll find some.

[Haralambos]

Well, I am not sure if this is solution will work in our environment but I will give it a shot anyway.

Thanks for the tips!

regards