6

I'm planning to automate copying a large file to a remote server over ssh using rsync, using following command :

sshpass -p '<PASS>' rsync --partial -av --progress --inplace --rsh='ssh -p 22' ${TAR_PATH} <SERVER_IP>:

This command will be run through Jenkins. The operator will enter the password in Jenkins.

I'm using sshpass here to automatically provide password to ssh. Is it insecure compared to manual ssh operation ? If I run the rsync manually without sshpass will it be more secure in any way?

6

It's less secure than doing it manually, but if you're using Jenkins, you're clearly trying to automate. That being said, pay attention to the sshpass home page when it says:

Most users should use SSH's more secure public key authentication instead.

Use of sshpass will probably leave the plaintext password in logs files and/or command history logs, which is highly undesirable. A passwordless key would be more secure than that.

  • Other than logs and history, the password is sent in plaintext in both cases right ? – amolkul Jan 13 '14 at 17:46
  • No, it's not sent over the network; sshpass merely passes the credentials to the ssh subprocess over stdin. Which is not really snoopable in a practical sense... which is why the logs/history are the important implications. – gowenfawr Jan 13 '14 at 18:05
2

It is lesser secure until you eliminate the risk to expose passwords to third parties.

There is an issue if the sshpass command is still being executed and other users, even with limited access privileges, can issue a ps command. The password may temporarily show up in the list as part of the process call even outside of logs and command histories bypassing the file view restrictions. These are just working for direct reading those log and history files in place.

There are multiple solutions to read the password into stdin from an external resource to avoid showing it up in the process call. It is beyond the scope of this answer to point to certain solutions.

You still need to audit if the access to the passwords stored elsewhere is safe enough for your requirements.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.