7

I'm planning to automate copying a large file to a remote server over ssh using rsync, using following command :

sshpass -p '<PASS>' rsync --partial -av --progress --inplace --rsh='ssh -p 22' ${TAR_PATH} <SERVER_IP>:

This command will be run through Jenkins. The operator will enter the password in Jenkins.

I'm using sshpass here to automatically provide password to ssh. Is it insecure compared to manual ssh operation ? If I run the rsync manually without sshpass will it be more secure in any way?

7

It's less secure than doing it manually, but if you're using Jenkins, you're clearly trying to automate. That being said, pay attention to the sshpass home page when it says:

Most users should use SSH's more secure public key authentication instead.

Use of sshpass will probably leave the plaintext password in logs files and/or command history logs, which is highly undesirable. A passwordless key would be more secure than that.

2
  • Other than logs and history, the password is sent in plaintext in both cases right ?
    – amolkul
    Jan 13 '14 at 17:46
  • 2
    No, it's not sent over the network; sshpass merely passes the credentials to the ssh subprocess over stdin. Which is not really snoopable in a practical sense... which is why the logs/history are the important implications.
    – gowenfawr
    Jan 13 '14 at 18:05
2

It is lesser secure until you eliminate the risk to expose passwords to third parties.

There is an issue if the sshpass command is still being executed and other users, even with limited access privileges, can issue a ps command. The password may temporarily show up in the list as part of the process call even outside of logs and command histories bypassing the file view restrictions. These are just working for direct reading those log and history files in place.

There are multiple solutions to read the password into stdin from an external resource to avoid showing it up in the process call. It is beyond the scope of this answer to point to certain solutions.

You still need to audit if the access to the passwords stored elsewhere is safe enough for your requirements.

1

Using it with the -p option is what most people talk about but it has other, more secure options, too.

You can also use sshpass with a GPG-encrypted file. When the -f switch is used, the reference file is in plaintext. Let's see how we can encrypt a file with GPG and use it.

Source

First, create a file as follows:

$ echo '!4u2tryhack' > .sshpasswd

Next, encrypt the file using the gpg command:

$ gpg -c .sshpasswd

Remove the file which contains the plaintext:

$ rm .sshpasswd

Finally, use it as follows:

$ gpg -d -q .sshpassword.gpg > pass_file; sshpass -f pass_file ssh user@srv1.example.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.