4 ms·
My go-to example for `expect` is password-based SSH. Since we're all enlightened beings these days who surely never use this anymore, there's no risk to it:
by hiAndrewQuinn 2y ago
My go-to example for `expect` is password-based SSH. Since we're all enlightened beings these days who surely never use this anymore, there's no risk to it:
#!/bin/bash
expect -c "
spawn ssh user@10.0.0.1
expect \"password:\"
send \"12345\r\"
interact
"
`interact` hands you back control to do whatever you want, but you don't actually need to do that. You can have `expect` run every command, fill out every field.
The tool you need when you're in environments you don't deserve.
- quesera 2y agoFor this particular use case, I'd suggest sshpass instead. https://linux.die.net/man/1/sshpass ... Operations folks today might not understand -- everything just works nowadays, which is slightly boring. And boring is good! But there's something unique about the feeling of making things work even though they are not designed to work, and really have no right to work. Expect has been a lifesaver for some of the most critical systems at some of the biggest companies in the world. No aspersions cast by me!
- hiAndrewQuinn 2y agoDefinitely, `sshpass` is the more better keyhole tool for this job. I picked it as the most common example I can imagine everyone going "ugh, I have to do this by hand again?" at.
- oxygen_crisis 2y agosshpass is a travesty of security. It has all the pitfalls of putting your front door key under your doormat. Except you're doing it in a world where everyone can materialize a unique key out of thin air, and you can always instantly tell your door which of those keys should or shouldn't be allowed to open it. sshpass is a curse, even calling it a crutch would be improper flattery. It's a dangerous cheat that accomplishes nothing except impeding people from otherwise spending the 20 minutes it takes to figure out SSH keys.
- yusyusyus 2y agosometimes the device you're connecting to doesnt support ssh keys.
- deleted 2y ago[deleted]
- quesera 2y agoYes this is the proper dogma, but you're missing the point. Any automation around passwords is a crutch and a mistake. But sometimes it is necessary. You don't always control the remote systems. The remote systems are not always capable of key-based auth. And sometimes the remote system is not of high concern so the "danger" is null. sshpass makes a reasonable effort to do the best-possible thing under these less-than-ideal circumstances. The other options suck more. My most recent use of sshpass is to collect reports from a vendor over sftp. I would have preferred to use https with BASIC auth, but in truth that has exactly the same problems as sshpass, and I have other hills to die on.
- Borborygymus 2y agoYou forgot all the other prompts that ssh might produce before the password prompt (e.g. add new host to known hosts yes/no). There are more possible prompts than most people realize.
- hiAndrewQuinn 2y agoDarn. If only there were a tool that can interactively answer prompts...
- penguin_booze 2y agoThis isn't a script that we'd send on an unmanned, inter-planetary, mission. This could be something that can save the tedium of typing password on a daily basis. If it fails, well, we still have a reason to be alive: press ^C.
- lo0dot0 2y agoYou can skip the new host prompt with ssh -o options.
- actinium226 2y agoFor the case of entering passwords, you can just use ssh authentication instead
- ndsipa_pomu 2y agoThere's certain devices (e.g. firewalls) that don't allow you to save your public key for SSH authentication, so you're stuck with passwords. I've used "expect" for automating backups to a TFTP server.
- tpoacher 2y agoout of curiosity, why do you call the expect script in string form from a bash shebang, rather than make the script itself an expect script directly with an explicit expect shebang?
- hiAndrewQuinn 2y agoI have no technical reason, I just wanted to wrap it into a familiar context for people. People are I find less scared of "useful CLI tool I can script around" than "scripting language in its own right".