Scripting SSH Login with Passwords

Secure Shell (SSH) enables encrypted remote shell access, tunneling, and file transfers between servers and clients.SSH utilizes RSA or DSA public-key cryptography for initial server authentication and then establishes symmetric encryption keys for secure data transmission. Authentication relies on user passwords or public/private key pairs to verify identities.

The Case for Automating SSH Logins

Manually authenticating SSH connections with passwords poses a few challenges:

• Tedious to type passwords repeatedly for ongoing access requirements
• Exposure risk if passing plaintext passwords as arguments
• Difficult to embed in automated workflow tools like scripting or CI/CD pipelines

Sysadmins may need persistent access to manage servers – repeating multi-factor authentication manually creates productivity bottlenecks.

Automating SSH authentication improves both security and efficiency. Next we‘ll explore tools like Expect and sshpass that streamline SSH logins by programmatically handling password authentication.

Leveraging Expect for Automated SSH Sessions

Expect is an extension scripting language that facilitates automating interative applications according to scripted responses. It is well suited for tasks like automated SSH password logins.

The following example demonstrates an Expect script that enables securely passing credentials to SSH non-interactively:

#!/usr/bin/expect -f 

set timeout 10  
spawn ssh user@example.com
expect "password:"  
send "pa55word\r" 
interact

This script spawns an SSH process, expects the password prompt, programmatically passes the password, then opens an interactive shell.

Customizing and Troubleshooting Expect Scripts

Expect uses regular expressions for input matching – the following patterns can be used match SSH password prompts:

• password:
• Password:
• ssh password:

Tuning these regex helps ensure prompts are correctly recognized before sending password responses.

Setting the timeout is also crucial – this controls how long Expect waits for the expected output. Values between 10-30 seconds are reasonable depending on network reliability.

You can also pass SSH arguments and environment variables to customize connection behavior:

spawn ssh -o StrictHostKeyChecking=no user@example.com
set env(TERM) vt100  

For troubleshooting, enable Expect debug mode to trace spawned process interactions:

exp_internal 1

Overall, Expect enables practically any SSH automation scenario by scripting interactivity. Next we‘ll look at even simpler purpose-built tools.

Leveraging Sshpass for Simple SSH Automation

Sshpass specializes in non-interactively authenticating with SSH using passwords. The syntax is straightforward:

sshpass -p "<password>" ssh <user>@<host>

This handles passing the password automatically so the SSH session opens without manual input.

To install sshpass from source:

wget http://somehost/sshpass-1.06.tar.gz
tar -xzf sshpass-1.06.tar.gz 
cd sshpass-1.06
./configure && make && make install

Now let‘s connect to a remote system using sshpass:

sshpass -p "secret12" ssh sysadmin@172.31.100.10

The session is established automatically using the supplied password.

Sshpass transmits passwords to SSH using stdin which avoids exposing secrets as command line arguments. While sshpass solves basic password auth, Expect provides more flexibility for custom automation requirements.

Hardening SSH Access with Public Key Authentication

While automating SSH password authentication has major efficiency advantages over manual entry – it still relies on perishable credentials.

Public key authentication provides a more secure SSH enhancement through asymmetric cryptography. Clients generate a key pair and install the public key on remote hosts to enable passwordless logins:

ssh-keygen -t rsa -b 4096
ssh-copy-id user@host
ssh user@host

Now that the public key is authorized, clients simply launch SSH to establish an encrypted session without password prompts.

SSH public keys utilize RSA and Ed25519 algorithms to enable authentication without exchanging secrets over the wire. Private keys remain securely stored only on client devices.

Keys should be protected by strong passphrases to add another authentication factor. SSH also supports enforcing public key signatures and revocation if a key becomes compromised. Overall, integrating SSH key pairs hardens server access control by replacing password mechanisms.

Comparing Approaches for Automated SSH Logins

Let‘s examine a quick comparison between the popular solutions discussed:

Approach	Pros	Cons
Expect	Advanced scripting capabilities Supports diverse protocols Highly customizable	Dependency on 3rd party script Steeper learning curve
SSHPass	Simple invocation for SSH only Contained executable binary	Limited flexibility beyond basic password feature
Public Keys	Inherently more secure No reliance on passwords	Requires key distribution and infrastructure

Organizations typically adopt a layered model combining these techniques:

• Leverage public keys for seamless end user access
• Utilize Expect for internal tooling and automation
• Support sshpass for quick scripts and temporary access

Best Practices for SSH Automation Security

While scripting SSH authentication enables better productivity and reliability, it also warrants some key security considerations:

Crypto Policies

Enforce FIPS 140-2 compliant algorithms and sufficient key lengths according to policies. Disable outdated schemes like SHA-1 hashes or 1024 bit moduli.

Key Management

Establish procedures for securing and rotating SSH keys according to NIST standards. Use dedicated secrets management systems and leverage public key infrastructure where possible.

Access Controls

Require secondary factors like VPN, geolocation filters, strict host allowlists in addition to SSH automated auth. Institute tainted password policies and disable root login.

Monitoring

Activate enhanced auditing around SSH activity with security tools like OSSEC or Splunk. Restrict SSH access to security groups and use dynamic jump hosts to isolate connections.

Incident Response

Verify capacity to detect and respond compromise of SSH credentials or hosts maliciously misusing established sessions/tunnels.

Adhering security best practices ensures organizations safely reap the automation benefits of scripted SSH logins.

Wrapping Up

Scripting utilities like Expect and sshpass offer simple yet powerful ways to remove repetitive authentication tasks for SSH server access. Tokenized credentials passed non-interactively close potential attack vectors compared to manual entry.

For even stronger protections, distributed SSH public keys enforce integral authentication without exchanging secrets whatsoever. Automating constant user prompts improves both security and productivity for managing today‘s remote compute environments.

By layering these different techniques properly, sysadmins can focus more on critical infrastructure – and less on being a human password manager!