sshpass(1)

NAME

sshpass - run ssh non-interactively by supplying its password

SYNOPSIS

/opt/omnicube/bin/sshpass [-f filename | -d number | -p password | -e] [-P prompt] [-v] command [parameters...]

sshpass [-h] [-V]

DESCRIPTION

sshpass is a third-party utility, bundled unmodified with OmniCube, that runs another program (in practice ssh(1) or scp(1)) in its own pseudo-terminal and types a password into it when the program asks for one. It exists because ssh(1) deliberately reads its password from the terminal rather than from standard input, which makes it impossible to drive from a script without a helper.

The version shipped here is sshpass 1.06, built for illumos. It is not part of the OmniCube code base and is not maintained by the OmniCube authors.

Within the suite it is used only for remote work that cannot be done with public-key authentication, typically talking to a peer or an appliance where an OmniCube key has not been (or cannot be) installed in authorized_keys. Everything that runs between cluster nodes uses key-based, non-interactive ssh instead, with the shared options set in /opt/omnicube/lib/common/utils.sh (BatchMode=yes, StrictHostKeyChecking=yes).

The password is taken from exactly one source, selected by -f, -d, -p or -e; with none of them given, it is read from standard input. Combining two sources is an error ("Conflicting password source"). sshpass then executes command with its parameters, watches the child's terminal output for the password prompt, and writes the password followed by a newline when it sees it. If the prompt appears a second time the password was wrong, and the child is terminated. If the child asks to confirm an unknown host key instead, that is reported as a host authentication prompt and sshpass exits without confirming the key.

It lives in /opt/omnicube/bin rather than in /usr/bin, so the suite carries its own copy and does not depend on the host having sshpass installed, and so an OmniCube upgrade cannot be broken by, or break, a platform package. Invoke it by absolute path (or make sure /opt/omnicube/bin precedes /usr/bin in PATH) when you need the bundled build.

OPTIONS

-f filename: Read the password from the first line of filename. The preferred file-based form; protect the file with mode 0600 and an appropriate owner.
-d number: Read the password from the already-open file descriptor number. Useful for handing a password down from a parent process without it ever touching the file system.
-p password: Take the password from the command line itself. Convenient and insecure: see SECURITY below.
-e: Take the password from the environment variable SSHPASS. If -e is given and SSHPASS is not set, sshpass reports "-e option given but SSHPASS environment variable not set" and exits.
-P prompt: Use prompt as the string searched for in the child's output when detecting a password prompt, instead of the built-in default ("assword"). Needed when the remote side prints something unusual, or when the prompt is localized.
-v: Be verbose about what it is doing: report the prompt string being matched, the moment the prompt is detected and the password sent, a repeated prompt (wrong password), and a host authentication prompt. Diagnostics go to standard error.
-h: Show the built-in usage screen and exit.
-V: Print version information and exit.

OPERANDS

command: The program to run, followed by its own parameters. Everything after the sshpass options is passed through untouched, so ssh options such as -o or -p belong here, after command, and are not consumed by sshpass.

EXAMPLES

Example 1: Password from a protected file

$ chmod 600 /var/opt/omnicube/.appliance.pw
$ /opt/omnicube/bin/sshpass -f /var/opt/omnicube/.appliance.pw \\
    ssh -o BatchMode=no admin@appliance 'show version'

Example 2: Password from the environment

$ read -s SSHPASS; export SSHPASS
$ /opt/omnicube/bin/sshpass -e scp report.txt admin@appliance:/tmp/

Example 3: A non-standard prompt

$ /opt/omnicube/bin/sshpass -f /root/.pw -P 'Enter passcode:' \\
    ssh admin@appliance 'reload'

Example 4: Password on a file descriptor

$ /opt/omnicube/bin/sshpass -d 3 ssh admin@appliance 'uptime' \\
    3< /var/opt/omnicube/.appliance.pw

EXIT STATUS

0: Success; the exit status of command is returned when sshpass itself had nothing to report.
1: Invalid command line argument.
2: Conflicting arguments given (more than one password source).
3: General runtime error.
4: Unrecognized response from ssh(1) (parse error).
5: Invalid or incorrect password: the password prompt appeared a second time.
6: The remote host's public key is unknown; sshpass exits without confirming the new key.
7: The remote host's public key has changed.

FILES

/opt/omnicube/bin/sshpass: The bundled binary (ELF, illumos), deliberately outside /usr.
/opt/omnicube/lib/common/utils.sh: Defines the key-based ssh options the rest of the suite uses instead of sshpass.

ENVIRONMENT

SSHPASS: Read as the password when -e is given. Unset it as soon as the command returns.
PATH: Must resolve command (normally /usr/bin/ssh).

SECURITY

Do not use -p. A command's arguments are visible to every user on the host through the process table (ps -eaf, pargs(1)), so -p secret publishes the password for as long as the command runs, and typically also records it in the invoking shell's history file and in any script that contains it. Prefer, in order:

1.: SSH public-key authentication with no password at all. This is what every node-to-node OmniCube workflow uses, and it removes the need for sshpass entirely.
2.: -e, with SSHPASS exported only for the single command and unset immediately afterwards. Environment variables of another process are not readable by other users on illumos.
3.: -f or -d, with a 0600 root-owned file.

Whichever source is used, remember that sshpass answers the password prompt automatically, so it also defeats the protection an interactive prompt gives against a man-in-the-middle: pair it with a pre-populated known_hosts and never with StrictHostKeyChecking=no. Exit status 6 and 7 exist precisely so a script can tell an unknown or changed host key from a bad password. Store credentials only under root-owned directories, never in a file that is group or world writable.

NOTES

sshpass is upstream software; report defects in it upstream, not to the OmniCube maintainers. Only its presence in /opt/omnicube/bin and the guidance above are OmniCube policy.

Because the child runs under a pseudo-terminal created by sshpass, the child's standard input is not a terminal from the caller's point of view. Interactive programs invoked through it behave slightly differently than when run directly, and a program that needs a controlling terminal for something other than the password prompt may misbehave.

A prompt is detected by matching a substring of the child's output; the default match is deliberately short ("assword") so it works for both "Password:" and "password:". Output from the remote command that happens to contain that substring can be mistaken for a prompt, in which case use -P with a longer, more specific string.

No OmniCube script calls sshpass today. It is shipped for operator use and for site-local scripts; the suite's own remote operations require key authentication and fail fast rather than prompt, because BatchMode=yes is set.