Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I see that you can create an SSH key to use rsync over ssh without a password prompt.

But I'm using rsync over ssh in Eclipse/ANT, where the password can be interactively entered, but then the interaction between eclipse and the rsync command isn't interactive (it's one command line exec call), so I would need to specify the password obtained in eclipse on the command line.

Is this possible?

share|improve this question
Putting passwords in command lines is inherently insecure, because all command lines are public for everyone on your computer (ps -ef). Don't do it. – ceving Jun 27 '11 at 5:45
Good point, thanks for that. But this is just an ant script running on my dev system, I consider it far more likely someone will get a key file that is permanently stored, automatically backed up across the network, and likely forgotten about, than someone picking up the password off a ps command in the 5 seconds that this script might be running for. – davidparks21 Jun 27 '11 at 6:12
Actually I'm working on using expect to handle the interactive password portion of it, I think this might be the best answer, but I've run into some road blocks along the way. – davidparks21 Jun 27 '11 at 6:19
You can protect your key file with a password and you can use ssh-agent to open the key for your programming session. – ceving Jun 27 '11 at 9:01
up vote 3 down vote accepted

After a heated battle between myself and the computer, I finally have an answer that hasn't been discussed in any article I could find. I will post a blog about it.

The solution is to use a new feature only fixed in the alpha release of ant 1.8.3, which appears to just be a bug fix over the release version of 1.8.2, so it's probably stable enough even with the alpha title. That feature allows you to pass data to the STDIN of the script, namely the password. You can then use standard linux tools or cygwin on windows to read the password off STDIN and use it as a variable.

No dependencies, no key files, no leaked password on the command line, no stored passwords. I finally see some light beyond this dark dreary existence I've suffered through the last few days.

Here is an ANT task that does just this:

<input message="Enter username for ${}:" addproperty="host.username" />
<input message="Enter password for ${}:" addproperty="host.password" />

<sshexec host="${}" trust="true"
         username="${host.username}" password="${host.password}"
         command='read var; expect -c "spawn sudo chmod u+x /usr/local/website/bin/start_website" -c "expect ${host.username}:" -c "send ${var}\r" -c "wait"' />

Note the command line:

read var; expect -c "spawn sudo chmod u+x /usr/local/website/bin/start_website" -c "expect ${host.username}:" -c "send ${var}\r" -c "wait"

First we read STDIN into variable var. We then fire up expect which performs some action requiring user interaction: sudo in this case. When sudo prompts us for the password we send it from the stored variable var and wait for the process to complete.

share|improve this answer

Since the two machines will be known to you, you can safely ignore the password from the individual user, and then:

  1. give a rsync user sudo rights to rsync so they can access everything

  2. setup private key / passwordless login using that rsync user from the remote machine, and invoking rsync with sudo via ssh

This way the password won't matter, and you'll be more secure.

share|improve this answer

You can just use ssh-agent and keychain.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .