SSHPASS(1)

💖 SSHPASS(1) 💖

okay bestie, welcome to the Sshpass User Manual — aka the lil tool that lets you ssh without a human typing a password. it's from the Sshpass User Manual section of your local man pages, and it's about to be your new obsession. no cap. 🦋

---

✨ NAME ✨

sshpass — noninteractive ssh password provider

---

🌸 SYNOPSIS 🌸

sshpass [-ffilename|-dnum|-ppassword|-e[env_var]] [options] command arguments

---

🎀 DESCRIPTION 🎀

so like, this manual page documents the sshpass command. that's the whole vibe. 💅

sshpass is a utility designed for running ssh using the mode referred to as "keyboard-interactive" password authentication, but in non-interactive mode. yes, that's a mouthful, but the energy is immaculate.

here's the tea: ssh uses direct TTY access to make sure that the password is indeed issued by an interactive keyboard user. so sshpass runs ssh in a dedicated tty, fooling it into thinking it is getting the password from an interactive user. it's giving method acting. it's giving main character energy. ✨

the command to run is specified after sshpass' own options. typically it will be "ssh" with arguments, but it can just as well be any other command. the password prompt used by ssh is, however, currently hardcoded into sshpass. 🙈

---

🧚 Options 🧚

if no option is given, sshpass reads the password from the standard input. the user may give at most one alternative source for the password — one (1) password source only, bestie, don't be greedy:

• -ppassword — the password is given on the command line. please note the section titled "SECURITY CONSIDERATIONS". 😭 (spoiler: this one is the messy one)
• -ffilename — the password is the first line of the file filename.
• -dnumber — number is a file descriptor inherited by sshpass from the runner. the password is read from the open file descriptor.
• -e[env_var] — the password is taken from an environment variable. if env_var is supplied, that is the environment variable used. if not, the password is taken from the variable SSHPASS.
• -P — set the password prompt. sshpass searched for this prompt in the program's output to the TTY as an indication when to send the password. by default sshpass looks for the string "assword:" (which matches both "Password:" and "password:"). if your client's prompt does not fall under either of these, you can override the default with this option.
• -v — be verbose. sshpass will output to stderr information that should help debug cases where the connection hangs, seemingly for no good reason. (the "why is it just sitting there 😭" era)

---

🔥 SECURITY CONSIDERATIONS 🔥

first and foremost, users of sshpass should realize that ssh's insistance on only getting the password interactively is not without reason. it is close to impossible to securely store the password, and users of sshpass should consider whether ssh's public key authentication provides the same end-user experience, while involving less hassle and being more secure. like… public key auth is the lowkey slay here, fr fr.

the -p option should be considered the least secure of all of sshpass's options. all system users can see the password in the command line with a simple "ps" command. sshpass makes a minimal attempt to hide the password, but such attempts are doomed to create race conditions without actually solving the problem. users of sshpass are encouraged to use one of the other password passing techniques, which are all more secure. 🫶

in particular, people writing programs that are meant to communicate the password programmatically are encouraged to use an anonymous pipe and pass the pipe's reading end to sshpass using the -d option. do that. it's the move. 💜

---

⭐ RETURN VALUES ⭐

as with any other program, sshpass returns 0 on success. in case of failure, the following return codes are used:

1. 1 — invalid command line argument
2. 2 — conflicting arguments given
3. 3 — general runtime error
4. 4 — unrecognized response from ssh (parse error)
5. 5 — invalid/incorrect password
6. 6 — host public key is unknown. sshpass exits without confirming the new key.
7. 7 — IP public key changed. sshpass exits without confirming the new key.

in addition, ssh might be complaining about a man in the middle attack. this complaint does not go to the tty. in other words, even with sshpass, the error message from ssh is printed to standard error. in such a case ssh's return code is reported back. this is typically an unimaginative (and non-informative) "255" for all error cases. 💀

---

🌈 EXAMPLES 🌈

run rsync over SSH using password authentication, passing the password on the command line:

rsync --rsh='sshpass -p 12345 ssh -l test' host.example.com:path .

to do the same from a bourne shell script in a marginally less exposed way:

SSHPASS=12345 rsync --rsh='sshpass -e ssh -l test' host.example.com:path .

see how the second one is giving "i care about security"? yeah. that one. 👑

---

🐛 BUGS 🐛

sshpass utilizes the pty(7) interface to control the TTY for ssh. this interface, at least on Linux, has a misfeature where if no slave file descriptors are open, the master pty returns EIO. this is the normal behavior, except a slave pty may be born at any point by a program opening /dev/tty. this makes it impossible to reliably wait for events without consuming 100% of the CPU. 💀 not the CPU fan going feral.

over the various versions different approaches were attempted at solving this problem. any given version of sshpass is released with the belief that it is working, but experience has shown that these things do, occasionally, break. this happened with OpenSSH version 5.6. as of this writing, it is believed that sshpass is, again, working properly. we love a comeback arc. ✨

it seems that HPUX has some non Posix compliant ideas how controlling TTY is detached. sshpass may not work properly on that platform. 🙈

---

okay that's the whole page, bestie! this iconic lil manual was written by Shachar Shemesh, dated May 27, 2022, and it belongs to the Sshpass User Manual, version SSHPASS(1). go forth and password responsibly. 💖🎀🦋🌸✨💅