The author claims that sshpass is "broken by design" and goes on to show some ex...

vbernat · on Dec 25, 2023

Author here. I don't claim sshpass is "broken by design". I claim it is brittle as it relies on the detection of a password prompt. passh author has several examples here: https://github.com/clarkwang/passh/blob/master/sshpass-broke....

rovr138 · on Dec 25, 2023

https://github.com/clarkwang/passh/

On the sidebar, in the about, it says,

> sshpass is broken by design

This is another repo. But probably where they got it.

dark-star · on Dec 28, 2023

yeah, sorry, I was under the impression that the autor was also the author of that repo.

dark-star · on Dec 28, 2023

Sorry, I was under the impression that you were also the author of passh. I take that statemen back, obviously (can't edit my post anymore)

bityard · on Dec 25, 2023

You may wish to edit your comment to clarify that the author of https://github.com/clarkwang/passh claims sshpass is broken by design, not the author of the linked article.

MikePlacid · on Dec 25, 2023

You are probably asking about the passh page. Examples there show that sshpass creates a new permanent tty entry with each use, while passh does not.

More importantly though is that sshpass keeps your password permanently on your computer, thus increasing security risks considerably.

dark-star · on Dec 28, 2023

Yeah, but that's my question, why is all that stuff about TTYs bad? The examples basically say:

bad:

   bash-4.4# tty
   /dev/pts/18     // the bash's stdin is also connected to pts/18

good:

   bash-4.4# tty
   /dev/pts/18     // the bash's stdin is connected to the new pts/36

...and stuff about controlling terminals and missing job control, but why are these things bad?

And yes, if I use either sshpass or passh, the password will have to be "on my computer" (i.e. in a script or text file), that's the whole point of it: accessing devices that don't do public-key authentication non-interactively

erinnh · on Dec 25, 2023

I’ve always been told that ssh is not supposed to work non-interactively. Which is the whole reason for sshpass, to work non-interactively. Ie. Broken by design.

nine_k · on Dec 25, 2023

What, how about scp and sshfs?

I can argue that SSH password auth only makes sense.as in interactive affair; for non-interactive auth cases, there are public keys, certificates, smart cards, etc.

dark-star · on Dec 28, 2023

I totally agree, but sometimes you have no other choice (e.g. devices that only offer password auth), and in that case it is claimed that sspass is bad ("broken by design" according to the passh author) and passh is good. And that's what I'm confused about