Mac OS X Lion and sshpass

Question

I've upgraded from Mac OS X Snow Leopard to Lion. I used several scripts with sshpass but after I upgraded to Lion the following error appears:

Permission denied, please try again.
debug1: read_passphrase: can't open /dev/tty: Device not configured
debug1: permanently_drop_suid: 502
ssh_askpass: exec(/usr/libexec/ssh-askpass): No such file or directory

I can only connect with sshpass (or type the password manually). No public/private key way. I've reinstalled MacPorts and sshpass.

How can I get ssh-askpass? How can I configure /dev/tty ?

Greets!

Answer 1

You should first file a complaint with the server's administration, observing that public key authentication is vastly more secure than simply a password, but I'll assume you've already done so, and your admins are simply idiots.

Apple sadly removed ssh-askpass when they integrated its functionality into ssh, scp, and ssh-add. There is however an SSHKeychain package that provides an ssh-askpass with an Apple-like Cocoa password prompt for macports' openssh package. It should fix your problems the way you want, perhaps even setting the SSH_ASKPASS variable for you.

Just fyi, I'd usually recommend against installing the openssh macports package itself because it break your Apple password prompt, but once you've installed SSHKeychain macports usually offers a more recent openssh than Apple.

There is nothing wrong imho with embedding passwords in scripts when the server disables public key authentication, i.e. if they cared about security, they should reenable public keys. There are even servers that intentionally break sshpass. You could access such machines using the following expect script :

#!/usr/bin/expect -f
set timeout -1
set send_human {.05 0.1 1 .07 1.5}
eval spawn $argv
match_max 100000
expect {
   -re "USERNAME@(\[0-9A-Za-z_\\-\\.\]+)'s password: "
     { sleep 0.1 ; send -- "PASSWORD\r" ; sleep 0.3 }
}
interact

You may speed up this script by reducing the sleeps and send_human delays.

Answer 2

I also ran into a similar problem after upgrading to Mac OS X Lion. I use Unison to synch a directory on my MacBook Pro with my Linux server, but after the upgrade I could not connect anymore. The problem is that /usr/libexec/ssh-askpass is absent in Lion. To correct this you may go to http://westergaard.eu/2011/07/printing-on-wi-from-mac-os-x-lion/?utm_source=rss&utm_medium=rss&utm_campaign=printing-on-wi-from-mac-os-x-lion. There you may download the file Printer-hack.zip. It contains the file ssh-askpass that you can then move to /usr/libexec/.

Answer 3

The proper way to fix this is to remove all the sshpass stuff you installed and to just rely on what Apple already set up for you.

By default, ssh-agent is already running (actually poised to run once you use it, via launchd). You can verify this from the terminal with env|grep SSH which should come back with something like SSH_AUTH_SOCK=/tmp/launch-7D4wfP/Listeners. If it doesn't look like that, then you're still overriding the default in one of your shell startup scripts.

Then, store your SSH key passphrase in your keychain with ssh-add -K. Once that's done, it will automatically load your key into your ssh-agent when needed.

EDIT: Oops I missed the "no pubkey auth" bit and what ssh-pass does. Ok, try setting the environment variable SSH_ASKPASS to a script that prints your password. That will make ssh execute that script instead of ssh_askpass.

What could be going on is that Lion may be stricter about the TTY and it won't accept the environment that ssh-pass provides as a real TTY. If that is the case then ssh-pass will need to be fixed. Perhaps compiling your own ssh may work too.

Answer 4

OK, I faced this same issue with AIX as well. The scenario was erratic, sometimes the command would execute and sometimes it would throw the /dev/tty error.

I worked around it by doing the below: I export SSH_ASKPASS to a shell script that would echo the password. and then run ./sshpass -p $password $user@$node hostname. On doing this, the cases that ssh complains about /dev/tty it spawns $SSH_ASKPASS and gets the password.

Hope this is useful. I am tempted to think this being more a sshpass bug, but of course haven't debugged more.

Cheers Suriyan