Expect, su, ssh and sudo

in my relentless quest to automate remote execution of scripts, at last a working example:

this is to execute the following commands run from host1:
ssh pvernet@host2
(enter automatically the pvernet password on host2)
sudo su - soa
(enter automatically the pvernet password on host2)
touch /home/soa/pippo.txt 2> /tmp/errors.txt
exit
exit


(at the end you should return to host1, that's why I have 2 exit)

this is the file tryagain.expect:

#!/usr/bin/expect
log_user 1
set timeout 5
set user "pvernet"
set host "host2"
set pass "mypassword"
spawn ssh -q ${user}@${host}
expect "assword"
send "$pass\r\n"
expect "${user}@"
send "sudo su - soa\r\n"
expect "assword"
send "$pass\r\n"
expect "soa@"
send "touch /home/soa/pippo.txt 2> /tmp/errors.txt\r\n"
expect "host2"
send "exit\r\n"
expect "host2"
send "exit\r\n"
interact

run this with:
expect -f tryagain.expect


PRICELESS TIP: add "exp_internal 1" to debug the Expect dialog with the controlled process.

passwordless ssh, scp , expect and ssh-agent

I have a soa user on host1, and a pvernet user on host2. pvernet@host2 can sudo su - soa, and carry out soa operations on host2.

My problem is to automate all operations on host2 with scripts running on host1.

ssh requires a password to be manually entered each time (no way to pass it as parameter, don't ask me why, I find it EXTREMELY annoying... probably for security reasons, but hey give me the option and let me decide).

An alternative is using http://en.wikipedia.org/wiki/Expect :

Create a file "remotels.expect" :
spawn ssh pvernet@host2 ls /opt/oracle
expect "password:"
send "mypassword\r"
set results $expect_out(buffer)
expect eof


then run it with "expect -f remotels.expect".

When you try to embed in the .expect file a "sudo su - soa" followed by a "expect password:", then a command "touch bla.txt", the command "touch bla.txt" is still executed as "pvernet" and not as soa. No clue why. Maybe I am "expecting" a bit too much from Expect.

The alternatives are:

•  passwordless ssh with a passwordless rsa key (pvernet on host1 -> soa on host2) https://blogs.oracle.com/jkini/entry/how_to_scp_scp_and , it's very easy to setup (remember to chmod 644 authentication_keys !!!) and works like a charm.... but anybody gaining access to "pvernet" on host1 would then be able to run any command as "soa" on host2, which is a major security breach.

• setting up a password protected rsa key + Expect (pvernet on host1 -> soa on host2): when you run the "ssh" command you would me prompted NOT with the soa password, but with the rsa key password...let Expect provide that rsa password, and then you need not to "sudo" since you act on host2 as "soa". I still need to test this. This is the same as the .ssh/identity approach described here http://www.slac.stanford.edu/BFROOT/www/Computing/Offline/DataDist/ssh-idfile.html

• using ssh-agent to provide the "pvernet@host2" password for you, then use Expect to "sudo su - soa" remotely... this also can be tricky, still need to test.

Of course I have no option to set sudo to NOPASSWORD in the sudoers file.