Expect OpenSSH sudo login is failing

archeman2 has asked for the wisdom of the Perl Monks concerning the following question:

I am kind of new to both OpenSSH and Expect, but it appears that most advise to use these libraries for remote sudo command execution.

My script takes 5 arguments:

remoteHostname
nonRootUsername
nonRootPassword
pathToLocalOuput
RootPassword

The script is supposed to connect as nonRootUser and then use 'sudo' to execute a sequence of commands. The connection and login appears to work as expected, however the sudo login fails and the only thing that appears in the output file is the RootPassword. The root password contains spaces and those spaces do appear to be getting escaped correctly according to the output file

Here is the perl script:

#!/usr/bin/perl -w
use strict;
use Net::OpenSSH;
use Expect;
$Expect::Exp_Internal = 1;

 
my $hostname = shift;
my $username = shift;
my $password = shift; 
my $path = shift;
my $rootpassword = shift;


# Lets Connect First
my $ssh = Net::OpenSSH->new(host => $hostname, user => $username, pass
+word => $password);
$ssh->error and die "Unable to connect to remote host: $hostname as $u
+sername " . $ssh->error;
print "Username: $username Password: $password\n";
# Figure Out What Command To Run

my ( $pty, $pid ) = $ssh->open2pty({stderr_to_stdout => 1}, '/usr/bin/
+sudo', -p => $rootpassword, 'su', '-')
or return "failed to attempt su: $!\n";
my $expect = Expect->init($pty);
$expect->log_file("$path/expect_pm.log", "w");
my @cmdlist =(
    "ls -l",
    "pwd",
    "ls",
    "who am i",
    "id",
    "whoami"
);
foreach my $expect_cmd (@cmdlist){
    $expect->expect(2,
        [ qr/$rootpassword/ => sub { shift->send("$password\n");} ],  
        [ qr/Sorry/ => sub { die "Login failed" } ],
        [ qr/#/ => sub { shift->send("$expect_cmd \n");}]
    ) or die "___Timeout!";
}
$expect->expect(2);
[download]

The command line output looks like this:

archeman@host_target8:~/workdir/auto/scripts$ perl ./TestConnect.pl  1
+0.10.1.1 nonRoot p44s\!4t3Th15 /tmp/output root\ pass\ word\ here

                                   WARNING

Access and use of this device is restricted to authorized personnel of
+ xxx Corporation 
 for the purpose of fulfilling obligations
to a specific customer.  All other access is illegal and therefore str
+ictly
prohibited. Access and activity of this device may be monitored, and a
+ record
of access and activity may be retained by in accordance with its recor
+ds
retention policy.

Username: nonRoot Password: p44s!4t3Th15
Starting EXPECT pattern matching...
 at /usr/local/share/perl/5.14.2/Expect.pm line 597.
        Expect::expect(Expect=GLOB(0x87789c4), 2, ARRAY(0x8778d0c), AR
+RAY(0x8778c94), ARRAY(0x8778e74)) called at ./TestConnect.pl line 33
handle id(5): list of patterns:
  #1: -re `(?^:root pass word here)'
  #2: -re `(?^:Sorry)'
  #3: -re `(?^:#)'


handle id(5): Does `'
match:
  pattern #1: -re `(?^:root pass word here)'? No.
  pattern #2: -re `(?^:Sorry)'? No.
  pattern #3: -re `(?^:#)'? No.

Waiting for new data (2 seconds)...

handle id(5): Does `root pass word here'
match:
  pattern #1: -re `(?^:root pass word here)'? YES!!
    Before match string: `'
    Match string: `root pass word here'
    After match string: `'
    Matchlist: ()
Calling hook CODE(0x8778b40)...
Sending '3sc4!4t3Th15\n' to handle id(5)
 at /usr/local/share/perl/5.14.2/Expect.pm line 1421.
        Expect::print(Expect=GLOB(0x87789c4), "p44s!4t3Th15\x{a}") cal
+led at ./TestConnect.pl line 31
        main::__ANON__(Expect=GLOB(0x87789c4)) called at /usr/local/sh
+are/perl/5.14.2/Expect.pm line 825
        Expect::_multi_expect(2, undef, ARRAY(0x877ba74)) called at /u
+sr/local/share/perl/5.14.2/Expect.pm line 602
        Expect::expect(Expect=GLOB(0x87789c4), 2, ARRAY(0x8778d0c), AR
+RAY(0x8778c94), ARRAY(0x8778e74)) called at ./TestConnect.pl line 33
Returning from expect successfully.
Starting EXPECT pattern matching...
 at /usr/local/share/perl/5.14.2/Expect.pm line 597.
        Expect::expect(Expect=GLOB(0x87789c4), 2, ARRAY(0x8778d48), AR
+RAY(0x8778d98), ARRAY(0x8778eb0)) called at ./TestConnect.pl line 33
handle id(5): list of patterns:
  #1: -re `(?^:root pass word here)'
  #2: -re `(?^:Sorry)'
  #3: -re `(?^:#)'


handle id(5): Does `'
match:
  pattern #1: -re `(?^:root pass word here)'? No.
  pattern #2: -re `(?^:Sorry)'? No.
  pattern #3: -re `(?^:#)'? No.

Waiting for new data (2 seconds)...

handle id(5): Does `\r\n'
match:
  pattern #1: -re `(?^:root pass word here)'? No.
  pattern #2: -re `(?^:Sorry)'? No.
  pattern #3: -re `(?^:#)'? No.

Waiting for new data (2 seconds)...

handle id(5): Does `\r\nSorry, try again.\r\nroot pass word here'
match:
  pattern #1: -re `(?^:root pass word here)'? YES!!
    Before match string: `\r\nSorry, try again.\r\n'
    Match string: `root pass word here'
    After match string: `'
    Matchlist: ()
Calling hook CODE(0x8778b68)...
Sending '3sc4!4t3Th15\n' to handle id(5)
 at /usr/local/share/perl/5.14.2/Expect.pm line 1421.
        Expect::print(Expect=GLOB(0x87789c4), "p44s!4t3Th15\x{a}") cal
+led at ./TestConnect.pl line 31
        main::__ANON__(Expect=GLOB(0x87789c4)) called at /usr/local/sh
+are/perl/5.14.2/Expect.pm line 825
        Expect::_multi_expect(2, undef, ARRAY(0x877bccc)) called at /u
+sr/local/share/perl/5.14.2/Expect.pm line 602
        Expect::expect(Expect=GLOB(0x87789c4), 2, ARRAY(0x8778d48), AR
+RAY(0x8778d98), ARRAY(0x8778eb0)) called at ./TestConnect.pl line 33
Returning from expect successfully.
Starting EXPECT pattern matching...
 at /usr/local/share/perl/5.14.2/Expect.pm line 597.
        Expect::expect(Expect=GLOB(0x87789c4), 2) called at ./TestConn
+ect.pl line 36
handle id(5): list of patterns:


handle id(5): Does `'
match:

Waiting for new data (2 seconds)...

handle id(5): Does `\r\n'
match:

Waiting for new data (2 seconds)...

handle id(5): Does `\r\nSorry, try again.\r\nroot pass word here'
match:

Waiting for new data (2 seconds)...
TIMEOUT
Returning from expect with TIMEOUT or EOF
rlong@host_target8:~/workdir/auto/scripts$
[download]

When I examine the output in the file /tmp/output/expect_pm.log file, it contains only the rootPassword:

rlong@host_target8:~/workdir/auto/scripts$ cat /tmp/output/expect_pm.l
+og
root pass word here
Sorry, try again.
root pass word here
Sorry, try again.
[download]

So the password response to sudo appears to be formed correctly but I'm not sure why it is failing

Comment on Expect OpenSSH sudo login is failing Select or Download Code

Replies are listed 'Best First'.
Re: Expect OpenSSH sudo login is failing by salva (Canon) on Apr 20, 2017 at 20:33 UTC
The root password contains spaces and those spaces do appear to be getting escaped correctly Spaces in the password shouldn't be escaped in any way! Or do you mean the prompt for the root password? What I see is from the debugging output you have posted is that the remote systems doesn't like the root password you are passing	[reply]
Re^2: Expect OpenSSH sudo login is failing by archeman2 (Novice) on Apr 20, 2017 at 20:59 UTC
Well since I am passing in several arguments, and the password contains spaces, that is where I'm using the escapes: In the example below, the final argument is the root password that contains spaces <blocktext> `user@host:> perl perlscript.pl one two three four root\ pass\ word` [download] </blocktext> btw, I have tested the password when manually connected to the remote system and the password is correct	[reply] [d/l]
Re^3: Expect OpenSSH sudo login is failing by archeman2 (Novice) on Apr 20, 2017 at 21:55 UTC
I suspect that I may have found the root cause, at least it is 'kind of' working now that I have made the following change: `[ qr/$rootpassword/ => sub { shift->send("$password\n");} ],` [download] Changed to: `[ qr/$rootpassword/ => sub { shift->send("$rootpassword\n");} +],` [download] So it may have in fact been the wrong password	[reply] [d/l] [select]
Re: Expect OpenSSH sudo login is failing by thanos1983 (Parson) on Apr 21, 2017 at 10:31 UTC
Hello archeman2, Since you are using already Net::OpenSSH why don't you use Running remote commands with sudo (FAQ) which already implemented? I had similar problem in the past and I have tried many modules trying to resolve it (Best module to execute administrator commands on external operating systems (Linux)). I do not know if you are interested it can also be achieved with parallel ssh connections running ssh commands (Net::OpenSSH::Parallel with sudo commands). From my point of view I would set up ssh-exchange as root so you do not need to provide password when you ssh and then apply the commands that you want as root. This is much much more safer than applying psw through ssh. Think about it. Hope this helps. Seeking for Perl wisdom...on the process of learning...not there...yet!	[reply] [d/l] [select]
Re: Expect OpenSSH sudo login is failing by neilwatson (Priest) on Apr 20, 2017 at 19:56 UTC
Not Perl, but Ansible is great tool for operations on remote hosts. Don't reinvent the wheel if you don't have to. Neil Watson watson-wilson.ca	[reply]
Re^2: Expect OpenSSH sudo login is failing by archeman2 (Novice) on Apr 20, 2017 at 20:27 UTC
Well it appears that Ansible is a heavy $$$ commercial GUI product rather than a basic script. So I'm not re-inventing the wheel, I'm trying to fix my wobbly wheel while your trying to sell me a commercial airliner.	[reply]
Re^3: Expect OpenSSH sudo login is failing by neilwatson (Priest) on Apr 21, 2017 at 02:31 UTC
Ansible is an opensource non-gui program. There are commercial addons, but they are not required. Neil Watson watson-wilson.ca	[reply]
Re^4: Expect OpenSSH sudo login is failing (ansible) by hippo (Archbishop) on Apr 21, 2017 at 08:35 UTC
Re^5: Expect OpenSSH sudo login is failing (ansible) by Corion (Patriarch) on Apr 21, 2017 at 08:42 UTC