I am kind of new to both OpenSSH and Expect, but it appears that most advise to use these libraries for remote sudo command execution.
My script takes 5 arguments:
The script is supposed to connect as nonRootUser and then use 'sudo' to execute a sequence of commands. The connection and login appears to work as expected, however the sudo login fails and the only thing that appears in the output file is the RootPassword. The root password contains spaces and those spaces do appear to be getting escaped correctly according to the output file
Here is the perl script:
#!/usr/bin/perl -w use strict; use Net::OpenSSH; use Expect; $Expect::Exp_Internal = 1; my $hostname = shift; my $username = shift; my $password = shift; my $path = shift; my $rootpassword = shift; # Lets Connect First my $ssh = Net::OpenSSH->new(host => $hostname, user => $username, pass +word => $password); $ssh->error and die "Unable to connect to remote host: $hostname as $u +sername " . $ssh->error; print "Username: $username Password: $password\n"; # Figure Out What Command To Run my ( $pty, $pid ) = $ssh->open2pty({stderr_to_stdout => 1}, '/usr/bin/ +sudo', -p => $rootpassword, 'su', '-') or return "failed to attempt su: $!\n"; my $expect = Expect->init($pty); $expect->log_file("$path/expect_pm.log", "w"); my @cmdlist =( "ls -l", "pwd", "ls", "who am i", "id", "whoami" ); foreach my $expect_cmd (@cmdlist){ $expect->expect(2, [ qr/$rootpassword/ => sub { shift->send("$password\n");} ], [ qr/Sorry/ => sub { die "Login failed" } ], [ qr/#/ => sub { shift->send("$expect_cmd \n");}] ) or die "___Timeout!"; } $expect->expect(2);
The command line output looks like this:
archeman@host_target8:~/workdir/auto/scripts$ perl ./TestConnect.pl 1 +0.10.1.1 nonRoot p44s\!4t3Th15 /tmp/output root\ pass\ word\ here WARNING Access and use of this device is restricted to authorized personnel of + xxx Corporation for the purpose of fulfilling obligations to a specific customer. All other access is illegal and therefore str +ictly prohibited. Access and activity of this device may be monitored, and a + record of access and activity may be retained by in accordance with its recor +ds retention policy. Username: nonRoot Password: p44s!4t3Th15 Starting EXPECT pattern matching... at /usr/local/share/perl/5.14.2/Expect.pm line 597. Expect::expect(Expect=GLOB(0x87789c4), 2, ARRAY(0x8778d0c), AR +RAY(0x8778c94), ARRAY(0x8778e74)) called at ./TestConnect.pl line 33 handle id(5): list of patterns: #1: -re `(?^:root pass word here)' #2: -re `(?^:Sorry)' #3: -re `(?^:#)' handle id(5): Does `' match: pattern #1: -re `(?^:root pass word here)'? No. pattern #2: -re `(?^:Sorry)'? No. pattern #3: -re `(?^:#)'? No. Waiting for new data (2 seconds)... handle id(5): Does `root pass word here' match: pattern #1: -re `(?^:root pass word here)'? YES!! Before match string: `' Match string: `root pass word here' After match string: `' Matchlist: () Calling hook CODE(0x8778b40)... Sending '3sc4!4t3Th15\n' to handle id(5) at /usr/local/share/perl/5.14.2/Expect.pm line 1421. Expect::print(Expect=GLOB(0x87789c4), "p44s!4t3Th15\x{a}") cal +led at ./TestConnect.pl line 31 main::__ANON__(Expect=GLOB(0x87789c4)) called at /usr/local/sh +are/perl/5.14.2/Expect.pm line 825 Expect::_multi_expect(2, undef, ARRAY(0x877ba74)) called at /u +sr/local/share/perl/5.14.2/Expect.pm line 602 Expect::expect(Expect=GLOB(0x87789c4), 2, ARRAY(0x8778d0c), AR +RAY(0x8778c94), ARRAY(0x8778e74)) called at ./TestConnect.pl line 33 Returning from expect successfully. Starting EXPECT pattern matching... at /usr/local/share/perl/5.14.2/Expect.pm line 597. Expect::expect(Expect=GLOB(0x87789c4), 2, ARRAY(0x8778d48), AR +RAY(0x8778d98), ARRAY(0x8778eb0)) called at ./TestConnect.pl line 33 handle id(5): list of patterns: #1: -re `(?^:root pass word here)' #2: -re `(?^:Sorry)' #3: -re `(?^:#)' handle id(5): Does `' match: pattern #1: -re `(?^:root pass word here)'? No. pattern #2: -re `(?^:Sorry)'? No. pattern #3: -re `(?^:#)'? No. Waiting for new data (2 seconds)... handle id(5): Does `\r\n' match: pattern #1: -re `(?^:root pass word here)'? No. pattern #2: -re `(?^:Sorry)'? No. pattern #3: -re `(?^:#)'? No. Waiting for new data (2 seconds)... handle id(5): Does `\r\nSorry, try again.\r\nroot pass word here' match: pattern #1: -re `(?^:root pass word here)'? YES!! Before match string: `\r\nSorry, try again.\r\n' Match string: `root pass word here' After match string: `' Matchlist: () Calling hook CODE(0x8778b68)... Sending '3sc4!4t3Th15\n' to handle id(5) at /usr/local/share/perl/5.14.2/Expect.pm line 1421. Expect::print(Expect=GLOB(0x87789c4), "p44s!4t3Th15\x{a}") cal +led at ./TestConnect.pl line 31 main::__ANON__(Expect=GLOB(0x87789c4)) called at /usr/local/sh +are/perl/5.14.2/Expect.pm line 825 Expect::_multi_expect(2, undef, ARRAY(0x877bccc)) called at /u +sr/local/share/perl/5.14.2/Expect.pm line 602 Expect::expect(Expect=GLOB(0x87789c4), 2, ARRAY(0x8778d48), AR +RAY(0x8778d98), ARRAY(0x8778eb0)) called at ./TestConnect.pl line 33 Returning from expect successfully. Starting EXPECT pattern matching... at /usr/local/share/perl/5.14.2/Expect.pm line 597. Expect::expect(Expect=GLOB(0x87789c4), 2) called at ./TestConn +ect.pl line 36 handle id(5): list of patterns: handle id(5): Does `' match: Waiting for new data (2 seconds)... handle id(5): Does `\r\n' match: Waiting for new data (2 seconds)... handle id(5): Does `\r\nSorry, try again.\r\nroot pass word here' match: Waiting for new data (2 seconds)... TIMEOUT Returning from expect with TIMEOUT or EOF rlong@host_target8:~/workdir/auto/scripts$
When I examine the output in the file /tmp/output/expect_pm.log file, it contains only the rootPassword:
rlong@host_target8:~/workdir/auto/scripts$ cat /tmp/output/expect_pm.l +og root pass word here Sorry, try again. root pass word here Sorry, try again.
So the password response to sudo appears to be formed correctly but I'm not sure why it is failing
In reply to Expect OpenSSH sudo login is failing by archeman2
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |