Embedding the Password in the Bash Script

Embedding an Expect script inside a Bash script

Your Bash script is passing the Expect commands on the standard input of expect. That is what the here-document <<EOD does. However, expect... expects its commands to be provided in a file, or as the argument of a -c, per the man page. Three options are below. Caveat emptor; none have been tested.

1. Process substitution with here-document:

   expect <(cat <<'EOD'
   spawn ... (your script here)
   EOD
   )
   

   The EOD ends the here-document, and then the whole thing is wrapped in a <( ) process substitution block. The result is that expect will see a temporary filename including the contents of your here-document.

   As @Aserre noted, the quotes in <<'EOD' mean that everything in your here-document will be treated literally. Leave them off to expand Bash variables and the like inside the script, if that's what you want.

2. Edit Variable+here-document:

   IFS= read -r -d '' expect_commands <<'EOD'
   spawn ... (your script here)
   interact
   EOD
   
   expect -c "${expect_commands//
   /;}"
   

   Yes, that is a real newline after // - it's not obvious to me how to escape it. That turns newlines into semicolons, which the man page says is required.

   Thanks to this answer for the read+heredoc combo.

3. Shell variable

   expect_commands='
   spawn ... (your script here)
   interact'
   expect -c "${expect_commands//
   /;}"
   

   Note that any ' in the expect commands (e.g., after id_rsa) will need to be replaced with '\'' to leave the single-quote block, add a literal apostrophe, and then re-enter the single-quote block. The newline after // is the same as in the previous option.

Automating Passphrase in a Bash Script (steghide, gpg, etc.)

man steghide:

   -p, --passphrase
          Use  the  string  following  this  argument  as the
          passphrase. If your passphrase contains whitespace,
          you  have  to enclose it in quotes, for example: -p
          "a very long passphrase".

man gpg:

   --passphrase string
          Use  string  as  the  passphrase. This can only be used if only one
          passphrase is supplied. Obviously, this  is  of  very  questionable
          security  on  a multi-user system. Don't use this option if you can
          avoid it.

Prompting for MySQLDump password in a bash script?

This should do the trick:

read -p "mysql password: " PASS && ssh user@domain.com 'mysqldump -u mysqluser -p'$PASS' --databases foo | bzip2' > foo-dump.sql.bz2 ; PASS=""

In this case, you will first enter the mysql password, and then be prompted for the ssh password. Note that the mysql password will not be hidden, i.e., someone can read it over your shoulder. If you want to avoid that, use the flag -s

read -s -p "mysql password: " PASS && ...

Note also that there mustn't be any space between the "p" (in -p for password) and the quotation mark for the password variable.

Also, your shebang is not specifying which interpreter to use, which might be a problem. I'd suggest you use #!/bin/bash or #!/usr/bin/env bash.

How to supply sudo with password from script?

If, as you say, you completely don't care about security...

Run visudo to edit /etc/sudoers with validation in place. Add the following line:

ALL ALL=(ALL) NOPASSWD: ALL

This will prevent sudo from ever asking for a password, for any user, for any command.

Secure way to use password in bash and expect

You can somewhat securely pass the password through the environment, as this is only readable by the same user and root. In the shell export password, and in the expect script

set password $env(password)

---

Related Topics