Bash | shell script to connect SFTP server

[vale lance]

The regular SSH/SFTP login prompt should appear when the remote side asks for authentication, and that should be accepting input as usual.

If you have the option you may also want to setup passwordless authentication using SSH keys.

[vivid mulch]

Yeah my SFTP ask me for the password but I want the script to enter it for me

[vivid mulch]

So when I launch the script it's already log in the sftp

[vale lance]

That's a rather bad idea from a security standpoint.
But I'm sure you're aware of that.

You'll probably want to have a look at ssh-agent.
That will store login credentials in memory so non-interactive programs can safely use them.
It's also applicable here, since SFTP is built on top of SSH.

[vivid mulch]

The script can't type something for me ?

[vale lance]

It could.
But that is a really bad idea when dealing with passwords/authentication.

[vivid mulch]

Yeah but this will only be on my phone so no problem

Just asking
test.bash
echo "test"
But when I use it with shortcuts it didn't print test why ?

[vale lance]

In an abstract sense, no.
But practically speaking there is no excuse for intentionally using terrible security practices.

[vale lance]

echo, cat, printf and other commands that print something to the terminal usually print to the "standard output", also referred to as stdout or fd/1.
stdout in turn gets printed on its connected terminal.
Ordinarily the Termux app interface.

Shortcuts are not connected to the standard Termux app interface, and as such can't print out text to stdout.
Although you could probably redirect that into a notification or something.
I'd need to think about it some more.

[vivid mulch]

Into a notification?

[vale lance]

Termux has the ability to send Android notifications through termux-notification.

It's part of the Termux:API add-on and termux-api package

[vivid mulch]

Of and what I will do with that ?

[vale lance]

It was a hypothetical

[vivid mulch]

It's bad but if I use the termux-fingerprint to secure that ? It is less bad no ?

[vale lance]

The issue is, you're putting an authentication token, in this case a password.
In plain text.
In your script.

Which is a huge no no.
Passwords ideally never touch the disk.
And if they must, then they should never be on the disk in an unencrypted state.

[vivid mulch]

But no one can access it

Only me

Because its my phone

[vale lance]

Do as you see fit.

sftp user@host <<< 'password'

Should in theory work.
But I want to reiterate that storing passwords in plain text is a really bad idea.

sftp may also simply refuse non-interactive input like that.

[vivid mulch]

Thanks I will try

That didn't work

[vale lance]

That is strictly a good thing.
That just means sftp is protecting you from a really basic security mistake.

[vivid mulch]

And how to use ssh_agent

[vale lance]

We'll need to initialize it first.
You'll need to add the following in your ~/.bashrc or equivalent start up file for your shell.

eval "$(ssh-agent)" # This will print a confirmation message on startup along the lines of
# Agent pid 1234

# if you want to discard that confirmation message use
eval "$(ssh-agent)" > /dev/null

# either way, a ssh-agent is now running for this session.

To store the login credentials for a remote host simply try to login on it, the credentials will then be stored for the duration of the active session.

There is a couple caveats to this.
By default there is no sharing of the ssh-agent between sessions, and the ssh-agent exits when its parent process does.
So credentials are stored per session, and do not persist past that point.

[vivid mulch]

So it's useless if its only for a session

Because if I have a new session I need to put my password again

[vale lance]

Which is where keybased authentication slots in.

[vivid mulch]

?

[vale lance]

I can generate a new pair of SSH keys.
Don't give those a passphrase.
Then add the public key of the pair on the remote side with ssh-copy-id.
It'll ask me to authorize doing that with the password.

Then afterwards as long as I specify the location of the private key from the pair in the config or on the command with the -i flag I can log in without a password
because I'm able to prove my identity by the fact that I have the Private Key that corresponds to the public key I gave the remote site.

[vivid mulch]

Ok how I can do that

It just store the password with encryption

Somewhere

[vivid mulch]

All of that is user side ? Not server side ?

[vale lance]

The only thing that has to get added to the remote side is the Public Key of the key pair.
And only the public key.
ssh-keygen spits out two files.
A Public and a Private key.

The Public key is what you give the remote side so they can identify you.
The Private key, is the corresponding authentication.

[vivid mulch]

But can I have the same private key on 2 device

Or 1 private key per device

And does the server can get multiple public key ?

[vale lance]

Yes, you can use the same private key to authenticate with multiple different servers.

[vivid mulch]

Not for multiple server

[vale lance]

Oh you meant can you use one key pair for both directions.

[vivid mulch]

Like my phone as the same private key than my tablet to access the same server

[vale lance]

You can use the same private key on multiple devices.
Just keep it, well, private.

[vivid mulch]

Well that sounds possible

So how can I create key ?

And where I found them ?

Oh I need to ask my host if he can add the key to authorize me to log in

[vale lance]

Nope, that can be done automatically using ssh-copy-id

[vivid mulch]

Sounds great

Can you explain me step by step how to do so ?

Like the command I need to run and how to find the key to put on my second device ?

[vale lance]

You can make a key pair using ssh-keygen.
I use this command as a general template for my keys.

ssh-keygen -t rsa -b 4096 -f "$PWD/rsa-4096_key_name" -C "Key Comment - ${USER}@${HOST:-$HOSTNAME} $(date -I)"

Let's break it down.
ssh-keygen - we wanna make a new key pair

• -t rsa - of type RSA
• -b 4096 - make it 4096 bits long, that's reasonably secure
• -f "$PWD/rsa-4096_key_name" - put the resulting keys in the current directory and name them rsa-4096_key_name (you can pick your own key name obviously) I just like specifying the key type in the name.
• -C "Key Comment - ${USER}@${HOST:-$HOSTNAME} $(date -I)" - add a comment, and then the username and system where I generated the keys and the time.

[vivid mulch]

Something like that ? Or I filled it in the wrong way ? And with the pwd line that mean my key will be on the folder I'm when I execute the command right ?

ssh-keygen -t rsa -b 4096 -f "$PWD/rsa-4096_key_name" -C "Key Comment - ${geekman}@${HOST:-$geekman.com} $(date -I)"```

(that's not my real sftp adresse)

[vale lance]

mmmh if you wanna manually specify a username and hostname Just replace the ${USER}@${HOST:-$HOSTNAME}.
${USER} is the environment variable USER, which contains the username of the current user.
So if you want [email protected] you just put that in as literal text.

[vivid mulch]

That mean I can just copy paste your code ?

No need to enter user and password

Because you said if I want to do it manually that mean it's doing it automatically?

[vale lance]

You will need to copy over your new public key to the server with ssh-copy-id but after that you should be able to log in without a password if you provide the private key as authentication.

[vivid mulch]

But where do I paste that ? On termux consol or when I am log in the SFTP ?

[vale lance]

ssh-copy-id -i ./rsa-4096_key_name.pub user@server

[vivid mulch]

I'm talking about the first one

[vivid mulch]

This one

[vale lance]

Oh, on the Termux console.

[vivid mulch]

Ok

What I put for passphrase?

@vale lance

[vale lance]

nothing

just enter

[vivid mulch]

Ok

[vale lance]

If you put a passphrase we're right back to needing to enter a password.
Just for the key this time.

[vivid mulch]

So I get my key

[vivid mulch]

What's next

[vale lance]

You still need to add your public key on the remote side.

[vale lance]

see here

[vivid mulch]

How do I specify the port ?

I just run the command but when I enter password I got a error that permissions denied and I done that to me last time when I didn't put the port

[vale lance]

You can do user@server:port

[vivid mulch]

Ok

[vivid mulch]

That don't work

Before I was connecting it with this command
sftp -P 2022 [email protected]

[vale lance]

That'll need to be a small p for ssh-copy-id.
According to ssh-copy-id --help

[vivid mulch]

Ok

Error
exec request failed on channel 0

[vale lance]

You can also set up a Host section in your ~/.ssh/config if you prefer.
SFTP and ssh-copy-id will read that as a side effect of using SSH.
Should look something like this.

Host Termux Phone termux phone
    User u0_a294
    Hostname 192.168.111.3
    Port 8022
    IdentityFile ${HOME}/.ssh/keys/local/rsa-4096_Termux

each name on the Host line will be a valid alias for the connection.

So I can just do sftp Termux for example.

[vivid mulch]

Ok

But I will do that after

[vivid mulch]

But I got that. :/

[vale lance]

You can try adding -s to the ssh-copy-id command.
That way it will use SFTP to transfer your key.

[vivid mulch]

Where I put the -s ?

Yeah because I have SFTP access but not ssh

[vale lance]

Ah that would do it.

[vivid mulch]

Forgot to tell you sorry

[vale lance]

You can put it just after ssh-copy-id, the order doesn't generally matter for command flags unless they take additional arguments.

[vivid mulch]

`/data/data/com.termux/files/usr/bin/ssh-copy-id: ERROR: invalid option (-s)

Usage: /data/data/com.termux/files/usr/bin/ssh-copy-id [-h|-?|-f|-n] [-i [identity_file]] [-p port] [[-o <ssh -o options>] ...] [user@]hostname
-f: force mode -- copy keys without trying to check if they are already installed
-n: dry run -- no keys are actually copied
-h|-?: print this help`

[vivid mulch]

Are you sure ? 🤔

[vale lance]

That is generally how argument parsing works.
-a "flags" and --opt " long options", don't usually have to go in any specific order.
--file /path/to/location or -o /put/that/here, options that take additional (positional) arguments usually expect them right after though.
You can usually tell from the --help option of a command.

[vivid mulch]

Yeah but -s don't exist

[vale lance]

Let's take ssh-copy-id's --help output as an example.

# ssh-copy-id --help
/usr/sbin/ssh-copy-id: illegal option -- -
Usage: /usr/sbin/ssh-copy-id [-h|-?|-f|-n|-s] [-i [identity_file]] [-p port] [-F alternative ssh_config file] [[-o <ssh -o options>] ...] [user@]hostname
        -f: force mode -- copy keys without trying to check if they are already installed
        -n: dry run    -- no keys are actually copied
        -s: use sftp   -- use sftp instead of executing remote-commands. Can be useful if the remote only allows sftp

Anything in brackets [] is optional.
So what's required is only ssh-copy-id hostname
Any other options can be specified in whatever order you like.

[vivid mulch]

So why I got error ?

[vale lance]

huh...

Termux's version does not have -s

I just checked.

That's weird.

[vivid mulch]

So what's it ?

[vale lance]

I am guessing Termux's version doesn't support sending the key via SFTP.

[vivid mulch]

💀

So I can't do that

[vale lance]

Yep just found it in the build script.

[vivid mulch]

So I can't

[vale lance]

Not from Termux.

[vivid mulch]

And with proot ?

Ubuntu proot

[vale lance]

Should be doable.

[vivid mulch]

I can install openssh and do it no ?

[vale lance]

Should work.

[vivid mulch]

Nice

How can I access termux key from proot ?

[vale lance]

I don't use proot personally, but I think there's like a --no-sandbox option or something like that to let the proot access the host file system.

[vivid mulch]

I just find it

Just doing cd /data/data/com.termux/files/home

When I run it I got a error

/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "./rsa-4096_HostyKey.pub" mktemp: failed to create directory via template ‘/root/.ssh/ssh-copy-id.XXXXXXXXXX’: No such file or directory /usr/bin/ssh-copy-id: ERROR: failed to create required temporary directory under ~/.ssh

So u tried the command but with -i /my_key

/usr/bin/ssh-copy-id: ERROR: failed to open ID file '/rsa-4096_HostyKey.pub': No such file

[vale lance]

/rsa-4096_HostyKey.pub would indicate a keyfile in the root directory, which isn't correct.

[vivid mulch]

I tried removing the / but still don't work

How can I access with the key in the same directory that I am

[vale lance]

You will need the actual location of the public key.
If it's in your current directory you can use ./rsa-4096_HostyKey.pub
. is shorthand for the current directory.

[vivid mulch]

That erro

[vivid mulch]

With that

[vale lance]

You might have to ask your host to add your key then.

[vivid mulch]

Ok what I should ask him

Like precisely

[vale lance]

The entire content of your public key will need to be added to the .ssh/authorized_keys file in your user's home directory.
That file should contain your entire public key.

[vivid mulch]

Sadly it's a no 😔