DataFlex

Using sudo in an SSH Shell Session

Demonstrates running a command with sudo in a shell session without an interactive prompt. sudo -S reads the password from stdin and -p "" suppresses the prompt, so piping the password in with echo runs the command as root with no interaction.

Security note: The password appears in the command line, so it may be visible in the remote host's process list and shell history. A passwordless sudo rule for the specific command is preferable where it can be arranged.

Background: This is the scripted alternative to the interactive su approach: rather than waiting for a password prompt and answering it, the password is supplied up front so no terminal interaction is needed. Because QuickShell allocates a PTY, the shell echoes back everything sent to it, which is what motivates the quoting trick on the final marker — writing echo THIS 'IS' THE END means the echoed command line contains the quotes while the real output does not, so matching the unquoted text matches actual output rather than the echo.

Chilkat DataFlex Downloads

Download Chilkat for DataFlex

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoSsh
    Integer iPort
    String sPassword
    Integer iChannelNum
    Handle hoSbCommands
    String sCommands
    Boolean iCaseSensitive
    String sSessionOutput
    String sTemp1
    Boolean bTemp1

    Move False To iSuccess

    //  This example requires the Chilkat API to have been previously unlocked.
    //  See Global Unlock Sample for sample code.

    //  Demonstrates running a command with "sudo" in a shell session, supplying the password without
    //  an interactive prompt.

    Get Create (RefClass(cComChilkatSsh)) To hoSsh
    If (Not(IsComObjectCreated(hoSsh))) Begin
        Send CreateComObject of hoSsh
    End

    Move 22 To iPort
    Get ComConnect Of hoSsh "ssh.example.com" iPort To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Normally you would not hard-code the password in source.  You should instead obtain it
    //  from an interactive prompt, environment variable, or a secrets vault.
    Move "mySshPassword" To sPassword

    Get ComAuthenticatePw Of hoSsh "mySshLogin" sPassword To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Start a shell session.  QuickShell allocates a PTY, so the shell echoes the commands sent
    //  to it and prints a prompt.
    Get ComQuickShell Of hoSsh To iChannelNum
    If (iChannelNum < 0) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Build the command.  "sudo -S" makes sudo read the password from stdin, and "-p" sets the
    //  prompt -- setting it to an empty string removes the prompt entirely.  Piping the password in
    //  via "echo" therefore runs the command as root with no interaction.
    //  
    //  Security note: the password appears in the command line, so it can be visible in the remote
    //  host's process list and shell history.  Prefer a passwordless sudo rule where possible.
    Get Create (RefClass(cComChilkatStringBuilder)) To hoSbCommands
    If (Not(IsComObjectCreated(hoSbCommands))) Begin
        Send CreateComObject of hoSbCommands
    End
    Get ComAppend Of hoSbCommands 'echo "' To iSuccess
    Get ComAppend Of hoSbCommands sPassword To iSuccess
    Get ComAppend Of hoSbCommands '" | sudo -S -p "" ls' + (character(10)) To iSuccess

    //  The final command echoes a marker used to detect the end of the output.  The single quotes
    //  around 'IS' are a trick: the terminal echo of the typed command includes the quotes, while
    //  the command's actual output does not.  Matching the unquoted form therefore matches the real
    //  output rather than the echo.
    Get ComAppend Of hoSbCommands "echo THIS 'IS' THE END OF THE SCRIPT" + (character(10)) To iSuccess

    Get ComGetAsString Of hoSbCommands To sCommands
    Get ComChannelSendString Of hoSsh iChannelNum sCommands "utf-8" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  No more commands will be sent.
    Get ComChannelSendEof Of hoSsh iChannelNum To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  IMPORTANT: Set a read timeout before receiving until a match.  ReadTimeoutMs defaults to 0,
    //  which means no limit -- without it, this call waits forever if the received data never
    //  contains a match.
    Set ComReadTimeoutMs Of hoSsh To 15000

    Move True To iCaseSensitive
    Get ComChannelReceiveUntilMatch Of hoSsh iChannelNum "THIS IS THE END OF THE SCRIPT" "utf-8" iCaseSensitive To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Close the channel only after the desired output has been received.
    Get ComChannelSendClose Of hoSsh iChannelNum To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get ComChannelReceiveToClose Of hoSsh iChannelNum To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get ComGetReceivedText Of hoSsh iChannelNum "utf-8" To sSessionOutput
    Get ComLastMethodSuccess Of hoSsh To bTemp1
    If (bTemp1 = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "--- output ----"
    Showln sSessionOutput

    Send ComDisconnect To hoSsh


End_Procedure