Using sudo in an SSH Shell Session

See more SSH Examples

Demonstrates running a command with sudo in a shell session without an interactive prompt. sudo -S reads the password from stdin and -p "" suppresses the prompt, so piping the password in with echo runs the command as root with no interaction.

Security note: The password appears in the command line, so it may be visible in the remote host's process list and shell history. A passwordless sudo rule for the specific command is preferable where it can be arranged.

var
success: Boolean;
ssh: HCkSsh;
port: Integer;
password: PWideChar;
channelNum: Integer;
sbCommands: HCkStringBuilder;
commands: PWideChar;
caseSensitive: Boolean;
sessionOutput: PWideChar;

begin
success := False;

//  This example requires the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  Demonstrates running a command with "sudo" in a shell session, supplying the password without
//  an interactive prompt.

ssh := CkSsh_Create();

port := 22;
success := CkSsh_Connect(ssh,'ssh.example.com',port);
if (success = False) then
  begin
    Memo1.Lines.Add(CkSsh__lastErrorText(ssh));
    Exit;
  end;

//  Normally you would not hard-code the password in source.  You should instead obtain it
//  from an interactive prompt, environment variable, or a secrets vault.
password := 'mySshPassword';

success := CkSsh_AuthenticatePw(ssh,'mySshLogin',password);
if (success = False) then
  begin
    Memo1.Lines.Add(CkSsh__lastErrorText(ssh));
    Exit;
  end;

//  Start a shell session.  QuickShell allocates a PTY, so the shell echoes the commands sent
//  to it and prints a prompt.
channelNum := CkSsh_QuickShell(ssh);
if (channelNum < 0) then
  begin
    Memo1.Lines.Add(CkSsh__lastErrorText(ssh));
    Exit;
  end;

//  Build the command.  "sudo -S" makes sudo read the password from stdin, and "-p" sets the
//  prompt -- setting it to an empty string removes the prompt entirely.  Piping the password in
//  via "echo" therefore runs the command as root with no interaction.
//  
//  Security note: the password appears in the command line, so it can be visible in the remote
//  host's process list and shell history.  Prefer a passwordless sudo rule where possible.
sbCommands := CkStringBuilder_Create();
CkStringBuilder_Append(sbCommands,'echo "');
CkStringBuilder_Append(sbCommands,password);
CkStringBuilder_Append(sbCommands,'" | sudo -S -p "" ls' + #10);

//  The final command echoes a marker used to detect the end of the output.  The single quotes
//  around 'IS' are a trick: the terminal echo of the typed command includes the quotes, while
//  the command's actual output does not.  Matching the unquoted form therefore matches the real
//  output rather than the echo.
CkStringBuilder_Append(sbCommands,'echo THIS ''IS'' THE END OF THE SCRIPT' + #10);

commands := CkStringBuilder__getAsString(sbCommands);
success := CkSsh_ChannelSendString(ssh,channelNum,commands,'utf-8');
if (success = False) then
  begin
    Memo1.Lines.Add(CkSsh__lastErrorText(ssh));
    Exit;
  end;

//  No more commands will be sent.
success := CkSsh_ChannelSendEof(ssh,channelNum);
if (success = False) then
  begin
    Memo1.Lines.Add(CkSsh__lastErrorText(ssh));
    Exit;
  end;

//  IMPORTANT: Set a read timeout before receiving until a match.  ReadTimeoutMs defaults to 0,
//  which means no limit -- without it, this call waits forever if the received data never
//  contains a match.
CkSsh_putReadTimeoutMs(ssh,15000);

caseSensitive := True;
success := CkSsh_ChannelReceiveUntilMatch(ssh,channelNum,'THIS IS THE END OF THE SCRIPT','utf-8',caseSensitive);
if (success = False) then
  begin
    Memo1.Lines.Add(CkSsh__lastErrorText(ssh));
    Exit;
  end;

//  Close the channel only after the desired output has been received.
success := CkSsh_ChannelSendClose(ssh,channelNum);
if (success = False) then
  begin
    Memo1.Lines.Add(CkSsh__lastErrorText(ssh));
    Exit;
  end;

success := CkSsh_ChannelReceiveToClose(ssh,channelNum);
if (success = False) then
  begin
    Memo1.Lines.Add(CkSsh__lastErrorText(ssh));
    Exit;
  end;

sessionOutput := CkSsh__getReceivedText(ssh,channelNum,'utf-8');
if (CkSsh_getLastMethodSuccess(ssh) = False) then
  begin
    Memo1.Lines.Add(CkSsh__lastErrorText(ssh));
    Exit;
  end;
Memo1.Lines.Add('--- output ----');
Memo1.Lines.Add(sessionOutput);

CkSsh_Disconnect(ssh);

CkSsh_Dispose(ssh);
CkStringBuilder_Dispose(sbCommands);