Hi,
I am facing a strange problem while executing a script from a solaris server. This script calls another one to execute "expect" commands on some other 40 servers (all AIX 5200). I am passing username and password to the "expect" script as arguments. My problem is that it is showing the password when the script is logging in to some of these AIX servers, and the strange thing is this happens to different servers in different time (not on the same set of servers). I am invoking it in ksh. I am also using "stty -echo", but it does not show any effect here.
Can somebody suggest..?
This is how my script looks like..
#!/usr/local/bin/expect
set timeout 20
set servname [lindex $argv 0]
set uname [lindex $argv 1]
set password [lindex $argv 2]
spawn pbrun -h $servname root
expect "assword:"
send "$password\r"
expect "root#"
send "mkdir -p /tmp/qwho\r"
expect "root#"
send "hostname > /tmp/qwho/`date +%m-%d-%y`.`hostname`.log\r"
expect "root#"
send "-my command- >>/tmp/qwho/`date +%m-%d-%y`.`hostname`.log\r"
expect "root#"
send "scp /tmp/qwho/*.log $uname@-my serv name-:/tmp/DEC/QWHO/logs/\r"
expect "assword:"
send "$password\r"
expect "root#"
send "rm /tmp/qwho/*.log\r"
expect "root#"
close
Do you see the password (in the process list?) when logging into the target server or when scp'ing the logfile from target server back to source server?
Thanks for the quick reply..
I am seeing the password while logging in to the target servers using expect. When I run the script, it shows me the job process. ie, doing "pbrun" then it shows the banner of the target machine, then the prompt and there it shows the password. doing scp it does not show password.
However I have another script which use expect only to do scp from certain machines. There it shows the password. I have tried using "echo -stty" and "spwn -noecho pbrun <server_name> root". It does not seem to be working..
I think that you cannot prevent the password being visible in the processlist as long as you pass it over as an argument. In this case it was just a question of issuing the ps command at the right time to see it. This was about your current code:
#!/opt/freeware/bin/expect -f
stty -echo
set pass [lindex $argv 0]
sleep 1
send "$pass\r"
I named the script "te2" and used the little loop following to catch ps output while I ran the above script handing over "abc" as password:
(0)aserver:/home/shockneck> while true; do ps -fushockneck | grep [a]bc; done
During this one second sleep the loop catches the password more than ten times:
shockneck 25470 15792 3 22:25:07 pts/0 0:00 /opt/freeware/bin/expect -f te2 abc
shockneck 25470 15792 3 22:25:07 pts/0 0:00 /opt/freeware/bin/expect -f te2 abc
shockneck 25470 15792 3 22:25:07 pts/0 0:00 /opt/freeware/bin/expect -f te2 abc
[...]
shockneck 25470 15792 3 22:25:07 pts/0 0:00 /opt/freeware/bin/expect -f te2 abc
shockneck 25470 15792 1 22:25:07 pts/0 0:00 /opt/freeware/bin/expect -f te2 abc
Then I rewrote your code to this:
#!/opt/freeware/bin/expect -f
stty -echo
send_user "password? "
expect_user -re "(.*)\n"
send_user "\n"
set pass $expect_out(1,string)
sleep 1
send "$pass\r"
This way the password does not show up in the ps output. So you might just adapt your script. HTH.
hey thanks.. I shall try these..