From: "Mauricio Fernández" <batsman.geo@...>
Date: 2003-04-13T17:06:42+09:00
Subject: Re: Controlling an interactive program from Ruby

On Sun, Apr 13, 2003 at 12:16:54PM +0900, Joel VanderWerf wrote:
> Simon Strandgaard wrote:
> >On Sun, 13 Apr 2003 11:26:20 +0900, Daniel Carrera wrote:
> >
> >
> >>>>This is what I wantn to automate:
> >>>>
> >>>>$ scp dcarrera@zeno:/data/tmp/filename some/directory/
> >>>>$ dcarrera@zeno's password:
> >>>
> >>>Passwords are unsafe.. take a look at ssh-keys.

The reasons given before don't hold IMHO, as
 * no plaintext is used
 * whoever gets access to the script w/ the password inside can
   equally get the files in ~/.ssh/ and steal the key file
 * if you cannot trust the computer you're using you're screwed anyway.
   If "they" have a keystroke recorder, "they" can as well just copy your key
   files. Or they could have a modified ssh binary that saves everything
   it receives somewhere, or...

There's however one (IMO) valid reason: passwords tend to be weak and
can be "easily" guessed.

> >>
> >>I'll take a look at it.
> >>Would you mind elaborating though?
> >>Why are passwords unsafe?  I always thought it was the best we got.
> >
> >
> >* network packets can get sniffed by evil people hooked up
> >  to your network (hackers). 
> >
> 
> My understanding was that ssh passwords are not sent in plain text. From 
> man ssh:
> 
>  If other authentication methods fail, ssh prompts the user for a pass-
>  word.  The password is sent to the remote host for checking; however,
>  since all communications are encrypted, the password cannot be seen by
>  someone listening on the network.

Moreover AFAIK the password is not sent at all, not even encrypted.
Rather something like the following happens:
 
  server: send(CHALLENGE)
  client: send(HASH_FUNC(F(recx(),PASSWORD)))
  server: check whether recx() == HASH_FUNC(F(CHALLENGE,PASSWORD))
 
If you make

 challenge = rand(100000000).to_s + Time.new.to_i.to_s, 
 def f(chall, pwd)
   chall + pwd
 end
 def hash_func(txt)
   Digest::MD5.hexdigest txt
 end

you have a working secure (against eavesdropping, not man-in-the-middle attacks)
authentication scheme in Ruby.

> Anyway, I second the suggestion to use ssh-keygen to make RSA/DSA keys. 
> I was thinking of using expect for the same reason until I got key-based 
> authentication to work. It's much nicer.

Some sites don't allow the use of keys :-|
 

-- 
 _           _                             
| |__   __ _| |_ ___ _ __ ___   __ _ _ __  
| '_ \ / _` | __/ __| '_ ` _ \ / _` | '_ \ 
| |_) | (_| | |_\__ \ | | | | | (_| | | | |
|_.__/ \__,_|\__|___/_| |_| |_|\__,_|_| |_|
	Running Debian GNU/Linux Sid (unstable)
batsman dot geo at yahoo dot com

From: Ean Schuessler <ean@novare.net>
The unrecognized minister of propaganda,
E
	-- Debian, joking