Support for password input

[xsawyerx]

Hey,

this would probably be a better place to raise this issue.

I want to use System::Command with Rsync, which uses SSH, which does not accept the { input => $input } construct in the password input.

I've seen Net::OpenSSH use IO::Pty to handle this.

[dolmen]

As System::Command was originally built to wrap Git (see Git::Repository) I don't think it was designed for interactive programs. IPC::Run knows how to use IO::Pty for that use case, so that may be an appropiate module for the task.

Anyway, I don't think that you are using SSH in the right way. If your task has to be automated, you should use instead a private key dedicated for the task. I mean not just use a private key instead of password authentication, but a separate private key that will be used just for this script running on this machine and never for another usage (such as interactive use). To tell SSH to automatically use that private key you can add those lines in your ~/.ssh/config (I'm using those SSH aliases tricks in my own github-keygen tool):

# use 'my-fake-rsync-host' as the hostname in your rsync command
Host my-fake-rsync-host
Hostname my-real-rsync-host.example.com
User my-real-rsync-user
IdentitiesOnly yes
IdentityFile ~/.ssh/id_my-rsync-host.example.com

For further security, on the server side your key would be authorized to only run the host part of the rsync command. You do this by setting a restricted command on the public key in ~/.ssh/authorized_keys of the server. For more info, look for command= in the sshd man page.

For maximum security you would protect the private key with a passphrase (if not, your SSH prompt issue is already solved). To workaround ssh asking for the passphrase, you have two solutions:

• tell the script user to use an ssh-agent, and require in your script that the key is already loaded in the agent before the script starts. To achieve that, check that the key is listed in ssh-add -l.
• if you still insist on feeding the passphare from your script (bad thing, but not worse than a private key without passphrase, and still better than password authentication) you could use the SSH_ASKPASS environment variable (see the ssh and ssh-add man pages) to provide a program that will feed SSH. That program could be just cat path-to-a-fifo, the path-to-a-fifo being a FIFO fed by your program:

use POSIX 'mkfifo';
use File::Temp 'tmpnam';
my $fifo = tmpnam;
mkfifo $fifo, 0600;
$ENV{SSH_ASKPASS}="cat $fifo";
# use a child process to open and write the password to $fifo
# (because opening a FIFO is blocking until the reader is there)

[book]

Note that System::Command 1.114 (working correctly since 1.116 has a new interactive option which sets up the environment in the same way, but calls system, thus allowing interactions with the user to happen.