Ssh – Bash-like command substitution in ssh or How to request things from ssh *client*

bashshellssh

In bash (and other shells) it is possible to insert the result of a command into a command line using something like $() and “ (backticks).

Now it would be nice if you had something like that but for ssh sessions. So you are in an ssh session and need some information from your own computer and want to put it into the inner command line on the machine you are connected to.

E.g. say you want to directly access a mysql console. You could use a command like that:

ssh user@example.com "mysql -u blub -pmypass"

That works but the problem is, that you can see the password in the command line of the ssh shell process.

To solve this security problem I would like to have something like that:

ssh user@example.com "mysql -u blub -p\$(ssh-on-client 'cat pass-file')"

which would execute cat passfile on the ssh client and not on the server. Is there anything known like that? Do you have any other tricks how to do that?

UPDATE:
I appreciate answers which refer to my example, but I will not accept them unless they answer the real question. That is, wether it is possible to communicate to the ssh client computer from within an ssh session. (I know this may constitute a possible security problem)

Possible solutions:

  • Having an ssh server on the client to connect back to. (sweimann) The problem is how to get the credentials for connecting back to the server.
  • Creating a tunnel with ssh and using some netcat script/telnet to execute commands on the server and send the result back.
  • Use expect to script the shell. (Zac Thompson)
  • Use a custom wrapper around ssh on the client watching the console and taking action accordingly. (sapporo)
  • Patch SSH to support this. There is similar patch on the mailing list available.
  • There's an option 'SendEnv' to ssh which sets environment variables on the remote computer. This has to be enabled on the remote sshd, though.

Best Answer

You want to use expect for this. It's probably already on your machine. It's the standard tool for any kind of interactive command-line automation. It's a Tcl library, so you'll get some Tcl skills along the way for free. Beware; it's addictive.

#!/path/to/expect
spawn ssh user@example.com "mysql -u blub"
expect "*ssword:*"
send -- "mypass\r"
interact