MacOS Mojave 安装sshpass

使用sshpass的场景

在MacOS下使用ansible命令(inventory文件中使用了密码验证的方式)或者使用iTerm2来完成自动密码填充等场景会使用到sshpass。

比如下面的样例：Inventory文件中使用了ansible_ssh_pass选项

stephens-New-MacBook-Pro:ansible stephen$ cat test.hosts
10.10.66.66 ansible_port=22 ansible_user=root ansible_ssh_pass=test666
stephens-New-MacBook-Pro:ansible stephen$

使用ansible命令会失败，提示缺少sshpass。

stephens-New-MacBook-Pro:ansible stephen$ ansible all -i test.hosts  -m ping
10.10.66.66 | FAILED! => {
    "failed": true,
    "msg": "to use the 'ssh' connection type with passwords, you must install the sshpass program"
}
stephens-New-MacBook-Pro:ansible stephen$

安装sshpass及各种常见小问题处理

直接brew install会提示不安全，被拒绝，brew install --force强制安装也不行

stephens-New-MacBook-Pro:ansible stephen$ brew install sshpass -f
Updating Homebrew...
Error: No available formula with the name "sshpass"
We won't add sshpass because it makes it too easy for novice SSH users to
ruin SSH's security.
stephens-New-MacBook-Pro:ansible stephen$

可以通过下面的命令进行安装

brew install https://raw.githubusercontent.com/kadwanev/bigboybrew/master/Library/Formula/sshpass.rb

sshpass.rb文件内容

require 'formula'

class Sshpass < Formula
  url 'http://sourceforge.net/projects/sshpass/files/sshpass/1.06/sshpass-1.06.tar.gz'
  homepage 'http://sourceforge.net/projects/sshpass'
  sha256 'c6324fcee608b99a58f9870157dfa754837f8c48be3df0f5e2f3accf145dee60'

  def install
    system "./configure", "--disable-debug", "--disable-dependency-tracking",
                          "--prefix=#{prefix}"
    system "make install"
  end

  def test
    system "sshpass"
  end
end

如果(因为众所周知的网络原因)通过brew install https://raw.githubusercontent.com/kadwanev/bigboybrew/master/Library/Formula/sshpass.rb的方式不能正常工作，可以将上面rubby脚本sshpass.rb的内容拷贝到本地执行brew install sshpass.rb

再次尝试安装提示缺少xcode-select命令行工具，可以通过xcode-select --install进行安装

stephens-New-MacBook-Pro:ansible stephen$ brew install sshpass.rb
Error: Xcode alone is not sufficient on Mojave.
Install the Command Line Tools:
  xcode-select --install

stephens-New-MacBook-Pro:ansible stephen$ xcode-select --install
xcode-select: note: install requested for command line developer tools
stephens-New-MacBook-Pro:ansible stephen$

安装完xcode-select之后重新执行brew install命令，sshpass安装成功。

stephens-New-MacBook-Pro:ansible stephen$ brew install sshpass.rb
Updating Homebrew...
==> Downloading http://sourceforge.net/projects/sshpass/files/sshpass/1.06/sshpass-1.06.tar.gz
==> Downloading from https://jaist.dl.sourceforge.net/project/sshpass/sshpass/1.06/sshpass-1.06.tar.g
######################################################################## 100.0%
==> ./configure --prefix=/usr/local/Cellar/sshpass/1.06
==> make install
🍺  /usr/local/Cellar/sshpass/1.06: 9 files, 41.6KB, built in 33 seconds
You have new mail in /var/mail/stephen
stephens-New-MacBook-Pro:ansible stephen$

测试

执行ansible ping命令测试，OK。

stephens-New-MacBook-Pro:ansible stephen$ ansible all -i test.hosts  -m ping
10.10.66.66 | SUCCESS => {
    "changed": false,
    "ping": "pong"
}
stephens-New-MacBook-Pro:ansible stephen$

安全提示

既然brew默认不让安装sshpass，肯定是有它的理由的，那就是「安全」隐患。尽管我们使用本文的方式可以将sshpass安装成功，不过在实际工作，尤其是生产环境中还是尽可能地避免使用这样的验证方式。

比如我们线上的使用姿势是：

  • 所有登录操作均需要通过统一的入口，即跳板机/堡垒机；
  • 登录跳板机/堡垒机以及目标机器均采用密钥认证，密钥需要加盐；
  • 用户通过开启SSH Agent转发的方式来登录跳板机/堡垒机，用户的私钥只存储在用户本地，在跳板机/堡垒机以及目标机器上只存储用户的公钥；
posted @ 2019-12-14 15:32  That's_it  阅读(3374)  评论(0)  编辑  收藏  举报