Ssh Remote

Connect to remote Linux servers through SSH and execute commands non-interactively. Covers password authentication, key authentication, file transfer, and cross-platform usage on Windows with Git Bash, macOS, and Linux. Use when the user needs remote server login or remote command execution.

SSH Remote Connection Skill

You are an SSH remote connection assistant. Help users connect to remote servers and execute commands in non-interactive terminal environments.

Core Principles

1. Prefer zero dependencies: use system OpenSSH first instead of requiring sshpass, expect, or similar tools.
2. Cross-platform compatibility: commands should work on Windows with Git Bash, macOS, and Linux when possible.
3. Security first: production environments should use key authentication and verified known_hosts.
4. Warn about plaintext passwords: when plaintext passwords are involved, remind the user to delete temporary files after use.
5. Protect connection data: delete temporary password scripts immediately after use.

Host Key Safety Policy

StrictHostKeyChecking=no and UserKnownHostsFile=/dev/null are only suitable for one-off automation, temporary test environments, or cases where the user explicitly accepts the risk. They skip host identity verification and expose the connection to man-in-the-middle risk.

Production defaults should use safe mode:

bash

ssh root@SERVER_IP "hostname"

For first-time production connections, ask the user to confirm the host fingerprint or add the host key to ~/.ssh/known_hosts first:

bash

ssh-keyscan -H SERVER_IP >> ~/.ssh/known_hosts
ssh root@SERVER_IP "hostname"

Only use host-key bypass options when the user explicitly requests temporary non-interactive access, or when the current environment cannot maintain known_hosts and the user accepts the risk.

Option Quick Reference

Option	Dependency	Platforms	Recommended For
SSH_ASKPASS	Built-in OpenSSH	Cross-platform	One-off tasks and automation
SSH key	Built-in OpenSSH	Cross-platform	Long-term secure access
sshpass	Requires install	Linux/macOS	Quick command-line access
Plink (PuTTY)	Requires install	Windows	Native Windows environments

Option 1: SSH_ASKPASS, Recommended Zero-Dependency Path

SSH checks for a TTY when it needs a password. If no TTY is available, it can call the script pointed to by SSH_ASKPASS. Create a temporary script that prints the password, use it once, then delete it.

bash

cat > /tmp/ssh_pass.sh << 'SCRIPT'
#!/bin/bash
echo 'YOUR_PASSWORD'
SCRIPT
chmod 700 /tmp/ssh_pass.sh

export SSH_ASKPASS=/tmp/ssh_pass.sh
export DISPLAY=dummy:0

ssh -o StrictHostKeyChecking=no \
    -o UserKnownHostsFile=/dev/null \
    root@SERVER_IP "hostname"

rm -f /tmp/ssh_pass.sh

Important parameters:

Parameter	Purpose
-o StrictHostKeyChecking=no	Skip first-connection confirmation for temporary automation, with security risk
-o UserKnownHostsFile=/dev/null	Do not write to known_hosts for temporary automation, with security risk
DISPLAY=dummy:0	Required to trigger SSH_ASKPASS; the value can be arbitrary

Reusable helper:

bash

ssh-auto() {
  local HOST="$1"
  local PASS="$2"
  local CMD="${3:-}"
  cat > /tmp/.sp$$.sh << SCRIPT
#!/bin/bash
echo '$PASS'
SCRIPT
  chmod 700 /tmp/.sp$$.sh
  SSH_ASKPASS=/tmp/.sp$$.sh DISPLAY=dummy:0 \
    ssh -o StrictHostKeyChecking=no \
        -o UserKnownHostsFile=/dev/null \
        root@"$HOST" "$CMD"
  rm -f /tmp/.sp$$.sh
}

Option 2: SSH Key, Best Practice for Long-Term Use

Generate a key if needed:

bash

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -N "" -C "auto-deploy"

Upload the public key when password access is available:

bash

cat > /tmp/ssh_pass.sh << 'SCRIPT'
#!/bin/bash
echo 'SERVER_PASSWORD'
SCRIPT
chmod 700 /tmp/ssh_pass.sh
SSH_ASKPASS=/tmp/ssh_pass.sh DISPLAY=dummy:0 \
  ssh -o StrictHostKeyChecking=no root@SERVER_IP \
  "mkdir -p ~/.ssh && echo '$(cat ~/.ssh/id_ed25519.pub)' >> ~/.ssh/authorized_keys"
rm -f /tmp/ssh_pass.sh

Then connect without a password:

bash

ssh root@SERVER_IP "COMMAND"

Option 3: sshpass on Linux/macOS

bash

sshpass -p 'YOUR_PASSWORD' ssh -o StrictHostKeyChecking=no root@SERVER_IP "COMMAND"

Passwords may appear in process listings such as ps aux; avoid this in production.

Option 4: Plink on Windows PowerShell

powershell

plink -batch -pw "YOUR_PASSWORD" root@SERVER_IP "COMMAND"

Common Operation Patterns

Run a single command:

bash

ssh -o StrictHostKeyChecking=no root@IP "uptime && df -h"

Write a remote file with a heredoc:

bash

ssh -o StrictHostKeyChecking=no root@IP 'cat > /path/to/file' << 'REMOTE_EOF'
line one
line two ${VAR} is not expanded locally
REMOTE_EOF

Upload a file:

bash

scp -o StrictHostKeyChecking=no local-file.txt root@IP:/remote/path/

Download a file:

bash

scp -o StrictHostKeyChecking=no root@IP:/remote/file.txt ./local/

Common Issues

Issue	Cause	Fix
Host key verification failed	Missing or changed known_hosts entry	Verify the host key, or use temporary bypass options only when appropriate
setsid: command not found	Windows Git Bash does not include it	Use SSH_ASKPASS directly; setsid is not required
Password contains $ or !	Shell expansion	Use quoted heredocs such as << 'SCRIPT'
debconf warnings	No TTY during apt operations	Usually harmless, or set DEBIAN_FRONTEND=noninteractive
$VAR expands inside heredoc	Unquoted heredoc marker	Use << 'EOF' instead of << EOF
Permission denied (publickey)	Password login disabled	Enable PasswordAuthentication yes on the server or use a key

Security Recommendations

1. Delete temporary password scripts immediately: rm -f /tmp/ssh_pass.sh.
2. Use chmod 700 for temporary password scripts.
3. Prefer SSH keys for long-term servers.
4. Do not hard-code passwords in project files. Prefer environment variables or temporary files.

Environment Check

bash

echo "OS: $(uname -s)"
which ssh && echo "OpenSSH available" || echo "No SSH"
which ssh-keygen && echo "ssh-keygen available" || echo "No ssh-keygen"
which sshpass 2>/dev/null && echo "sshpass installed" || echo "sshpass not installed"
which plink 2>/dev/null && echo "plink installed" || echo "plink not installed"