Any security risks with sudo password from standard input over ssh?

Question

I want to execute sudo over ssh on remote servers and supply the password over standard input. The following code is in a shell script on a secured server with restricted access. The password is asked beforehand and the servers use all the same sudo password. The someaction can surely take some seconds to execute.

Here is the shell script extract:

read -s -p "please enter your sudo password" PASSWORD
ssh user@host1 -t "echo '$PASSWORD' | sudo -S someaction"
ssh user@host2 -t "echo '$PASSWORD' | sudo -S someaction"

My question: Is it safe to use echo with a pipe? And are here any security problems that might occur, like logging the echo result on the remote server, etc?

Maybe somebody has a better suggestion?

Note: I know other tools can do this, like ansible etc. I am not looking for another similar tool, just want to know whether using ssh/echo/sudo in the mentioned way is safe.

Maybe not on the server, but certainly on the node where you execute these commands. $PASSWORD is visible as it is an environment variable. — thriqon
good point, but the code is inside a script, and the assumption is that the script is not manipulated or tweaked by others. I will adjust the question. thanks. — agreif

thriqon thriqon · Accepted Answer · 2015-03-25T08:17:01

Yes!

As long as the command is running anybody that can view all processes can view that password, by running ps aux | grep echo:

root     [..] zsh -c echo topsecret | sudo -C action

You could configure sudo to not ask the password for a specific task for a user, that would certainly increase security over this solution.

Any security risks with sudo password from standard input over ssh?

1 Answers