In comp.os.linux.misc cracraft@cox.net <cracraft@cox.net>:
Hi - I have a large number of machines to manage and historically
have used an expect script that drives ssh to connect to the boxes
to do things.

Using expect with ssh is a waste of time and insecure, ssh allows
to use ssh-agent and agent forwarding to manage logins.

See: http://www.snailbook.com/faq/

Good luck

In comp.os.linux.misc Why Tea <ytlim1@gmail.com>:
>>Using expect with ssh is a waste of time and insecure, ssh allows
>>to use ssh-agent and agent forwarding to manage logins.

I tend to disagree on this. To save typing the repetitive hostname/IP
and usrname, I use ssh-agent to start an expect script, which in turn
spawns ssh-add (user will be prompted for passphrase) and then spawns
ssh to connect to the remote host.

Well, but then you failed to understand how ssh-agent and agent
forwarding works, you don't need to enter the passphrase on each
login, only once and ssh-agent will keep it in memory. That's the
purpose of it.

[]

In comp.os.linux.misc Why Tea <ytlim1@gmail.com>:
>>Well, but then you failed to understand how ssh-agent and agent
>>forwarding works, you don't need to enter the passphrase on each
>>login, only once and ssh-agent will keep it in memory. That's the
>>purpose of it.

Ah, I see what you meant. ssh-agent was designed for exactly what you
mentioned. In an Expect script, I do not exactly make use of that
feature (ssh-agent terminates as Expect exits). As mentioned before:

ssh-agent -Expect script -ssh-add (will prompt for passphrase)
-ssh -l usrname
automatically
-set Clearcase view or
something automatically
-run applications
automatically
-get into interactive mode
for user to use shell

The whole thing can be wrapped in a shell script (e.g. ssh.sh). Now
when ssh logs off due to inactivities. All you need to do is to run
ssh.sh and enter the passphrase again; the passphrase can be put into
the Expect script (unsecure of course!) for 100% automatic operation.

This is the point, if you put the passphrase into the script you
can use a key without passphrase, since you don't have more
security.

The normal manual usage is probably something like:

ssh-agent xterm -ssh-add (add passphrase)
-ssh -l usrname
-usr is now connected to the remote host
-run apps and do work

If ssh logs off, run ssh -l again (no
passphrase required)

I think Expect can definitely make life a lot easier WITHUT
jeapodizing the security ssh provides. If you compare the two methods
above, perhaps the Expect way is more secure?

If you don't put the passphrase into the script then you should
be fine, but you are certainly over complicating things and not
using the advantages of ssh-agent. You can have all security and
comfort if you search for a package called keychain and use it.

Good luck