Lua

Using sudo in an SSH Shell Session

Demonstrates running a command with sudo in a shell session without an interactive prompt. sudo -S reads the password from stdin and -p "" suppresses the prompt, so piping the password in with echo runs the command as root with no interaction.

Security note: The password appears in the command line, so it may be visible in the remote host's process list and shell history. A passwordless sudo rule for the specific command is preferable where it can be arranged.

Background: This is the scripted alternative to the interactive su approach: rather than waiting for a password prompt and answering it, the password is supplied up front so no terminal interaction is needed. Because QuickShell allocates a PTY, the shell echoes back everything sent to it, which is what motivates the quoting trick on the final marker — writing echo THIS 'IS' THE END means the echoed command line contains the quotes while the real output does not, so matching the unquoted text matches actual output rather than the echo.

Chilkat Lua Downloads

Download Chilkat for Lua

Lua

local chilkat = require("chilkat")

-- This example requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

-- Demonstrates running a command with "sudo" in a shell session, supplying the password without
-- an interactive prompt.

local ssh = chilkat.Ssh.new()

local port = 22
local success = ssh:connect("ssh.example.com", port)
if not success then
    print(ssh.last_error_text)
    return
end

-- Normally you would not hard-code the password in source.  You should instead obtain it
-- from an interactive prompt, environment variable, or a secrets vault.
local password = "mySshPassword"

success = ssh:authenticate_pw("mySshLogin", password)
if not success then
    print(ssh.last_error_text)
    return
end

-- Start a shell session.  QuickShell allocates a PTY, so the shell echoes the commands sent
-- to it and prints a prompt.
local channelNum = ssh:quick_shell()
if channelNum < 0 then
    print(ssh.last_error_text)
    return
end

-- Build the command.  "sudo -S" makes sudo read the password from stdin, and "-p" sets the
-- prompt -- setting it to an empty string removes the prompt entirely.  Piping the password in
-- via "echo" therefore runs the command as root with no interaction.
--
-- Security note: the password appears in the command line, so it can be visible in the remote
-- host's process list and shell history.  Prefer a passwordless sudo rule where possible.
local sbCommands = chilkat.StringBuilder.new()
sbCommands:append("echo \"")
sbCommands:append(password)
sbCommands:append("\" | sudo -S -p \"\" ls\n")

-- The final command echoes a marker used to detect the end of the output.  The single quotes
-- around 'IS' are a trick: the terminal echo of the typed command includes the quotes, while
-- the command's actual output does not.  Matching the unquoted form therefore matches the real
-- output rather than the echo.
sbCommands:append("echo THIS 'IS' THE END OF THE SCRIPT\n")

local commands = sbCommands:get_as_string()
success = ssh:channel_send_string(channelNum, commands, "utf-8")
if not success then
    print(ssh.last_error_text)
    return
end

-- No more commands will be sent.
success = ssh:channel_send_eof(channelNum)
if not success then
    print(ssh.last_error_text)
    return
end

-- IMPORTANT: Set a read timeout before receiving until a match.  ReadTimeoutMs defaults to 0,
-- which means no limit -- without it, this call waits forever if the received data never
-- contains a match.
ssh.read_timeout_ms = 15000

local caseSensitive = true
success = ssh:channel_receive_until_match(channelNum, "THIS IS THE END OF THE SCRIPT", "utf-8", caseSensitive)
if not success then
    print(ssh.last_error_text)
    return
end

-- Close the channel only after the desired output has been received.
success = ssh:channel_send_close(channelNum)
if not success then
    print(ssh.last_error_text)
    return
end

success = ssh:channel_receive_to_close(channelNum)
if not success then
    print(ssh.last_error_text)
    return
end

local sessionOutput = ssh:get_received_text(channelNum, "utf-8")
if not ssh.last_method_success then
    print(ssh.last_error_text)
    return
end

print("--- output ----")
print(sessionOutput)

ssh:disconnect()