Using sudo in an SSH Shell Session

See more SSH Examples

Demonstrates running a command with sudo in a shell session without an interactive prompt. sudo -S reads the password from stdin and -p "" suppresses the prompt, so piping the password in with echo runs the command as root with no interaction.

Security note: The password appears in the command line, so it may be visible in the remote host's process list and shell history. A passwordless sudo rule for the specific command is preferable where it can be arranged.

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @iTmp0 int
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @success int
    SELECT @success = 0

    --  This example requires the Chilkat API to have been previously unlocked.
    --  See Global Unlock Sample for sample code.

    --  Demonstrates running a command with "sudo" in a shell session, supplying the password without
    --  an interactive prompt.

    DECLARE @ssh int
    EXEC @hr = sp_OACreate 'Chilkat.Ssh', @ssh OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    DECLARE @port int
    SELECT @port = 22
    EXEC sp_OAMethod @ssh, 'Connect', @success OUT, 'ssh.example.com', @port
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @ssh, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ssh
        RETURN
      END

    --  Normally you would not hard-code the password in source.  You should instead obtain it
    --  from an interactive prompt, environment variable, or a secrets vault.
    DECLARE @password nvarchar(4000)
    SELECT @password = 'mySshPassword'

    EXEC sp_OAMethod @ssh, 'AuthenticatePw', @success OUT, 'mySshLogin', @password
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @ssh, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ssh
        RETURN
      END

    --  Start a shell session.  QuickShell allocates a PTY, so the shell echoes the commands sent
    --  to it and prints a prompt.
    DECLARE @channelNum int
    EXEC sp_OAMethod @ssh, 'QuickShell', @channelNum OUT
    IF @channelNum < 0
      BEGIN
        EXEC sp_OAGetProperty @ssh, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ssh
        RETURN
      END

    --  Build the command.  "sudo -S" makes sudo read the password from stdin, and "-p" sets the
    --  prompt -- setting it to an empty string removes the prompt entirely.  Piping the password in
    --  via "echo" therefore runs the command as root with no interaction.
    --  
    --  Security note: the password appears in the command line, so it can be visible in the remote
    --  host's process list and shell history.  Prefer a passwordless sudo rule where possible.
    DECLARE @sbCommands int
    EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sbCommands OUT

    EXEC sp_OAMethod @sbCommands, 'Append', @success OUT, 'echo "'
    EXEC sp_OAMethod @sbCommands, 'Append', @success OUT, @password
    EXEC sp_OAMethod @sbCommands, 'Append', @success OUT, '" | sudo -S -p "" ls' + CHAR(10)

    --  The final command echoes a marker used to detect the end of the output.  The single quotes
    --  around 'IS' are a trick: the terminal echo of the typed command includes the quotes, while
    --  the command's actual output does not.  Matching the unquoted form therefore matches the real
    --  output rather than the echo.
    EXEC sp_OAMethod @sbCommands, 'Append', @success OUT, 'echo THIS ''IS'' THE END OF THE SCRIPT' + CHAR(10)

    DECLARE @commands nvarchar(4000)
    EXEC sp_OAMethod @sbCommands, 'GetAsString', @commands OUT
    EXEC sp_OAMethod @ssh, 'ChannelSendString', @success OUT, @channelNum, @commands, 'utf-8'
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @ssh, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ssh
        EXEC @hr = sp_OADestroy @sbCommands
        RETURN
      END

    --  No more commands will be sent.
    EXEC sp_OAMethod @ssh, 'ChannelSendEof', @success OUT, @channelNum
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @ssh, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ssh
        EXEC @hr = sp_OADestroy @sbCommands
        RETURN
      END

    --  IMPORTANT: Set a read timeout before receiving until a match.  ReadTimeoutMs defaults to 0,
    --  which means no limit -- without it, this call waits forever if the received data never
    --  contains a match.
    EXEC sp_OASetProperty @ssh, 'ReadTimeoutMs', 15000

    DECLARE @caseSensitive int
    SELECT @caseSensitive = 1
    EXEC sp_OAMethod @ssh, 'ChannelReceiveUntilMatch', @success OUT, @channelNum, 'THIS IS THE END OF THE SCRIPT', 'utf-8', @caseSensitive
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @ssh, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ssh
        EXEC @hr = sp_OADestroy @sbCommands
        RETURN
      END

    --  Close the channel only after the desired output has been received.
    EXEC sp_OAMethod @ssh, 'ChannelSendClose', @success OUT, @channelNum
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @ssh, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ssh
        EXEC @hr = sp_OADestroy @sbCommands
        RETURN
      END

    EXEC sp_OAMethod @ssh, 'ChannelReceiveToClose', @success OUT, @channelNum
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @ssh, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ssh
        EXEC @hr = sp_OADestroy @sbCommands
        RETURN
      END

    DECLARE @sessionOutput nvarchar(4000)
    EXEC sp_OAMethod @ssh, 'GetReceivedText', @sessionOutput OUT, @channelNum, 'utf-8'
    EXEC sp_OAGetProperty @ssh, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 = 0
      BEGIN
        EXEC sp_OAGetProperty @ssh, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ssh
        EXEC @hr = sp_OADestroy @sbCommands
        RETURN
      END

    PRINT '--- output ----'

    PRINT @sessionOutput

    EXEC sp_OAMethod @ssh, 'Disconnect', NULL

    EXEC @hr = sp_OADestroy @ssh
    EXEC @hr = sp_OADestroy @sbCommands


END
GO