31

Is there an option to put the password on the line as well with sftp?

linux~ $ sftp USERNAME@FTP.WEBSITE.COM:/DIRECTORY_TO_GO_TO/

Like this

linux~ $ sftp USERNAME@FTP.WEBSITE.COM:/DIRECTORY_TO_GO_TO/ -p PASSWORD?
Daniel
  • 3,801

7 Answers7

61

As others have mentioned, a command-line password should be the last resort.

However, if nothing else is possible; one can go for ssh pass

sshpass -p <password> sftp user@host
Yogesh Nachnani
  • 711
  • 5
    This should be massively upvoted. It is really useful to have sshpass. Some providers don't allow you to create a .ssh folder and scp is also disallowed. – NetSquirrel Jul 05 '13 at 01:38
  • 3
    good that some tools have your back: brew search sshpass -- "We won't add sshpass because it makes it too easy for novice SSH users to ruin SSH's security." – oliver Apr 04 '17 at 09:22
  • 9
    This should be the accepted solution. The OP asked how to do this specific thing - not for security advice (albeit well-intentioned and correct). – ebr Jun 08 '17 at 20:33
  • Thank you so much for this. I need to have a docker container upload a file to an sftp server using a CICD pipeline (concourseci, call actions take place in containers). The password is stored in hashicorp vault. This allows me to add the password as an environment variable to the container, i can mount the file I need to upload, and then call the password as part of the sshpass command string. – Matthew Jul 16 '21 at 19:34
  • 1
    The better option would be to use SSHPASS="MY_PASSWORD" sshpass -e sftp user@host this prevents the password to be visible for other user by looking into ps -axf – meles Aug 20 '21 at 15:48
  • 1
    Further, if you must enter a password on the command line, if you use bash include a space in export HISTIGNORE=' ...' and prefix your command by a single space so it isn't captured in your history file. – David C. Rankin Sep 17 '21 at 06:31
  • permission denied (publickey) – jzadra Nov 22 '22 at 23:39
15

Generally including a password in a command line is considered a security risk because it will show up to anyone else who can run ps/top, and it may be saved in your shell's history.

It would be a much better idea to setup key-based authentication if you are able.

Also, I don't believe it is going to be possible with sftp. It is meant to be used for secure transfers. If you really had to do something like this and you have no other choice then you probably need to be looking at automating with expect.

Márton Tamás
  • 129
Zoredache
  • 131,987
7

Just use perl, ruby or python to script what you are trying to do. In case of ruby it's just (taken from the net-sftp API docs):

require 'net/sftp'

Net::SFTP.start('host', 'username', :password => 'password') do |sftp|

  # upload a file or directory to the remote host

  sftp.upload!("/path/to/local", "/path/to/remote")

end

For more info http://net-ssh.rubyforge.org/sftp/v2/api/index.html

7ochem
  • 280
monomyth
  • 971
4

Don't do that - setup SSH public key authentication for automatic login.

MikeyB
  • 39,673
2

As the other answers have stated, use public key authentication. There is a great, although a little dated, IBM developerWorks series that should explain everything you want to know about it, as well as some useful supplemental tools such as keychain.

rvf
  • 1,605
2

For searchers that don't care that the password can be seen in the command-line command:

sftp userid:password@remoteHost is how to include the password in the sftp connect command.

UPDATE: this turned out to be incorrect... see comments

ashnazg
  • 129
  • OpenSSH v5.3p1 and v4.3p2, both on Red Hat Enterprise... – ashnazg Dec 13 '18 at 15:06
  • 1
    This turned out to be incorrect... this method appeared to work for me because PHP and its ssh2 extension were being used earlier in my code to do actual standalone authentication... and the sftp command was being run later. It was this later piece where the syntax appeared to succeed. – ashnazg Dec 13 '18 at 15:25
  • 1
    Could not resolve hostname user: No such host is known. It is considering ":" in username which is not the case in FileZilla CLI – P Satish Patro Jun 04 '19 at 15:10
1

I suspect that there are as many answers as there are FTP clients. An SFTP server should not accept authentication information until encryption is established, so that the user and password are protected.

I believe the FileZilla client will allow for command line passing of the user and password .. see the documentation here. Given the reputation of the FileZilla project, I would expect it to operate securely.

tomjedrz
  • 5,974