Hacker News Reader

Comment by justin66 | Hacker News Reader

> Having used both, I'd say the security focus of OpenBSD means it's often lacking consistency and "polish".

I wonder why you think so. I've only ever used OpenBSD and NetBSD on PCs and Unix workstations. I have never, ever, in any domain found NetBSD to have more "polish" than OpenBSD.

From the initial installation where OpenBSD helps you with everything and NetBSD, well, doesn't, to reading and using documentation (OpenBSD's man pages are the best around, with the possible oddball exception of some old Open Group pages which include code examples), OpenBSD seems to be miles ahead.

So I just wonder what you're talking about specifically.

View on HN

ssh has persistently gotten more and more annoying to use over the years especially with it's non-sensical error messages when it's checking file permissions.

It is simply bad design to keep adding un-toggleable "security" mechanisms, like being unable to directly script password logins and the like.

Why would you ever script password logons? You should be using key-based authentication...

Someone hands me a list of servers, user accounts and passwords to get a bunch of files from.

This is a standard task which comes up all the damn time in any level of sysadmin work. I'm never going to connect to these machines again, and can't get anyone to cooperate about them. Which means, I'm going to need to feed that list to ssh or rsync with password authentication.

Your current options to do this are jump through ridiculous hoops with expect, or switch to something else entirely (like paramiko, which is awesome but doesn't solve the rsync case cleanly).

Yet all this could be solved by just having a damn --read-password-from prompt which would do it automatically. It would also be nice to have --skip-permissions-checks (and actual error messages which specified which permissions, on what file, are missing rather then current silent failure).

Which I think I'm going to code up for the next time I end up doing something like this (probably alongside "use JSON for remote rsync file specifications").

Ansible can do this, using sshpass (and openSSH).

Under the hood SSHpass is just an expect-like wrapper for ssh. The entire login is still dependent on a non-protocol bit of text parsing.

Reply on news.ycombinator.com