Path: csiph.com!usenet.pasdenom.info!dedibox.gegeweb.org!gegeweb.eu!nntpfeed.proxad.net!proxad.net!feeder1-2.proxad.net!usenet-fr.net!nerim.net!novso.com!newsfeed.xs4all.nl!newsfeed1.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail Return-Path: X-Original-To: python-list@python.org Delivered-To: python-list@mail.python.org X-Spam-Status: OK 0.044 X-Spam-Evidence: '*H*': 0.91; '*S*': 0.00; 'string': 0.09; 'cc:addr :python-list': 0.11; 'suggest': 0.14; '10:00': 0.16; 'command.': 0.16; 'fiddle': 0.16; 'from:addr:rosuav': 0.16; 'from:name:chris angelico': 0.16; 'reconfigure': 0.16; 'sane': 0.16; 'sees': 0.16; 'sudo': 0.16; 'wrote:': 0.18; 'wed,': 0.18; 'slightly': 0.19; 'thu,': 0.19; 'entered': 0.20; 'work,': 0.20; 'command': 0.22; '>>>': 0.22; 'memory': 0.22; 'separate': 0.22; 'cc:addr:python.org': 0.22; 'cc:2**0': 0.24; 'asking': 0.27; 'header:In-Reply-To:1': 0.27; 'am,': 0.29; 'tim': 0.29; 'message- id:@mail.gmail.com': 0.30; '(maybe': 0.31; 'run': 0.32; 'actual': 0.34; 'received:google.com': 0.35; 'should': 0.36; 'wrong': 0.37; 'so,': 0.37; 'remote': 0.38; 'nov': 0.38; 'whatever': 0.38; 'does': 0.39; 'how': 0.40; 'even': 0.60; 'read': 0.60; 'around.': 0.60; 'most': 0.60; 'first': 0.61; 'back': 0.62; "you'll": 0.62; 'guarantee': 0.63; 'skip:n 10': 0.64; '26,': 0.68; '2014,': 0.84; 'end.': 0.84; 'safer': 0.84; 'streams': 0.84; 'to:none': 0.92 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:cc :content-type; bh=p/G8bWqQpem27A5opkaNAE2hs22ToEM1aLKcN0BxiIs=; b=fpMLzX01iRhNPmJvWtzNHCs1lZjAGk2/ssKc5pz2VDu7Am2QAv2PpB+YzwNFoxtH0J cSkn9+VK1Tpg4wDA6y9AwN0B1iEhFT6I2+Nk6mgZ1kfBkCFsOhoCg4o+M9GMz4Onk6wP 7EiN/vUPuyRmUnevI8HVKg37DJDKf10iXFXb6XB8DqN6N0ncxLAvBIQSfMzTvTtfWsoS p/KsLxu+YS+sObezxVDatC37YBjrqu7+SbfscWpz9BegHE0l/Efmjvxd18SbwukAN26C i6y7vvFK0UDID1th6cqScFemP985yRTLxSneZIidArMXK1XC0oP5T/4P87DIsNM+9D6b LhbA== MIME-Version: 1.0 X-Received: by 10.42.106.12 with SMTP id x12mr34533002ico.26.1417018439882; Wed, 26 Nov 2014 08:13:59 -0800 (PST) In-Reply-To: <5475F9B1.3050407@tundraware.com> References: <54756D5F.4040806@tundraware.com> <20141126082606.281ff681@bigbox.christie.dr> <5475F38F.5010501@tundraware.com> <5475F7F2.4020901@tundraware.com> <5475F9B1.3050407@tundraware.com> Date: Thu, 27 Nov 2014 03:13:59 +1100 Subject: Re: Quotation Ugliness From: Chris Angelico Cc: "python-list@python.org" Content-Type: text/plain; charset=UTF-8 X-BeenThere: python-list@python.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: General discussion list for the Python programming language List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Newsgroups: comp.lang.python Message-ID: Lines: 29 NNTP-Posting-Host: 2001:888:2000:d::a6 X-Trace: 1417018453 news.xs4all.nl 2967 [2001:888:2000:d::a6]:43326 X-Complaints-To: abuse@xs4all.nl Xref: csiph.com comp.lang.python:81596 On Thu, Nov 27, 2014 at 3:02 AM, Tim Daneliuk wrote: > On 11/26/2014 10:00 AM, random832@fastmail.us wrote: >> >> On Wed, Nov 26, 2014, at 10:55, Tim Daneliuk wrote: >>> >>> Nope. Password only exist in memory locally. >> >> >> How does it send it to the remote sudo? >> > > Over paramiko transport (ssh) and then only if it sees a custom > string coming back from sudo asking for the pw. So, it does get sent on stdin to whatever program is on the other end. I would suggest a slightly safer approach: Instead of allowing a password to be entered at the sudo prompt, first run "sudo -v" (maybe -S as well to have it read stdin), which should be a self-contained "prompt for sudo password" command. Then have the actual command run as "sudo -n" for non-interactive mode. With most sane sudo setups, that should work, and it'll guarantee (as long as your I/O streams are separate for the separate programs) that the password will never be sent to the wrong program. Even so, I think your setup is pretty fragile. You'll do far better to reconfigure sudo than to try to fiddle all this around. ChrisA