Passwords in ssh and sftp are sent encrypted, so the password cannot be sniffed by moitoring your transmissions. You cannot say the same for ftp, telnet or http.
As someone pointed out, you can often arrange that two given accounts can use sftp without passwords; I do this quite a bit. Another approach that I use is to use the expect(1) package. You install it on one machine, and use it to automate just about any command-line activity, including sending passwords. The expect script that you wind up with may have the password in the clear, but you keep it protected in your own account. If it's using sftp, for instance, then the password is protected by the sftp protocols. Expect is marvellously useful for automating all sorts of things that were not written with automation in mind. I hope this helps. ++ kevin On Tue, 22 Feb 2005 09:10:09 -0500, Dave Nebinger <[EMAIL PROTECTED]> wrote: > > I think you're right. Does this mean anyone could easily intercept my > > login and password and log in as me? > > The basic answer for this is "yes". Definitely your password could be > intercepted and used by others. > > But consider for a minute what is involved with that... > > Someone floating out there on the net would have to be intercepting packets. > And the packets that you're sending would need to flow over the same path to > the endpoint (not guaranteed by IP). And they would need to be able to > filter the mass of packets going by their system to get the one(s) with your > password information. And they would initially have to identify a need to > get your password in order to target your packets for capture. > > Granted all of this is indeed doable, but IMHO it's like looking for a > particular atom in a haystack, let alone the needle... > > > -- > [email protected] mailing list > > -- Go back to the top: I almost always top-post Kevin O'Gorman, PhD -- [email protected] mailing list
