Shell scripts that respond to console output

shellshell-scriptsubversion

Disclaimer:: I am not an active shell scripter

How does one create a script that responds to console output? For instance, I'm trying to setup a cron that periodically svnsync 's changes to my repository to a backup server every midnight. The problem is, in order to sync, it prompts for authorization credentials.

svnsync sync accepts no options to specify a login thus a simple cron command is out. I believe I can launch a script but I'm trying to figure out how to make it respond to console output.

For instance:

ken@server:~$ svnsync sync https://svn3.backup.net/svn/mirror
Authentication realm: <https://svn3.backup.net/svn/mirror:443> backup.net Subversion Backup
Password for 'ken':
***<send return key>***
Username:***<specify backup.net username>***
Password for '<the name>':***<specify password for username>***
<It proceeds to check out>

where ***< message >*** is the action I want the script to respond to.

Best Answer

I was in doubt when you said "svnsync sync accepts no options to specify a login" so I checked the documentation and guess what, it does:

--source-password
--source-username
--sync-password
--sync-username

Those options should be enough for you to go back to a simple cron script.

Back into the case where you really can't specify such options, it is still easy to write a wrapper script that sends data to the program's stdin. For example the following may work (where program is the program you wan to run, and text is a file where you store text to be sent to the program):

program < text

However, for authentication, programs are often written to ready from tty and not from stdin (for security reasons). I'm not familiar with it, but you can still create a fake terminal in that case. This is where expect comes into use.

Related Solutions

Shell – How to output file & ignoring lines that start with “?”

You can express those conditions using regular expressions and use grep to filter the results based on those.

The first one is ^?. The carat is a special character that represents the beginning of a line; so that expression matches the beginning of the line immediately followed by a ?.

The second one is ^ *\*. The * is a special character that qualifies the preceding character - it means the preceding character may appear zero or more times. Since * is a special character, the one you're looking for needs to be escaped, hence, \*. So that expression will match the beginning of a line followed by zero or more spaces, followed by an asterisk.

For your first condition, use the -v option for grep to negate the results.

So finally,

svn status --show-updates | grep -v '^?'

svn status --show-updates | grep '^ *\*'

Regular expressions are very powerful, so many Unix tools can use them. They are very much worth learning. There is a great tutorial at regular-expressions.info.

Disable svn plaintext password storage for all users

You can't.

Whatever you do, your users can bypass it and store their password in a plain text file anyway. If you disable the feature in the client binary, they'll download or compile a different client. As a rule, if you set up obnoxious security measures (such as having to type a password for every svn operation), your users will bypass them in a way that makes security worse. (For example, writing a wrapper script that contains their password. Which they'll leave world-readable.) So don't do that.

To reiterate: you cannot, by technical measures alone, prevent users from storing their password in a file. You can forbid it, but if it makes their life difficult, they'll do it anyway.

If you're concerned about laptop or backup theft, encrypt the users' home directory. This will protect the passwords as well as the data. If the whole home directory is encrypted, the encryption password is usually the same as the login password, for usability reasons. Be sure to have a password backup policy (e.g. a sealed envelope), since losing an encryption password is irrecoverable.

If you're concerned about password reuse, impose a random (hence unique) password, which they will type once and for all into their client. Have a simple process for changing compromised passwords, of course.

Best Answer

Related Solutions

Shell – How to output file & ignoring lines that start with “?”

Disable svn plaintext password storage for all users

Related Question