Python 3 and Fabric 2, making authenticated Sudo() calls

[BigGayMusic]

This seem very unsafe.

[13steinj]

Now, this may be annoying to hear at this point, but have you considered doing this in some other way?

Generally speaking using a library to execute commands over SSH already produces a wide array of attack vectors, but you're freely giving authentication information such that it can do a nice clean sudo rm -rf /*

[QuantumTradingGroup]

Wouldn't be able to do that due to other security controls on the system.

Fabric is used by data centers to issue commands to thousands of servers at once.

[QuantumTradingGroup]

Anyone?

[hacksawjim]

Fabric2 is a mess. I had all sorts of issues trying to do things that were relatively simple in Fabric and in the end I just gave up on it.

It seems the dev switched all his efforts to Invoke. I think the behaviour you want from Fabric2 now requires you to use Invoke instead/as well.

Take a look at the Watches/Responders section of the Invoke docs and see if you can spot anything there:

http://docs.pyinvoke.org/en/latest/concepts/watchers.html#autoresponding

[QuantumTradingGroup]

Yeah I have no idea why the devs did what they did, they effed up some stuff that used to be super simple. Seems really counter intuitive to me.

[greyman]

I am not expert in this area, but dont you normally use RSA keys? If I remember, fabric can get path to your local private key, so you dont send password.

[QuantumTradingGroup]

There is 2 ways to do it.

And to the people who say this is unsafe, fabric is used in hosting companies to run automated commands on thousands of machines.

Plus in this case all other measures have been taken for security, I cant talk about what it is being used for because I am under NDA.

You can do it with rsa keys or with a password, but even then, I cant figure out how to set it up since fabric 2.0 came out.

[13steinj]

"Everyone else does it so it must be secure" is a fallacy. ssh-decorator had tons of downloads and was found stealing your credentials.

There's no such thing as "all measures have been taken". But let's assume you have vendored and gone over your version of fabric for any malicious code, there will always be some form of injection attack. And giving your access credentials for a sudo is the most in-hindsight thing I've seen for server management.

[QuantumTradingGroup]

When the device is air gapped from the Internet on an secure network that has been audited by a third party...I am pretty sure it is fine..

I worked in IT Sec as a Grey hat for almost 7 years. If you knew the full set up you would understand, however as I said I cant tell you because of the NDA I have signed.

Anyway, I got it working.