Sudo via SSH with password passing, tty is not required:
You can use sudo on top of ssh without forcing ssh to have a pseudo -t (without using the ssh "-t" switch), telling sudo not to require an interactive password and just get the password from standard input. This can be done using the "-S" switch on sudo. This causes sudo to listen on the password in stdin and stop listening when it sees a new line.
Example 1. A simple remote command
In this example, we send a simple whoami :
$ ssh user@server cat \| sudo --prompt="" -S -- whoami << EOF > <remote_sudo_password> root
We tell sudo not to issue an invitation and accept it from stdin. This makes sending the sudo password completely silent, so the only answer you get is the output from whoami .
The advantage of this method is that you can run programs through sudo via ssh, which themselves require stdin. This is because sudo uses the password in the first line of standard input, and then allows any program in which it runs to continue capturing standard input.
Example 2 - A remote command that requires its own standard input
In the following example, the remote "cat" command is executed via sudo, and we provide several additional lines via stdin to be displayed by the remote cat.
$ ssh user@server cat \| sudo --prompt="" -S -- "cat" << EOF > <remote_sudo_password> > Extra line1 > Extra line2 > EOF Extra line1 Extra line2
The output demonstrates that the string <remote_sudo_password> used by sudo, and that the remotely executed cat displays additional lines.
An example of where this might be useful is if you want to use ssh to pass the password to the privileged command without using the command line. Say if you want to mount a remote encrypted container on top of ssh.
Example 3. Mounting a VeraCrypt Remote Container
In this sample script, we remotely mount the VeraCrypt container via sudo without any additional help text:
#!/bin/sh ssh user@server cat \| sudo --prompt="" -S -- "veracrypt --non-interactive --stdin --keyfiles=/path/to/test.key /path/to/test.img /mnt/mountpoint" << EOF SudoPassword VeraCryptContainerPassword EOF
It should be noted that in all the above command line examples (everything except the script), the << EOF construct on the command line will lead to writing everything typed, including the password, to the local .bash_history computer. Therefore, it is highly recommended that you use either completely, through a script, as in the example with veracrypt above, or, if on the command line, put the password in a file and redirect this file through ssh.
Example 1a - Example 1 without a local command line password
Thus, the first example would be:
$ cat text_file_with_sudo_password | ssh user@server cat \| sudo --prompt="" -S -- whoami root
Example 2a - Example 2 without a local command line password
and a second example would be:
$ cat text_file_with_sudo_password - << EOF | ssh va1der.net cat \| sudo --prompt="" -S -- cat > Extra line1 > Extra line2 > EOF Extra line1 Extra line2
It is not necessary to put the password in a separate file if you put all this into a script, since the contents of the scripts do not fall into your history. However, this can be useful if you want to allow users who do not see the password to execute the script.