Auto-storing server host key in cache with plink

Question

I've been trying to issue commands using plink to retrieve information from my external server. Note that these plink commands are run from a binary that expects no input from the user. Is there a flag that will allow me to override this error message and continue with program output?

The server's host key is not cached in the registry. You
have no guarantee that the server is the computer you
think it is.
The server's rsa2 key fingerprint is:
ssh-rsa 2048 **:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**
If you trust this host, enter "y" to add the key to
PuTTY's cache and carry on connecting.
If you want to carry on connecting just once, without
adding the key to the cache, enter "n".
If you do not trust this host, press Return to abandon the
connection.
Store key in cache? (y/n)

Thank you!

Solution 1

Try prepending your script with:

echo y | plink -ssh root@REMOTE_IP_HERE "exit"

This will pipe the y character through stdin to plink when you get the Store key in cache? (y/n) prompt, allowing all further plink commands to pass through without the need of user input. The exit command will close the SSH session after it has been established, allowing the following plink commands to run.

Here's an example script which writes the external server's Unix time to a local file:

echo y | plink -ssh root@REMOTE_IP_HERE "exit"
plink -ssh root@REMOTE_IP_HERE "date -t" > remote_time.tmp

Pipelining Reference: http://tldp.org/HOWTO/Bash-Prog-Intro-HOWTO-4.html

Solution 2

The accepted is answer is "acceptable", but unsecure. The best way would be to specify host key to plink to prevent any Man-In-the-Middle attack.

plink -hostkey aa:bb:cc... root@REMOTE_IP_HERE [...]

Solution 3

PuTTY and plink.exe share the same cache of 'acceptable server keys' on the host they are installed on.

So if your scenario is interactive (and hence your frustration not being heard when you press 'y' or 'n'), a workaround is to attempt a connection with PuTTY first.

When doing this:

• You'll open PuTTY and pretend to start an interactive SSH session to the server
• You'll get a Windows dialog box showing the key asking if you want to trust it
• You'll check the presented key, to ward of MITM's, then press OK
• Henceforth, plink.exe won't bother to ask if you trust the server or not - it already knows you do

Comments

[andrybak]

The real issue is that either git doesn't properly give away input to plink or vice versa plink doesn't properly take it. If you launch git clone in, e.g. "git bash", the input (Y/n) goes then into bash prompt, and bash usually responds with bash: y: command not found.

[mckenzm]

If you are using the -batch switch, you should do an initial interactive plink logon (without that switch) to set this up and respond to the prompt. Yes, as another answer suggests this can be automated, but it is only required once.

[Nathan]

-auto_store_sshkey is an "unknown option" for plink version 0.63

[Gerrat]

...and unknown to 0,70

[David Bullock]

That's a good idea, if you want your calling application (say) to manage the 'trust chain'. Sometimes, we don't want to build this infrastructure ourselves, and we're happy to let plink.exe/PuTTY show the server's fingerprint for our review, and let it remember our 'Y' decision for later attempts. In this case, plink.exe is being invoked interactively by the user, but it won't read the user's interactive 'y' or 'n' key. Hence the accepted answer is a workaround to tell plink.exe/PuTTY, "yes, that is the one, please do remember it for me".

[David Bullock]

I had to write this down because I forgot ... again. I've solved this at least 3 times in the last 10 years :-\ (this last time was my quickest!) A couple of years ago I found a really good answer on SO and saw at the end ... to my surprise ... I'd written it years before!

[IndustryUser1942]

...and unknown to 0.73

[ghost]

...and unknown to 0.74