1

I would like to make shortcuts for gvfs mounts (I prefer to mount from the shell). For this, it is quite necessary/convenient not to have to enter the password for the ftp:// and sftp:// connections . Currently the only way I know is:

echo 12345 | gvfs-mount sftp://[email protected]/

Even though I can make the file's rights 700 (or even 100), I'm not sure if it's reasonably safe. Is it worse than .netrc items? I know about ssh-copy-id, but I can't access shell on most of my sftp servers.

Is there a better (standard) alternative to my approach? What do nautilus/caja do when they store the passwords?

Improve this question

2 Answers 2

Reset to default
2

I'm just like you, I like to mount/umount my filesystems from the command line.

About the stdin option

I'm not sure if it's reasonably safe. Is it worse than .netrc items?

You should be aware that on many systems, process names and command line arguments are visible to all users. In Linux for example, do grep -a . /proc/*/cmdline to see them all.

That said, in some shells including bash, echo is a built-in command so there's no process launched.

So, as far as I know, it should be no worse than .netrc. Double check your file permissions in any case.

SFTP

You can have gvfs-mount sftp://somehost/somepath work without a password. (I just tested this successfully.)

The recommended solution is to use key-based authentication, not store any password anywhere.

For example, see authentication - How can I set up password-less SSH login? - Ask Ubuntu and Easiest way to copy ssh keys to another machine? - Ask Ubuntu (it's written for Ubuntu but works the same for other Unices).

I know about ssh-copy-id, but I can't access shell on most of my sftp servers.

ssh-copy-id is just a handy shortcut. You don't need shell access to set key-based authentication, but you do need access to your home dir.

If you can access you files interactively with SFTP, you can most probably set up ~/.ssh/ and ~/.ssh/authorized_keys, unless the administrator carefully prevented this, but that would be shooting in their feet. Actually the admin should encourage users to set up key based authentication. Check what's the policy with them.

If you just need to set up only one key you just have to copy your public (not private) key file generated above (possibly ~/.ssh/id_rsa.pub) to a remote file in directory .ssh named authorized_keys and set permission 600 (read-write for you, nothing for others).

FTP

Regarding ftp urls, the traditional answer is to use a ~/.netrc as explained e.g. on https://askubuntu.com/a/359802/68124 .

Alas, it works very well with a zillion ftp clients, old and new, including curlftpfs, but (on Ubuntu 14.04 at least) gvfsmount ignores it.

Perhaps curlftpfs would suit your use case. The main difference is that you choose your mount point instead of having gvfs-mount compute one.

curlftpfs ftp://host/ ~/mymountpoint

SFTP, again

If you like the curlftpfs option, you may consider for your sftp urls,

sshfs host:/some/remote/path ~/myothermountpoint

And if wonder whether sshfs needs shell access, Wikipedia says: The client interacts with the remote file system via the SSH File Transfer Protocol (SFTP),[2]

A final word: for tools that need an explicit mount point, think to create an empty dir first at the correct path. And if you're trying several times or change options, remember to fusermount -u somepath to umount before trying to mount again.

Improve this answer
4
  • Thanks for a nice answer. Unfortunately it doesn't work for me. The problem of accessing shell has a lot to do with my restricted access to the system, I can basically access only webpage root, and I can't add arbitrary files even there. Commented Jun 8, 2014 at 20:18
  • Hum, thanks for the feedback. The situation is a little silly. If this happened to me, I would write them a request (as a bug or suggestion for improvement) to enable key-based authentication and be open for alternative providers. Commented Jun 8, 2014 at 20:29
  • Sorry to disturb you, but the idea that you can suggest such things to any sysadmin you have to deal with is a bit crazy... Commented Jun 8, 2014 at 20:31
  • I don't know your setup, if it is your university, your work, a public service provider, whatever. I can't guess its sanity. Anyway back to your first question, if you have no choice don't worry too much about the "echo mypassword | gvfs-mount". Commented Jun 8, 2014 at 20:40
1

You could use something like expect to provide the credentials each time you want to connect. It's not super secure but gives you what you want.

#!/usr/local/bin/expect -- set timeout -1 spawn gvfs-mount {args} expect "User" send "joe\n" expect "Password:" send "xxxxx\n" expect eof

Source: gvfs-mount specify username password

Improve this answer
1
  • Thanks, looks better than sending the password no matter if it's asked for. And thanks for the spawn, expect, send combination. I'll look into that tomorrow. Commented Apr 1, 2014 at 7:17

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.