Complete Guide to Running SFTP Commands with Password in Bash Scripts

Problem Context and Challenges

In automated operations and system management, file transfer functionality through scripts is frequently required. SFTP (Secure File Transfer Protocol), as an extension of SSH, provides secure file transfer capabilities. However, in scenarios where SSH key authentication cannot be used, running SFTP commands with password authentication in Bash scripts presents significant technical challenges.

Core Solution: sshpass Tool

sshpass is a tool specifically designed for automated SSH password authentication, capable of passing passwords to SSH client programs through standard input or environment variables. Here's a complete example of using sshpass for SFTP password authentication:

#!/bin/bash
# Set environment variable for password
export SSHPASS="your-password-here"

# Execute SFTP command using sshpass
sshpass -e sftp -oBatchMode=no -b - sftp-user@remote-host << EOF
cd incoming
put your-log-file.log
bye
EOF

# Clear password from environment variable
unset SSHPASS

Key technical aspects of this script include:

• Setting password via export SSHPASS environment variable
• Using sshpass -e parameter to read password from environment
• -oBatchMode=no option ensures password authentication is not disabled
• Using here document (<< EOF) to provide SFTP command sequence

Technical Details Deep Dive

Batch Mode and Password Authentication Compatibility

SFTP's batch mode (-b parameter) typically disables password prompts by default, conflicting with password authentication requirements. The solution is to explicitly enable password authentication using the -oBatchMode=no option:

sshpass -e sftp -o BatchMode=no -o PubkeyAuthentication=no -b - user@hostname

Critical configuration elements:

• -o BatchMode=no: Allows password authentication in batch mode
• -o PubkeyAuthentication=no: Disables public key authentication, forcing password use
• -b -: Reads batch commands from standard input

Security Best Practices

Using passwords in scripts presents security risks. Implement these measures:

#!/bin/bash
# Read password from secure storage
PASSWORD_FILE="/path/to/secure/password/file"

if [[ -f "$PASSWORD_FILE" ]]; then
    export SSHPASS=$(cat "$PASSWORD_FILE")
    # Set strict file permissions: chmod 600 /path/to/secure/password/file
else
    echo "Password file does not exist or is inaccessible"
    exit 1
fi

# Execute SFTP transfer
sshpass -e sftp -o BatchMode=no -b - user@hostname << EOF
cd /remote/directory
put local-file.txt
ls -l
bye
EOF

# Immediately clear password from memory
unset SSHPASS

Alternative Approaches Comparison

expect Tool Solution

expect is a Tcl-based automation tool that can simulate user input:

#!/usr/bin/expect

spawn sftp username@hostname.com
expect "password:"
send "yourpasswordhere\n"
expect "sftp>"
send "cd logdirectory\n"
expect "sftp>"
send "put /var/log/file.log\n"
expect "sftp>"
send "exit\n"
interact

Advantages: Powerful functionality, handles complex interaction scenarios. Disadvantages: Requires additional installation, higher code complexity, lower security.

lftp Tool Solution

lftp is a feature-rich file transfer program supporting multiple protocols:

#!/bin/bash
export LFTP_PASSWORD="your-password"
lftp --env-password sftp://user@host -e "put local-file.name; bye"
# Clear password
export LFTP_PASSWORD=""

Advantages: Concise syntax, supports advanced features like mirroring. Disadvantages: Password may appear in process lists.

Production Environment Deployment Recommendations

Cron Job Integration

Integrating SFTP scripts into cron jobs requires special attention:

# In crontab configuration
# Execute file transfer daily at 2 AM
0 2 * * * /home/user/sftp-transfer.sh >> /var/log/sftp-transfer.log 2>&1

Error Handling and Logging

Robust error handling mechanisms are crucial for production environments:

#!/bin/bash

LOG_FILE="/var/log/sftp-transfer.log"
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')

echo "[$TIMESTAMP] Starting SFTP transfer" >> "$LOG_FILE"

# Set password
export SSHPASS="${SFTP_PASSWORD}"

# Execute SFTP command and capture output
if sshpass -e sftp -o BatchMode=no -b - user@hostname << EOF 2>&1 | tee -a "$LOG_FILE"
cd /incoming
put /local/path/file.log
bye
EOF
then
    echo "[$TIMESTAMP] SFTP transfer successful" >> "$LOG_FILE"
else
    echo "[$TIMESTAMP] SFTP transfer failed" >> "$LOG_FILE"
    exit 1
fi

# Cleanup
unset SSHPASS

Security Considerations and Limitations

While the methods described address automated SFTP transfer needs, it's essential to recognize:

• Password storage and transmission in scripts present security risks
• Passwords in environment variables may be readable by other user processes
• SSH key authentication remains the more secure long-term solution
• Consider using password management tools like Vault for enhanced security

Conclusion

Through the sshpass tool combined with appropriate SFTP configuration, automated file transfer with password authentication can be achieved in Bash scripts. While not the most secure solution, it provides a viable alternative in special scenarios where SSH keys cannot be used. In practical applications, the most suitable implementation should be chosen based on specific security requirements and environmental constraints, always adhering to the principle of least privilege and security best practices.