How to use with google-authenticator?

[dr-br]

I want to use pdsh in conjunction with Google Authenticator PAM module. All remote servers have the same TOTP secret. How to pass the TOTP value?
Currently, one askpass window per remote server is opened, which is annoying, if there are many of these.

[grondo]

I do not think there is an easy way to do what you want with the current design of pdsh.
If we supported libssh, then perhaps pdsh could ask once for a password, under the assumption the password is the same on all hosts. But currently, pdsh invokes an ssh subprocess for each host, and there isn't a good, secure way to pass a password to each of these ssh processes except via the standard ssh-askpass utility.

If it is possible, switch to SSH keys.

If it is impossible to use SSH keys in this instance, the only other idea I would have would be to create a custom program that implements the askpass protocol, but only asks once per pdsh invocation, returning the same answer on each subsequent run without prompting the user. It might be that you'd have to store the password in pdsh itself (you could implement a pdsh module for this) to make sure different pdsh invocations didn't reuse a password.

Even if you did that, it might be prone to error since you do not know how long pdsh is going to take to contact all hosts, and a time-based password could expire in the interim.

[dr-br]

Thanks for the response. In fact, we intend to use SSH keys and TOTP together. I already (very briefly) tried expect + pdsh, no success. Another tool which I tried was cssh. Here, the TOTP part works. However, cssh is not a suitable replacement for pdsh (node count >>100)...

[watson6282]

For times where ssh keys are not allowed, but a password is, I've used the following script to do something like this. It does mean your password is stored in a file for as long as the pdsh is running, but the permissions are set so only you and root can read it, which is sufficient for some people.

#!/bin/bash

IFS=$'\n' read -rsp "Password: " password
echo >&2
if [[ -z $password ]]; then
    echo "no password" >&2
    exit 1
fi
printf -v password %q "$password"

password_script=
trap '[[ -n $password ]] && rm -f $password_script' EXIT

password_script=`mktemp`
if [[ $? != 0 || -z $password_script ]]; then
    echo "failed to create a file for the password script" >&2
    exit 1
fi

chmod 700 $password_script
cat > $password_script << EOM
#!/bin/bash
printf "%s\n" $password
EOM

export DISPLAY=
export SSH_ASKPASS=$password_script

pdsh "$@"