scripted ssh should not ask for a password if public key authentication fails

Question

Here is my use case: I have a script that lists through hundreds of servers and tests whether or not they allow logins using public key authentication using a specific private key (in the ssh client's .ssh directory). Some of these servers were misconfigured, and I do not have control over the SSH service on any of these servers.

Here is what I have so far:

ssh -o ConnectTimeout=2 -o PasswordAuthentication=no -q $x exit
returncode=$?

So this works so far for most servers (i.e., returns a non-zero return code when a server is unreachable, and 0 when the server can be logged-in to), until some troublesome server fails due to some SSH misconfiguration (ex. ~/.ssh on the remote server has an incorrect permission. Here is a related thread describing what can be done in such case.

But i don't want to fix the remote servers. I just want SSH to fail and exit with a non-zero return code if SSH key authentication fails.

Any ideas how to get around this?

Thanks in advance.

Answer 1

You can use timeout in addition to limit ssh's runtime:

timeout 10 ssh -o ConnectTimeout=2 -o PasswordAuthentication=no -q $x exit returncode=$?

or

timeout --preserve-status 10 ssh -o ConnectTimeout=2 -o PasswordAuthentication=no -q $x exit returncode=$?

Be sure to choose a good timeout. 2 seconds ConnectTimeout plus 8 seconds for running exit sould be enough; even on high load.

Answer 2

As per suggestion,

ssh has a -o batchmode=yes option that will prevent any interaction.

• no password asked

• no confirmation for foreign signature

This will result in error code if no connection is make.