title: How to securley pass Password as Argument to a Python Script over SSH?
body: <p>I have a python script that creates a linux user, given a username and password as arguments. I want to </p>
  
  <ul>
  <li>call the script directly (e.g, <code>./pass.py</code>)</li>
  <li>call the script on the same VM from
  python (e.g, <code>subprocess.Popen('/pass.py')</code>)</li>
  <li>call the script from a different VM from python over
  SSH. (e.g, <code>subprocess.Popen(['ssh', 'host', 'pass.py')</code>)</li>
  </ul>
  
  <p><strong>TL;DR Check the final code snippit and question</strong></p>
  
  <p><code>getpass</code> works for the first case.</p>
  
  <pre><code>password = getpass.getpass()
  </code></pre>
  
  <p>However, if I run this over ssh, (<code>ssh myhost /path/to/script.py username</code>) I get the following output:</p>
  
  <pre><code>/usr/lib64/python2.6/getpass.py:83: GetPassWarning: Can not control echo on the terminal.
    passwd = fallback_getpass(prompt, stream)
  Warning: Password input may be echoed.
  Password: password123
  </code></pre>
  
  <p>Also, if I run this script in python using <code>subprocess</code>:</p>
  
  <pre><code># Running from same host
  proc = subprocess.Popen(['./pass.py'], stdin=subprocess.PIPE)
  # Running from different host
  proc = subprocess.Popen(['ssh', 'myhost', '/path/to/pass.py', 'username'], stdin=subprocess.PIPE)
  </code></pre>
  
  <p>It seems to hang around <code>subprocess.Popen</code> and won't accept the password.</p>
  
  <p>However, if I get rid of <code>getpass.getpass()</code> and replace it with <code>raw_input</code>, it works for cases 2 and 3. It doesn't echo the password.</p>
  
  <p>I am therefore thinking of the following instead, which takes <code>--script</code> as an argument and asks for the password via <code>raw_input</code>:</p>
  
  <pre><code>import sys, getpass, argparse
  parser = argparse.ArgumentParser()
  parser.add_argument("username")
  parser.add_argument("-s", "--script", action="store_true")
  args = parser.parse_args()
  username = args.username
  if args.script:
      password = raw_input("Password: ")
  else:
      password = getpass.getpass()
  </code></pre>
  
  <p>This satisfies all three of my cases and does not appear to be echoing the password.</p>
  
  <p>Am I correct in assuming that this is safe and the password won't get logged?</p>