Previous | Contents | Index | Next

Chapter 7: Using the command-line connection tool Plink



7.1 Starting Plink





7.2 Using Plink



Plink: command-line connection utility
Release 0.73
  -V        print version information and exit
  -pgpfp    print PGP key fingerprints and exit
  -v        show verbose messages
  -load sessname  Load settings from saved session
  -ssh -telnet -rlogin -raw -serial
            force use of a particular protocol
  -P port   connect to specified port
  -l user   connect with specified username
  -batch    disable all interactive prompts
  -proxycmd command
            use 'command' as local proxy
            Specify the serial configuration (serial only)
The following options only apply to SSH connections:
  -pw passw login with specified password
  -D [listen-IP:]listen-port
            Dynamic SOCKS-based port forwarding
  -L [listen-IP:]listen-port:host:port
            Forward local port to remote address
  -R [listen-IP:]listen-port:host:port
            Forward remote port to local address
  -X -x     enable / disable X11 forwarding
  -A -a     enable / disable agent forwarding
  -t -T     enable / disable pty allocation
  -1 -2     force use of particular protocol version
  -4 -6     force use of IPv4 or IPv6
  -C        enable compression
  -i key    private key file for user authentication
  -noagent  disable use of Pageant
  -agent    enable use of Pageant
  -noshare  disable use of connection sharing
  -share    enable use of connection sharing
  -hostkey aa:bb:cc:...
            manually specify a host key (may be repeated)
  -sanitise-stderr, -sanitise-stdout, -no-sanitise-stderr, -no-sanitise-stdout
            do/don't strip control chars from standard output/error
  -no-antispoof   omit anti-spoofing prompt after authentication
  -m file   read remote command(s) from file
  -nc host:port
            open tunnel in place of session (SSH-2 only)
  -sshlog file
  -sshrawlog file
            log protocol details to a file
            test whether a connection-sharing upstream exists

Once this works, you are ready to use Plink.

7.2.1 Using Plink for interactive logins



Debian GNU/Linux 2.2
flunky login:



Z:\sysosd>plink -ssh
login as:


Z:\sysosd>plink my-ssh-session
Sent username "fred"
Authenticating with public key "fred@winbox"


7.2.2 Using Plink for automated connections





To avoid being prompted for a user name, you can:



hello, world



Z:\sysosd>plink mysession echo hello, world
hello, world



7.2.3 Plink command line options






(This option is only meaningful with the SSH-2 protocol.) -share: Test and try to share an existing connection.

This option tris to detect if an existing connection can be shared (See section 4.19.5 for more information about SSH connection sharing.) and reuses that connection.

A Plink invocation of the form:

plink -share <session>

will test whether there is currently a viable ‘upstream’ for the session in question, which can be specified using any syntax you'd normally use with Plink to make an actual connection (a host/port number, a bare saved session name, -load, etc). If no ‘upstream’ viable session is found and -share is specified, this connection will be become the ‘upstream’ connection for subsequent connection sharing tries.

(This option is only meaningful with the SSH-2 protocol.) -shareexists: test for connection-sharing upstream

This option does not make a new connection; instead it allows testing for the presence of an existing connection that can be shared. (See section 4.19.5 for more information about SSH connection sharing.)

A Plink invocation of the form:

plink -shareexists <session>

will test whether there is currently a viable ‘upstream’ for the session in question, which can be specified using any syntax you'd normally use with Plink to make an actual connection (a host/port number, a bare saved session name, -load, etc). It returns a zero exit status if a usable ‘upstream’ exists, nonzero otherwise.

(This option is only meaningful with the SSH-2 protocol.) -sanitise-stream: control output sanitisation

In some situations, Plink applies a sanitisation pass to the output received from the server, to strip out control characters such as backspace and the escape character.

The idea of this is to prevent remote processes from sending confusing escape sequences through the standard error channel when Plink is being used as a transport for something like git or CVS. If the server actually wants to send an error message, it will probably be plain text; if the server abuses that channel to try to write over unexpected parts of your terminal display, Plink will try to stop it.

By default, this only happens for output channels which are sent to a Windows console device, or a Unix terminal device. (Any output stream going somewhere else is likely to be needed by an 8-bit protocol and must not be tampered with at all.) It also stops happening if you tell Plink to allocate a remote pseudo-terminal (see section and section 4.25.1), on the basis that in that situation you often want escape sequences from the server to go to your terminal.

But in case Plink guesses wrong about whether you want this sanitisation, you can override it in either direction, using one of these options:

Sanitise server data written to Plink's standard error channel, regardless of terminals and consoles and remote ptys.
Do not sanitise server data written to Plink's standard error channel.
Sanitise server data written to Plink's standard output channel.
Do not sanitise server data written to Plink's standard output channel. : turn off authentication spoofing protection prompt

In SSH, some possible server authentication methods require user input (for example, password authentication, or entering a private key passphrase), and others do not (e.g. a private key held in Pageant).

If you use Plink to run an interactive login session, and if Plink authenticates without needing any user interaction, and if the server is malicious or compromised, it could try to trick you into giving it authentication data that should not go to the server (such as your private key passphrase), by sending what looks like one of Plink's local prompts, as if Plink had not already authenticated.

To protect against this, Plink's default policy is to finish the authentication phase with a final trivial prompt looking like this:

Access granted. Press Return to begin session.

so that if you saw anything that looked like an authentication prompt after that line, you would know it was not from Plink.

That extra interactive step is inconvenient. So Plink will turn it off in as many situations as it can:

But if you still find the protective prompt inconvenient, and you trust the server not to try a trick like this, you can turn it off using the ‘-no-antispoof’ option.

7.3 Using Plink in batch files and scripts


plink root@myserver /etc/backups/




7.4 Using Plink with CVS


set CVS_RSH=\path\to\plink.exe


You should then be able to run CVS as follows:




7.5 Using Plink with WinCVS





or (if you're using a saved session):




[PuTTY release 0.73]