ENT-14418: Added --ask-pass, --password-file and --switch-user-command options

[nickanderson]

cf-remote can now switch user on hosts where sudo asks for a password, prompting for it once with --ask-pass or reading it from a file with --password-file, so passwordless sudo is no longer a requirement. --switch-user-command replaces the hardcoded sudo bash -c.

🤖 Generated with Claude Code

[larsewi]

🚀

[larsewi]

Warning Use communicate() rather than .stdin.write, .stdout.read or .stderr.read to avoid deadlocks due to any of the other OS pipe buffers filling up and blocking the child process.

• Ref. https://docs.python.org/3/library/subprocess.html#subprocess.Popen.stderr

Is this what you are referring to?

[nickanderson]

Yes, that's the warning. The reasoning Claude wrote was that our payload (a password) is far smaller than the pipe buffer, so the write can't block — but that argument only holds as long as nobody sends anything bigger, so I've stopped making it. _popen() now only opens the pipe and communicate(input=...) does the writing, in cd4fa30.

The one wrinkle is that _Task.communicate() polls with a short timeout, and communicate() raises ValueError: Cannot send input after starting communication if a later call hands it the same input again. It remembers what the first call gave it and keeps writing from where it left off, so only the first call passes it (and a retried process gets a fresh one, so the flag resets). tests/test_aramid.py::test_input_is_only_handed_over_once covers that — it fails with that ValueError if the flag goes away.

[larsewi]

I don't love these "mutable" globals. Can you achieve the same with function parameters?

[nickanderson]

Done — they're gone. There's a SwitchUser object now, built once in main.py from the options and passed down as a switch_user= parameter to the connections it applies to. All the consumers (ssh_sudo, the hint, the "does this host want a password" check) already had a connection in hand, so they read connection.switch_user instead of module state.

The plumbing follows what users already does: auto_connect reads switch_user to make the connection with, and a connection that's handed in already carries its own.

[larsewi]

Maybe you should run this with debug to make sure it's not leaked in logs either?

[nickanderson]

Good idea, done. That case runs with --log-level debug now, and there's a second debug case on the host where the password is sent, since that's where a leak would come from. Both grep the whole output for it, and assert [DEBUG] is present so the check can't silently pass on a non-debug run.