Capturing stdout of an interactive process that prompts for a password

[dansimau]

Hi there,

I want to use python-sh to run the following shell equivalent:

$ aws --profile=myprofile ec2 describe-instances >/tmp/instances.json
Enter MFA code: 
$

In the example above, the aws command is a Python process that uses getpass.unix_getpass under the hood. When the user enters their password, it sets echo mode off on the TTY so that the password is not visible.

(The "Enter MFA code" is output to stderr and the password is read from stdin but the characters are not echoed.)

Here is my attempt to do this using python-sh:

aws(_in=sys.stdin, _err=sys.stderr, _out="/tmp/instances.json", "--profile", "myprofile", "ec2", "describe-instances")

However, this results in:

/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/getpass.py:86: GetPassWarning: Can not control echo on the terminal.
  passwd = fallback_getpass(prompt, stream)
Warning: Password input may be echoed.
Enter MFA code: 

Indeed, the password is echoed. The line that fails in getpass.py is when TTY options are being set using termios.tcsetattr. The error is:

(25, 'Inappropriate ioctl for device')

I can eliminate this problem by setting _fg=True:

aws(_fg=True, _out="/tmp/instances.json", "--profile", "myprofile", "ec2", "describe-instances")

However, then stdout is not captured.

Is there a way to work around this?

[hartmans]

I think you're running into #514. A quick and very dirty work around is something like:

aws(_in = os.dup(0), _out="/tmp/instances.json", "--profile", "myprofile", "ec2", "describe-instances")

That is the issue is that sh mis-handles file descriptor 0.
Clearly, you want to do something cleaner and actually close the newly duplicated copy of stdin.

[amoffat]

I was able to reproduce the issue and confirmed that 1e15190 fixes it. Thanks to @hartmans for spotting it. The fix will be on the next release.