How to change password on multiple hosts (can use ssh)

[Tech Geek]

Hi,

We have about 125 Linux(RH)/Unix(Solaris) servers and to be in line with the
security policy we have to change our password every 90 days. How can I
change the password on all the server in an automated fashion....I can use
ssh. Please help me with options.

Thanks in advance.

[Unruh]

Post by Tech Geek
Hi,
We have about 125 Linux(RH)/Unix(Solaris) servers and to be in line with the
security policy we have to change our password every 90 days. How can I
change the password on all the server in an automated fashion....I can use
ssh. Please help me with options.

Well, that is what YPi/NIS is for-- a central repository of passwords.
Alternatively you could have a script copy the password file and shadow
files between the machines.

[Tech Geek]

Post by Unruh

Post by Tech Geek
Hi,
We have about 125 Linux(RH)/Unix(Solaris) servers and to be in line with the
security policy we have to change our password every 90 days. How can I
change the password on all the server in an automated fashion....I can use
ssh. Please help me with options.

Well, that is what YPi/NIS is for-- a central repository of passwords.
Alternatively you could have a script copy the password file and shadow
files between the machines.

Thanks for the response and information. Not sure why we didn't implement
NIS...I will check this out. As regards copying the password file and
shadow files...doesn't it require root access. I haven't done this (I am
not a Sys Admin!).,...will this approach allow copying over the shadow file
entries only for one user? Will it be possible to help me some more
additional information on this approach. Appreciate your time and help with
this.

[Scott Lurndal]

Post by Tech Geek
Hi,
We have about 125 Linux(RH)/Unix(Solaris) servers and to be in line with the
security policy we have to change our password every 90 days. How can I
change the password on all the server in an automated fashion....I can use
ssh. Please help me with options.
Thanks in advance.

Wouldn't it be easier to use NIS+, LDAP or even AD?

scott

[Tech Geek]

Post by Scott Lurndal

Post by Tech Geek
Hi,
We have about 125 Linux(RH)/Unix(Solaris) servers and to be in line with the
security policy we have to change our password every 90 days. How can I
change the password on all the server in an automated fashion....I can use
ssh. Please help me with options.
Thanks in advance.

Wouldn't it be easier to use NIS+, LDAP or even AD?
scott

Scott,

thanks for he response....we did try LDAP but couldn't be implemented
successfully because of apparent conflicts the cluster software is having
with the existence of LDAP. We had to disable LDAP to allow the cluster
software to work. We have been working with the vendors but we haven't
gotten a working resolution yet.

Thanks again.

[Keith Keller]

["Followup-To:" header set to comp.os.linux.admin.]

Post by Tech Geek
thanks for he response....we did try LDAP but couldn't be implemented
successfully because of apparent conflicts the cluster software is having
with the existence of LDAP. We had to disable LDAP to allow the cluster
software to work. We have been working with the vendors but we haven't
gotten a working resolution yet.

That sounds pretty unbelievable. Software should not be interacting
with the authentication mechanisms directly, so LDAP or no LDAP should
make no difference.

One thought occurs to me: are the compute nodes on the cluster on their
own private switch? If so they likely can't get to the LDAP server.
One potential way around this would be to make the head node an LDAP
slave, and configure the compute nodes to get their LDAP information
from the head node instead of the master LDAP server.

Other folks suggested NIS. Unless your network is firewalled well, and
your internal users are trusted, NIS is a security nightmare. LDAP will
serve much better.

--keith

[Ted Linnell]

Post by Tech Geek
Hi,
We have about 125 Linux(RH)/Unix(Solaris) servers and to be in line with the
security policy we have to change our password every 90 days. How can I
change the password on all the server in an automated fashion....I can use
ssh. Please help me with options.
Thanks in advance.

At a place I used to work, had about 800 - 900 servers I had to be
able to logon to and was required to change my password regularly.

One of the other guys wrote an expect script to do this.
Supplied the script with a list of servers, userid, old password and
new password and it connected to each server in the list and changed
the password.

Client would not even consider using NIS+ or LDAP, which is a much
better option.

Ted.
==============================================================
| Ted Linnell <***@acslink.net.au> |
| |
| Nunawading, Victoria , Australia |
==============================================================

[Tech Geek]

Post by Ted Linnell

Post by Tech Geek
Hi,
We have about 125 Linux(RH)/Unix(Solaris) servers and to be in line with the
security policy we have to change our password every 90 days. How can I
change the password on all the server in an automated fashion....I can use
ssh. Please help me with options.
Thanks in advance.

At a place I used to work, had about 800 - 900 servers I had to be
able to logon to and was required to change my password regularly.
One of the other guys wrote an expect script to do this.
Supplied the script with a list of servers, userid, old password and
new password and it connected to each server in the list and changed
the password.
Client would not even consider using NIS+ or LDAP, which is a much
better option.
Ted.
==============================================================
| |
| Nunawading, Victoria , Australia |
==============================================================

Ted,

thanks for the response and information. In fact, I am looking for a similar
thing and as such I am attempting to get the script to work, but it's
happening for me. I am not able to figure out a way to pass on the password
in an automated fashion in response to the prompts made by ssh.

for example:

ssh <node_name> ...this prompts for the password, I am not able to provide
it in a silient way.

Any thoughts, ideas would be greatly appreciated.

Thanks

[anonymous]

Post by Tech Geek
Hi,
We have about 125 Linux(RH)/Unix(Solaris) servers and to be in line with
the security policy we have to change our password every 90 days. How
can I change the password on all the server in an automated fashion....I
can use ssh. Please help me with options.
Thanks in advance.

centrify.com
i heard about them through a tech convention and realized this could be
an amazing administrative tool. it is designed for an AD domain system
so if you are running your domain with linux/unix only this will
probably not solve the problem.

[Jim Haynes]

Post by Tech Geek
Hi,
We have about 125 Linux(RH)/Unix(Solaris) servers and to be in line with
the security policy we have to change our password every 90 days. How
can I change the password on all the server in an automated fashion....I
can use ssh. Please help me with options.
Thanks in advance.

Kerberos

[unruh]

Post by anonymous

Post by Tech Geek
Hi,
We have about 125 Linux(RH)/Unix(Solaris) servers and to be in line with
the security policy we have to change our password every 90 days. How
can I change the password on all the server in an automated fashion....I
can use ssh. Please help me with options.
Thanks in advance.

centrify.com
i heard about them through a tech convention and realized this could be
an amazing administrative tool. it is designed for an AD domain system
so if you are running your domain with linux/unix only this will
probably not solve the problem.

ARe you the sysadmin or a user?
If a user:
1) persuade the sysadmins to institute NIS.
2) write a script
#!/bin/bash
OLDPASS=$1
NEWPASS=$2
for i in `cat ~\hostnames`
do

ssh $i passwd <<EOF
$OLDPASS
$NEWPASS
$NEWPASS
EOF
done

where ~/hostnames contains the hostnames of all the computers you want
tochange the password on.
Note this is somewhat dangerous as the old and new passwords will be
visible to someone doing a ps -auxww
You could have the script ask for the old and new passwords at the
beginning instead etc, but you get the idea

Also I have not tested this so am not sure about the input feeding to
passwd with te <<EOF on the remote machine

You had better make sure that the passwd does not reject the password or
you could be stuck in an awkward situtation.