Copy a file in more than 20 nodes through script

[Vishu]

Hi Gurus,

Greetings!!!

My server running HP-UX 11.23. SSH allowed but not with root. NO rhosts file, so no rlogin.

Now i want to copy a file from one server to around 23 servers at /itback folder owned by root. I also dont have my key saved for SSH in all those servers.

So, kindly help me with the script to do this.

Thanks
Vishu

[Steven Schweda]

> [...] SSH allowed but not with root. NO
> rhosts file, so no rlogin.

What else can't you do? NFS? CIFS? Telnet?

> [...] I also dont have my key saved for SSH
> in all those servers.

Perhaps you'll need to remove one of these
restrictions before you can do what you want
to do. My psychic powers are too weak to
tell me what you're willing to change.

> So, kindly help me with the script to do
> this.

It's hard to help with a script if I don't
know which command(s) I can use in it. You
could use a "for" loop to run through a list
of the remote system names. Then you'll need
to use some command(s) to copy the file.

[melvyn burnard]

Have you looked at using DSAU?
http://bizsupport2.austin.hp.com/bc/docs/support/SupportManual/c01920477/c01920477.pdf

[Vishu]

Hi Steven,

We normally use to SSH to server with our local ids and then sudo to root.

I can use 'for' loop for list of systems, but then i dont know how to proceed, because if i run ssh command in loop, it will take me to the server and then do i have to manually run the scp command and chmod command to change its permissions to 755 or it can also be done with the help of loop???

Please help in it.

Thanks

[Jayakrishnan G Naik]

Hi

I would recommend to copy ssh key to all the systems which will really make things simpler for such copy, and other common activities to be done on all these nodes.


Once this is through you can do copy using simple for - do - done loop.


You can copy all the server names to a file, one server name per line and run the following commands.

for i in `cat filename`; do copy ; done

Thanks & Regards
Jayakrishnan G Naik

[Vishu]

Hi,

if i login to copy SSH key to all servers, then i can copy that file also to them. Any idea with current setup?

[Doug O'Leary · Accepted solution]

Hey;

The right answer is to enable public key access to root by setting

PermitRootLogin without-password

in sshd_config, restarting sshd, then distributing your key as needed. There are other things needed to make direct root login via ssh/pka a more preferred method of root access over sudo; however, that's a different topic.

In your current environment:

for h in $(cat ${list-o-hosts})
do
echo ${h}
scp ${file} ${admin}@${h}:/tmp/${file}
ssh -l ${admin} ${h} sudo mv /tmp/${file} ${dir}/${file}
ssh -l ${admin} ${h} sudo chown root:sys ${dir}/${file}
ssh -l ${admin} ${h} sudo chmod 755 ${dir}/${file}
done

The first time you access each host, you'll need to type your password. You could run the above w/o password entries if you run the loop within 5 minutes of looping through all the hosts to run a sudo command

for h in $(cat ${list-o-hosts})
do
ssh -l ${admin} ${h} sudo ls -ld /tmp
done

If you have your password in a cut/paste buffer you can simply paste it as quickly as it's requested, then run the first loop within 5 minutes.

Like I said, though, the right answer is to lock direct root access to public key authentication.

The other required items are ensure each key allowed to access root uses a forced command to log whatever it's doing via remote commands and log key fingerprints via

SyslogFacility Auth
LogLevel VERBOSE

Doug

[Vishu]

Hi Doug,

Really appreciate your help on this!!!

But we only have permission to do "sudo su -" in the sudoers file. i think those commands will not execute with sudo, if they don't exist in sudoers file...correct me if i m wrong..

[Doug O'Leary]

Hey;

You are quite correct. Sounds like you all have some squirrelly configurations that should really be rethought.

That configuration pretty much successfully prohibits any ability to script what you're trying to do - unless you're familiar with perl and the expect module. Writing in that for a one time transfer is a bit overkill.

It'd be easier to do the transfers manually.

It'd be better long term to enable direct ssh/pka access to root providing the other steps described previously are also taken.

If you're allowed to do sudo su -, then reconfiguring sudo to say

%admin ALL=(ALL) ALL

would be less better than the ssh/pka; however, it would, at least, allow you to run the loop described previously.

Doug

[Bill Hassell]

Your security restrictions have not been properly thought through. You can hire more sysadmins and have each of them login to the remote systems to pull the file(s). Or you can change the sudoers file on each system to allow scp. Since each of the remote systems has a big security hole (sudoers allows su -), you can go to each system and list root's public key. Then add it to your distribution server's .ssh/authorized_keys file. Now each of the remote systems can use scp to pull the file.

Note that scp is by far the simplest way to pull the file. Be sure to use scp -p to preserve the permissions.

[Vishu]

Hi All,

thanks for your help. I can't change my environment because this is how client want it to be. So no probs. i will do it manually then if there is no other way.

Anyways, thanks again for your help.

vishu