First time passwordless ssh automation
Passwordless ssh setup for one or two servers will be OK to do in the traditional way, where you enter password for the first time. If it comes to many server, it'll be cumbersome.
This is the same thing happened to one of my friend, where she has to do over 50 servers for her important work. She was entering password manually.
This is the same thing happened to one of my friend, where she has to do over 50 servers for her important work. She was entering password manually.
I wanted to avoid manual entry of password and finally I came across "expect" scripting. By this you can do passwordless ssh without entering it manually.
There could be two scenario, one you have the same password in all the servers/nodes or different password in each server/node. If you want to do many, just have a masterfile with servers/nodes and password and you can loop thru this.
As you can easily write a wrapper loop script, I'm just providing what is required. I'm new to expect script and in the process of enhancing the code.
--------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------
One time or optional
rm -rf /root/.ssh/id_rsa
ssh-keygen -q -f /root/.ssh/id_rsa -N ''
Add your remote servername to known_hosts as ssh-keyscan doesnt have option of -o
sed -i /^"<servername>/d >> /root/.ssh/known_hosts 2>&1
ssh-keyscan -t rsa <servername> 2>&1 >> /root/.ssh/known_hosts
Have the below in a separate file.
#!/usr/bin/expect
# This script pushes the key to the remote host. ssh-copy-id doesn't check for duplication, so displaying an message also in the script.
set host [lrange $argv 0 0]
set pass [lrange $argv 1 1]
set timeout -1
spawn ssh-copy-id -i /root/.ssh/id_rsa.pub root@$host
match_max 100000
# Looking for all possible string. Options might change in your environment
expect {
"password" {
send -- "$pass\r"
send -- "\r"
sleep 1
send_user " Ssh key copied to $host\n"
send_user " **** Check for duplication entry in $host:/root/.ssh/authorized_keys ****\n"
}
"$host's" {
send_user " Ssh key copied to $host\n"
send_user " **** Check for duplication entry in $host:/root/.ssh/authorized_keys ****\n"
}
"Password:*" {
send -- "$pass\r"
send -- "\r"
sleep 1
send_user " Ssh key copied to $host\n"
send_user " **** Check for duplication entry in $host:/root/.ssh/authorized_keys ****\n"
}
"machine" {
sleep 1
send_user " Ssh key copied to $host\n"
send_user " **** Check for duplication entry in $host:/root/.ssh/authorized_keys ****\n"
}
}
interact
rm -rf /root/.ssh/id_rsa
ssh-keygen -q -f /root/.ssh/id_rsa -N ''
--------------------------------------------------------------------------------------------------------------------------
Add your remote servername to known_hosts as ssh-keyscan doesnt have option of -o
sed -i /^"<servername>/d >> /root/.ssh/known_hosts 2>&1
ssh-keyscan -t rsa <servername> 2>&1 >> /root/.ssh/known_hosts
--------------------------------------------------------------------------------------------------------------------------
Have the below in a separate file.
#!/usr/bin/expect
# This script pushes the key to the remote host. ssh-copy-id doesn't check for duplication, so displaying an message also in the script.
set host [lrange $argv 0 0]
set pass [lrange $argv 1 1]
set timeout -1
spawn ssh-copy-id -i /root/.ssh/id_rsa.pub root@$host
match_max 100000
# Looking for all possible string. Options might change in your environment
expect {
"password" {
send -- "$pass\r"
send -- "\r"
sleep 1
send_user " Ssh key copied to $host\n"
send_user " **** Check for duplication entry in $host:/root/.ssh/authorized_keys ****\n"
}
"$host's" {
send_user " Ssh key copied to $host\n"
send_user " **** Check for duplication entry in $host:/root/.ssh/authorized_keys ****\n"
}
"Password:*" {
send -- "$pass\r"
send -- "\r"
sleep 1
send_user " Ssh key copied to $host\n"
send_user " **** Check for duplication entry in $host:/root/.ssh/authorized_keys ****\n"
}
"machine" {
sleep 1
send_user " Ssh key copied to $host\n"
send_user " **** Check for duplication entry in $host:/root/.ssh/authorized_keys ****\n"
}
}
interact
In case if your expect script fails, try to troubleshoot thru expect debugger "expect -d <script>"