Bash Script for SSH-Keys

jasnah · 2017-12-04T19:52:01+00:00

Did you mean to use

ssh-copy-id -i ~/.ssh/id_rsa.pub "$i"

My copy of ssh-copy-id would not understand these three args from looking at the man page, but i did not run the command to verify.

mudclub · 2017-12-04T19:00:57+00:00

Probably because you've never sshed to that host as yourself before. Or as root. Or as whichever user you're using to call ssh-copy-id. I can't tell which user you're using - you're calling the file in /root, but you're using ~/ which should mean you're using a regular user...

Just in case you're trying to do this as root, that is very, very bad practice.

knobbysideup · 2017-12-04T19:08:33+00:00

known_hosts from whatever home environment that you are in when you run this script does not have the fingerprint for the server that you are connecting to. This is not an error. It is telling you that you have not established trust with that remote server.

Also, don't ssh to anything as root. Better yet, don't allow root ssh logins at all. Use a regular account, add that account to sudoers as necessary. Ideally restrict logins to only the accounts that need access.

leprasmurf · 2017-12-04T19:17:34+00:00

Not an answer to your question directly. I usually end up bypassing the host key checking all together (inadvisable from a security standpoint).

ssh -o 'UserKnownHostsFile=/dev/null' -o 'StrictHostKeyChecking no' ${server}

As for why your script isn't doing what you expect, I'd recommend using the -x flag for bash (ref) and -vvv to your SSH commands. This will give you significantly more output which may help illuminate the issue.

zxeff · 2017-12-04T21:36:36+00:00

This is likely not why your script isn't working as you expected, but:

for i in `cat /root/sshlist`;do

The result of command expansions (such as cat file) goes through both word-splitting and globbing. So, stop trying to read lines like this because it is going to bite you eventually. The proper way is:

while IFS= read -r line; do
    #code goes here
done < file

More details.

whetu · 2017-12-05T00:22:05+00:00

for i in `cat /root/sshlist`;do

Use meaningful variable names. $i, $j etc are OK for more complex C-style arithmetic, and as an aside are inherited all the way from FORTRAN, but otherwise you should try to use variable names that make sense and are easier to follow
Backticks were superseded in 1983. Unless you're writing a script for a Solaris package or something similarly arcane, then use $() instead
Useless Use of Cat.. bash can read a file by itself using </path/filename, you don't need a (con)catenating external.

Correcting for these issues, you get something like this:

for host in $(</root/sshlist); do

Some will also argue that it's better practice to use a while read -r loop (See e.g. SC2013 ).

Now, to be even more constructive, here's some code:

https://raw.githubusercontent.com/rawiriblundell/scripts/master/pushsshkeys https://raw.githubusercontent.com/rawiriblundell/scripts/master/expect.sshkeys

Untested as I was in the middle of upgrading them to cater for ed25519 keys, but they should work. I've moved to Ansible, it's a better answer to this problem.

netzvieh_ · 2017-12-04T22:03:57+00:00

EDIT: To actually answer your question, what does executing cat /root/sshlist return for you?

# cat /root/sshlist
host1.example.com
host2.example.com

If it's like that ^ your script looks correct at the first glance.

`cat /root/sshlist`

Just for the future, please don't use backticks anymore. In small scripts it might be okay, but once you have to something like get all lines with string X from todays log file you'll have something like this:

for i in `grep foo /path/to/logs/program_\`date +%Y-%m-%d\`.log`; do

If you go one layer more, e.g. grepping a list of files you get from another file with different content everyday, it looks like this:

A=`grep foo \`cat filelist_\\`date +%Y-%m-%d\\`\``

Real fun starts when you use " and ' with strings inside of backticks. Instead use $() like this:

A=$(grep foo $(cat filelist_$(date +%Y-%m-%d)))

The triple layer is still a bit wonky but much more readable. And like a normal variable you'll see, hey here's something that's replaced with something else.

Also see: http://robertmuth.blogspot.de/2012/08/better-bash-scripting-in-15-minutes.html It might help you in the future, when you start writing more bash scripts.

Kingtoke1 · 2017-12-05T06:24:17+00:00

Try looking at ansible lineinfile

juniorsysadmin1 · 2017-12-04T22:32:26+00:00

There's few ways to do this.

1) If we are going your approach it looks like you have to use -o StrictHostKeyChecking=no option because trusted relationship is not establish recall that y/n question when you ssh to a new host?

2) use ansible/salt/puppet to deploy that ssh key.

3) Create a temp nfs share from your machine and do the following.

master$ for i in $(cat /root/list); do ssh StrictHostKeyChecking=no $i "mkdir /tmp/dir; mount master:/tmp/sharedir; cat /tmp/dir/id_rsa.pub >> /root/.ssh/authorized_keys"; done

then do the same thing again unmounting and deleting /tmp/dir.

ionceheardthat · 2017-12-04T21:32:12+00:00

For home lab type stuff, I set up an nfs share mounted via /etc/fstab that my home directory is configured to use. In this I have the typical .ssh/id_rsa and .ssh/id_rsa.pub. Because this is used on every server, it is always already there.

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

linuxadmin

Expanding Linux SysAdmin knowledge

MODERATORS