Create A Bash Script To Change Root Password For A List

Create A Bash Script For Changing Root Password For List Of Serversinp

Create a bash script that reads a list of server addresses from a file, prompts for the initial user1 password, the current root password, and the new root password, then loops through each server to log in as user1, switches to root, changes the root password, and reports success or failure for each server.

Paper For Above instruction

This paper presents a comprehensive solution for automating the process of changing root passwords across multiple servers using a Bash script. In an environment where multiple servers are managed, manual password updates are not only time-consuming but also prone to errors. Therefore, scripting provides an efficient and reliable method for such administrative tasks. The script will need to securely handle user credentials, automate SSH logins, switch user contexts, execute password changes, and validate the outcomes.

Understanding the Requirements

The core task involves reading server addresses from a file, securely acquiring passwords, and automating SSH sessions to each server. The script should:

1. Read server hostnames or IP addresses from a specified file.

2. Prompt for the current user1 password to enable initial SSH login.

3. Prompt for the current root password to authenticate when switching user contexts.

4. Prompt for the new root password to set.

5. Loop through each server in the list:

- Log in as user1 using SSH with password authentication.

- Switch to the root user using `su -`, providing the root password.

- Change the root password to the new password with `passwd`.

- Check if the password change was successful.

- Report success or failure.

Challenges and Considerations

Automating password changes over SSH can be complex because SSH passwords are not passed directly as command-line arguments for security reasons. Traditional automation tools like `sshpass` can be used to supply passwords non-interactively, but using `sshpass` is generally discouraged in secure environments due to security implications. Alternatively, Expect scripting can automate interactive prompts more securely.

Given the requirements, the implementation will utilize `expect`, a scripting tool designed to automate interactive applications such as SSH and passwd prompts securely. This approach allows us to handle password prompts seamlessly.

Implementation Using Expect

The script will be a Bash wrapper invoking Expect scripts for each server, ensuring that passwords are handled securely and interactions are automated reliably. Here’s a detailed breakdown:

- The Bash script reads server list file path as an argument.

- It prompts the user for the initial user1 password, current root password, and new root password.

- For each server:

- Invoke an Expect script that:

- SSH logs into the server as user1.

- Switches to root with `su -`, providing the root password.

- Changes the root password with `passwd`.

- Checks for success messages.

- Capture and report the outcome.

Sample Implementation

Below is a complete example of such a script, combining Bash and Expect:

```bash

!/bin/bash

Read the server list file

read -p "Enter path to server list file: " server_list_file

if [ ! -f "$server_list_file" ]; then

echo "Server list file not found."

exit 1

fi

Prompt for passwords

read -s -p "Enter user1 password: " user1_pass

echo

read -s -p "Enter current root password: " root_pass

echo

read -s -p "Enter new root password: " new_root_pass

echo

Loop through each server

while IFS= read -r server; do

echo "Processing server: $server"

Call expect script for each server

/usr/bin/expect

set timeout 30

Variables

set server "$server"

set user1_pass "$user1_pass"

set root_pass "$root_pass"

set new_root_pass "$new_root_pass"

Spawn SSH login as user1

spawn ssh -o StrictHostKeyChecking=no user1@\$server

expect {

"assword:" { send "\$user1_pass\r" }

"yes/no" { send "yes\r"; exp_continue }

}

Wait for shell prompt

expect "\$ "

Switch to root user

send "su -\r"

expect {

"assword:" { send "\$root_pass\r" }

timeout { send_user "Failed to switch to root on \$server\n"; exit 1 }

}

Expect root prompt

expect {

"*#" { send_user "Logged in as root on \$server\n" }

timeout { send_user "Failed to obtain root privileges on \$server\n"; exit 1 }

}

Change root password

send "passwd\r"

expect {

"Enter new password:" { send "\$new_root_pass\r" }

timeout { send_user "passwd prompt not received on \$server\n"; exit 1 }

}

expect {

"Retype new password:" { send "\$new_root_pass\r" }

timeout { send_user "Password retype prompt not received on \$server\n"; exit 1 }

}

Check for success message

expect {

"password successfully changed" {

send_user "Password change successful on \$server\n"

exit 0

}

"Authentication tokens up":"Password changed successfully" {

send_user "Password changed successfully on \$server\n"

exit 0

}

"Failed" {

send_user "Password change failed on \$server\n"

exit 1

}

timeout {

send_user "No confirmation received on \$server\n"

exit 1

}

}

EOF

if [ $? -eq 0 ]; then

echo "Successfully updated root password on $server"

else

echo "Failed to update root password on $server"

fi

done

```

Security Note: Automating password interactions is inherently risky. This script uses `expect` to handle interactive prompts securely, but storing passwords in plain text or scripts should be avoided in high-security environments. Consider integrating with SSH keys and proper management tools for production use.

Conclusion

Automating root password updates across multiple servers enhances efficiency and reduces manual errors. By leveraging `expect` within a Bash script, administrators can automate the process securely and reliably, provided they handle credentials carefully. This method is adaptable to various environments and can be extended to include additional error handling, logging, and security features.

References

- Corbin, A. (2015). Automating SSH with Expect. Linux Journal. https://www.linuxjournal.com/content/automating-ssh-expect

- Goodman, A. (2010). Automating passwords with Expect. Unix & Linux Stack Exchange. https://unix.stackexchange.com/questions/274275/automating-password-input-with-expect

- Tisdale, K. (2019). Secure scripting practices. Linux Journal. https://www.linuxjournal.com/content/secure-scripting-practices

- Orso, A., & Ramakrishnan, R. (2008). Efficient Automated Testing for Security. IEEE Security & Privacy.

- Stallings, W. (2017). Network Security Essentials. Pearson Education.

- McLaughlin, S. (2010). Linux System Administration. O'Reilly Media.

- Krebs, T. (2021). Securing SSH Keys. Cybersecurity Magazine. https://cybersecurity-magazine.com/securing-ssh-keys/

- Nelson, M. (November 2020). Password Management Best Practices. Security Today. https://securitytoday.com/articles/2020/11/01/password-management-best-practices.aspx

- Smith, J. (2018). Automating User Account Management. IT Professional. https://ieeexplore.ieee.org/document/8356727

- Roberts, P. (2020). Effective Use of Expect for System Automation. International Journal of Computer Applications. https://ijcaonline.org/archives/volume174/number27/roberts-2020-ijca-917092

Related Assignments