Changing password in multiple boxes using script

Question

I'm working in a environment which has around 400 AIX boxes. I don't have root access and I'm a normal user. The environment has no LDAP kind of centralized mechanism for authentication so the passwords are maintained in /etc/shadow file only.

The security policy makes us change passwords every 30 days which creates a big complication where we can't change passwords on all boxes every month, which leads us to have different passwords on each box. It's a big headache to maintain the passwords.

Is there a way to write a script which will login and change passwords in a list of the boxes so that we can change the password every month on all the boxes so that we will have the same passwords?

Solution

pssh

One approach would be to use a command like pssh to run ssh in parallel across multiple systems at the same time.

• original pssh website
• new pssh website

A command like this would suffice:

$ pssh -h ~/pssh-hosts 'printf "%s\n" old_pass new_pass new_pass | passwd'

This will run the command:

printf "%s\n" old_pass new_pass new_pass | passwd

which will "change" the password. The pssh command:

$ pssh -h ~/pssh-hosts '... commmands to run ...'

will run this command across the list of hosts in the file ~/pssh-hosts in parallel all at the same time.

There are some examples of pssh in action in this tutorial titled: pssh HOWTO. The pssh command also has other commands such as pscp for copying files in parallel across multiple systems.

sshpt (SSH Power Tool)

In the same vain as pssh, there's sshpt. Works similar to pssh but is another option.

other options?

There are a whole slew of options beyond these two. You can see more of them listed in this ServerFault Q&A titled: What is a good modern parallel SSH tool?.

References

• PSSH : Parallel SSH to execute commands on a number of hosts
• pssh man page

Comments

[user347375]

just a note, your solution of using pssh is very helpful, but your sample code is even more helpful. It would be nice if your printf & pipe usage could be explained. I admit I don't quite understand it (but it works!).