Automated Password Change

UNIX for Advanced & Expert Users
1

Hi All
I need to automate (execute from a script or loop on the command line) password changes on a number of UNIX boxes. I cannot use telnet since I have disabled this on all servers - and installed SSH.

I have root private/public keys setup so that I can login directly into the boxes non-interactively, hence I am looking for something like this:

ssh $hostname "/path/to/a/local/script"

Obviously that script can take username and password variables from a access restricted file on each host, or even specify these in the script itself. What I plan on doing is pushing the same script out to all servers and then executing it.

The problem is, as we all know, passwd is interactive, and I just cannot get it to read from stdin. I have tried:

passwd $username<<EOF
password
password
EOF

But this does not work.

The reason I need to use passwd is because the boxes are installed with a variety of UNIXes, so I need something that will work universally, and not something that relies upon OS specific tools.

Any ideas? Or anyone have any better ways to do this ( bearing in mind the solution must be cross-platform friendly).

Any help is much appreciated.

2

you can try installing webmin on all unix boxes. webmin has a module for this type of thing, and many others. it's easy to use & install.

3

As far as I am aware, Webmin doesn't have the ability to change the passwords on a remote server, does it?

I need two functional criteria to be met:

  1. Something that can be executed from a central location.
  2. Something that can change passwords non-interactively.
4

webmin has a cluster change password module standard with version 1.170 but you need to have webmin installed on all machines and configured in a cluster, meaning all listening on port 10000 and tell webmin it's in a cluster. if you have webmin running in a cluster you can execute some commands from a central location like change passwords, copy files, cron jobs, shell commands, users and groups, install software and webmin configuration. maybe some third party modules have extra functionality. check out the webmin site in their standard modules.

5

Sometimes the only way to a portable script is something like:

os=`uname -s`
case $os in
HP-UX)
           hp-ux code
            ;;
SunOS)
           sunos code
            ;;
*)     
            echo unsupported os  >&2
            exit 1
            ;;
esac

Since the script is running as root, it can do anything. So replace the encrypted password string in /etc/password or /etc/shadow as required.