shell自动批量登录主机执行任务
shell原生实现批量管理机器
1.准备环境
1.hosts.info是主机文件
2.t1.sh t2.sh t3.sh是shell脚本文件
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
10.155.6.7 admin 22 passwd1 10.155.6.11 admin 22 passwd1 10.155.6.8 admin 22 passwd1 10.155.6.9 admin 22 passwd1 10.155.6.33 admin 22 passwd1
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
#!/bin/bash COMMAND=$* HOST_INFO=hosts.info IP_LIST=`awk '/^[^#]/{print $1}' $HOST_INFO` for IP in $IP_LIST;do USER=`awk -v ip=$IP 'ip==$1{print $2}' $HOST_INFO` PORT=`awk -v ip=$IP 'ip==$1{print $3}' $HOST_INFO` PASSWD=`awk -v ip=$IP 'ip==$1{print $4}' $HOST_INFO` expect -c " spawn ssh -p $PORT $USER@$IP expect { \"(yes/no*)\" {send \"yes\r\"; exp_continue } \"password:\" {send \"$PASSWD\r\"; exp_continue} \"$USER@*\" {send \"$COMMAND\r exit\r\"; exp_continue} } " echo "-----------------------------------" done
t2.sh是自动到ssh登录到每台主机执行shell命令
sh t2.sh 'sudo ls /tmp && sudo rm -fr /tmp/*xml'
sh t2.sh 'cd /home/secure/check && sh 36c221be-6ab2-ef53-1589-fe16877914f4.sh null null null'
t3.sh 自动把所有远程主机生成的结果文件拷贝到本机
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
#!/bin/bash HOST_INFO=hosts.info IP_LIST=`awk '/^[^#]/{print $1}' $HOST_INFO` for IP in $IP_LIST;do USER=`awk -v ip=$IP 'ip==$1{print $2}' $HOST_INFO` PORT=`awk -v ip=$IP 'ip==$1{print $3}' $HOST_INFO` PASSWD=`awk -v ip=$IP 'ip==$1{print $4}' $HOST_INFO` expect -c " spawn scp -r $USER@$IP:/tmp/*.xml . expect { \"(yes/no*)\" {send \"yes\r\"; exp_continue } \"password:\" {send \"$PASSWD\r\ exit\r\"; exp_continue} } " echo "-----------------------------------" done
sh t3.sh
下载结果文件到本地
自动基线配置命令
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
usermod -L listen usermod -L gdm usermod -L webservd usermod -L nobody usermod -L nobody4 usermod -L noaccess echo 'umask 027' >> /etc/profile sed -i 's/export TMOUT=.*/export TMOUT=300/g' /etc/profile mkdir -p /etc/syslog-ng/ cat > /etc/syslog-ng/syslog-ng.conf <<'EOF' destination logserver { udp("10.10.10.10" port(514)); }; log { source(src); destination(logserver); }; EOF echo '*.* @192.168.0.1' >> /etc/rsyslog.conf
使用这种shell方式可以快速在多台主机上执行相同命令,提高主机管理效率
批量修改主机密码
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
#!/bin/bash HOST_INFO=hosts3.info IP_LIST=`awk '/^[^#]/{print $1}' $HOST_INFO` for IP in $IP_LIST;do USER=`awk -v ip=$IP 'ip==$1{print $2}' $HOST_INFO` PORT=`awk -v ip=$IP 'ip==$1{print $3}' $HOST_INFO` PASSWD=`awk -v ip=$IP 'ip==$1{print $4}' $HOST_INFO` PASSWD2=`awk -v ip=$IP 'ip==$1{print $5}' $HOST_INFO` expect -c " spawn ssh -p $PORT $USER@$IP expect { \"(yes/no*)\" {send \"yes\r\"; exp_continue } \"password:\" {send \"$PASSWD\r\"; exp_continue} \"$USER@*\" {send \"sudo echo $PASSWD2 | passwd --stdin secure\r exit\r\"; exp_continue} } " echo "-----------------------------------" done
echo $PASSWD2 | passwd --stdin secure
执行这条命令的时候必须是root用户才行,普通用户无法执行此命令.即使前面加上sudo也不行
sudo有点类似于su命令,但sudo的不同之处在于它默认需要用户的密码进行身份验证,而不是su需要的目标用户的密码。Sudo也不会产生root shell;相反,它以提升的权限运行程序或命令,不像su它产生一个root shell
第二种方式
把阻断需要输入的字符串自动发送给shell就可以实现自动修改自身密码,由于passwd是在远程主机上执行并且Changing也是在远程机上输出导致send命令无效
第三种方式
sudo -u root sh -c "echo '5555555' | passwd --stdin secure"
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
#!/bin/bash HOST_INFO=hosts3.info IP_LIST=`awk '/^[^#]/{print $1}' $HOST_INFO` for IP in $IP_LIST;do USER=`awk -v ip=$IP 'ip==$1{print $2}' $HOST_INFO` PORT=`awk -v ip=$IP 'ip==$1{print $3}' $HOST_INFO` PASSWD=`awk -v ip=$IP 'ip==$1{print $4}' $HOST_INFO` PASSWD2=`awk -v ip=$IP 'ip==$1{print $5}' $HOST_INFO` COMMAND=`sudo -u root sh -c 'echo $PASSWD2 | passwd --stdin secure'` expect -c " spawn ssh -p $PORT $USER@$IP expect { \"(yes/no*)\" {send \"yes\r\"; exp_continue } \"password:\" {send \"$PASSWD\r\"; exp_continue} \"$USER@*\" {send \"sudo -u root sh -c 'echo $PASSWD2 | passwd --stdin secure'\r exit\r\"; exp_continue} } " echo "-----------------------------------" done
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
10.155.6.9 secure 22 #Ctcss@2022! aaaa 10.155.6.33 secure 22 #Ctcss@2022! bbbb 10.155.6.35 secure 22 #Ctcss@2022! ccccc 10.155.6.34 secure 22 #Ctcss@2022! ddddd 10.155.6.5 secure 22 #Ctcss@2022! asdfasdf
sudo命令解析
ssh自动批量升级
1.覆盖可执行文件
2.修改配置文件
#预览模式 并不会直接修改源文件内容
sed '/GSSAPIKexAlgorithms/d' /etc/crypto-policies/back-ends/openssh.config
#直接修改文件内容添加 -i 选项
sed -i '/GSSAPIKexAlgorithms/d' /etc/crypto-policies/back-ends/openssh.config
3.重启sshd服务
/usr/local/bin/ssh-key -A
cp /etc/ssh/ssh_host_rsa_key /usr/local/etc/
cp /etc/ssh/ssh_host_ecdsa_key /usr/local/etc/
cp /etc/ssh/ssh_host_ed25519_key /usr/local/etc/
systemctl restart sshd
本文来自博客园,作者:不懂123,转载请注明原文链接:https://www.cnblogs.com/yxh168/p/18274369