1

I'm using a key pair for authentication for SSH on all my servers. We disable password login over SSH for security reasons on all our Linux servers.

On each server I have a folder at the root level and in that folder I have a set of scripts that I tend to run for routine maintenance on all the servers.

I have a single linux management workstation, which I use to SSH into each of my servers, and on that management station I have a copy of that script folder.

What I want to do is maintain only one copy of that folder on my management station and then use a script to SCP into each of my servers to then copy that folder over. I have the list of all my servers in a text file which sits alongside my replicate script.

So far I've written the replicate script to handle parsing the "servers" file and loop through each entry and SCP into each server to copy the folder over.

My problem is i'm being asked for the keyphrase for my private key each time, and I was wondering if there was a way to open the key once and then use it for all the connections. Thus asking me for the keyphrase only once, instead of for every server it wants to connect to.

I realise I could use something like Syncthing or another replication system to do this replication automatically, maybe even rsync but I want to avoid running software like that on all my servers, just for replicating this one folder, and I have very little knowledge on what's involved setting up rsync, and again I want to avoid putting specific config on all my servers to just allow rsync to work.

The basic/crude script I have is as follows, and it works but I just have to keep typing the passphrase.

replicate.sh

hosts=$(<servers_file)
for host in $hosts; do
    echo "Connecting to host $host";
    scp -r /data/scripts root@$host:/data
done

servers_file

10.1.1.10
10.1.1.11
etc

I thought I had run into a nice solution using SSH sockets, but that only allows me to run multiple commands on the same remote host, when I need to connect to multiple hosts. Also a solution at https://serverfault.com/questions/389404/use-scp-to-copy-a-file-to-different-servers will work, but only if we're using passwords for SSH, which we are not.

If someone can point me in the right direction, it would be very much appreciated.

  • I would setup up passwordless ssh login on all the servers. Generate new keys and leave the passphrase blank on all the servers. If you are copying from and to a root folder you will need a root key on both and exchanged to both. ssh-keygen puts it in the home folder. Sudo ssh-keygen makes a root key. – walttheboss Jul 1 at 22:18
  • 1
    I'm not overly keen on having a key file without a passphrase on it. Should someone obtain that key then they would have access to all our servers. At least with a passphrase on the key it's a little more secure. – Adam French Jul 1 at 22:38
  • Have you read man ssh-add ssh-agent? – waltinator Jul 2 at 2:13
0

I have a similar use case where I want to fully automate commands over ssh where there is an interaction that can be automated . I've automated using python and use pexpect to answer questions (which could be passphrase)

def localexpect(alog, config, host):
    TMPLOG = "/tmp/pexpect.log"
    mcs = config["mcs"]
    cmd = f'''
ssh-keygen -R {host}.local ;\
ssh-copy-id -i rsa/id_rsa.pub {mcs["user"]}@{host}.local ;\
echo "publickeyinstalled" ;\
echo "alldone" 
        '''

    alog.info(cmd)

    with open(TMPLOG, "w") as log:
        ch = pexpect.spawn(f"/bin/bash -c \"{cmd}\"", encoding='utf-8', logfile=log)
        while True:
            i = ch.expect(["Are you sure", "password:", "publickeyinstalled"])
            if i == 0:
                alog.info("ECDSA check")
                ch.send("yes\r")
            elif i == 1:
                alog.info("Password required")
                ch.send(f"{mcs['pwd']}\r")
            elif i == 2:
                alog.info("public key installed")
                break
        ch.expect("alldone")
        i = ch.expect([pexpect.EOF], timeout=5)
        ch.close()
        alog.info("expect done - EOF")

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.