Shell Programming and Scripting

Hi,

I need a script that will connect to a list of servers and first sudo to root and then run a couple of commands.
For security reasons, we can't setup ssh keys as root.
Manually I have to login to a server as user and then sudo to root.
It's not possible to use root@servername , because of security restrictions.

This is what I got so far, but the problem is that it's not sudo ing to root:

Code:

#!/bin/bash
HOSTS=$(cat filename)
SCRIPT2="sudo su -"
SCRIPT=" command ; command ; command"

for HOSTNAME in ${HOSTS} ; do
    ssh  ${HOSTNAME} "${SCRIPT2}" "${SCRIPT}"
done

I recall sudo might want a terminal, so ssh -t or ssh -tt. Of course, ssh in on a utility id that has sudo privileges. Usually sudo means you do not need su. If you sudo bash you can send any number of commands, so you do not need to maintain remote scripts.

sudo isn't possible

sudo works without terminal if there is NOPASSWD: in sudoers. Please check which command(s)!
But it is either

Code:

sudo command; sudo command

or

Code:

sudo su - -c 'command; command'

where the optional - reads root's profile.

sudo su - is not allowed
I understand that we can avoid these things, by setting up ssh keys or the sudoers file, but these options are not allowed

basiclly I want to do these steps, but in a script:
login to the Unix server as my own userid
ssh to remote server
sudo to root
execute a couple of commands
exit

On google I couldn't find something similar,
but I assume I am not the first person who came across this?

we have have environments where we can login to a main server as root ,
execute scripts on remote servers as root, because SSH keys have been configured, but not for this environment

You can use an expect script for interactive prompt handling.

Code:

man expect

This is probably the least secure method, because the passwords are stored in your script. At least read-protect it for others!

Yes, ssh is more secure with PPKey not password, as well as allowing simpler scripting. Once in as not root user with a controlling terminal (-tt), accessing root with any interactive commands is fine, but once again, you may need expect or something like it to send the root password, or sudo so you do not need to use and expose that password.

You could write your own set-uid root compiled program to let just your trusted id or group run just scripts in a special directory.