☰

检查 ssh-key 多个服务器

tag-icon • tag-icon shell-script ssh rhel python
检查 ssh-key 多个服务器

我需要编写一个脚本来检查多台 Redhat 服务器（大约 980 台服务器）上使用 ssh-key 的用户身份验证。

用户可以编辑用户 ID 和私有 ssh 密钥位置的脚本。

脚本必须：

  • 检查登录成功或失败（如果要求输入密码）并输出到日志文件中；

  • 从servers.txt中读取服务器IP/主机名；

  • 如果服务器离线则跳过。

最好的方法是什么？

答案1

像这样的东西：

#!/bin/bash
# I assume "logfile" is the log file. If you just want the last run 
# in the log fil, use date> logfile.
# It is always a good idea to get a time stamp in this kind of logs.
date >> logfile 

# The read takes the input from servers.txt, which is done at the
# bottom using `done < servers.txt`.
# Some people like to do `cat servers.txt | while read -r hostname ; do`
# but they get negative comments on stackexchange :-)
while read -r hostname ; do

    # Test if the host is up with a simple ping
    # Throw away all output.
    if ping -c1 "$hostname"  > /dev/null 2>/dev/null; then

        # We now test if a host is up with a simple command, echo.
        # with -o PasswordAuthentication=no, we make sure that password
        # authentication is not used. Output the result to the logfile.
        if ssh  -o PasswordAuthentication=no "$hostname" echo ' '; then
            echo "OK - $hostname" >>logfile
        else
            echo "AArrrghhh $hostname" >> logfile
        fi
    else
        # I assumed you want some idea of how many servers are skipped.
        echo "skipped $hostname" >> logfile
    fi
done < servers.txt

写得很快，可能需要一些调整。这些评论应该会给您一些关于要检查的内容的提示。

答案2

这是完美的:-)我对它做了一些修改;-)

将 private.ppk 转换为 private.pem：

$ apt install putty-tools
$ puttygen private.ppk -O private-openssh -o private.pem
$ eval `ssh-agent -s`
$ ssh-add priv_key.pem

并且脚本将完美运行

输出.log

root@Pi-3Plus:~# cat output.log
Sat 20 Jul 20:37:51 EEST 2019
SSH-Key Refused - 192.168.1.106
No route to 192.168.4.34
SSH-Key Accepted - 192.168.1.2
No route to 192.168.4.33
SSH-Key Refused - 192.168.1.101
SSH-Key Refused - 192.168.1.195
No route to 192.168.4.39
SSH-Key Accepted - 192.168.1.2

添加以下代码的修改。

#!/bin/bash
# I assume "logfile" is the log file. If you just want the last run
# in the log fill, use date> logfile.
# It is always a good idea to get a time stamp in this kind of logs.
date >> output.log

# The read takes the input from servers.txt, which is done at the
# bottom using `done < servers.txt`.
# Some people like to do `cat servers.txt | while read -r hostname ; do`
# but they get negative comments on stackexchange :-)
while read -r hostname ; do

    # Test if the host is up with a simple ping
    # Throw away all output.
    if ping -c1 "$hostname"  > /dev/null 2>/dev/null; then

        # We now test if a host is up with a simple command, echo.
        # with -o PasswordAuthentication=no, we make sure that password
        # authentication is not used. Output the result to the logfile.
        if ssh -l ADDUSERHERE -o StrictHostKeyChecking=no -o IdentitiesOnly=yes -o PasswordAuthentication=no -n "$hostname" echo ''; then
        echo "SSH-Key Accepted - $hostname" >>output.log
    else
        echo "SSH-Key Refused - $hostname" >> output.log
    fi
else
    # I assumed you want some idea of how many servers are skipped.
    echo "No route to $hostname" >> output.log
    fi
done < servers.txt

相关内容