0

We have 300+ AIX servers.We have created local id for a user on all those servers.Now the user has to log in manually in all servers to check his whether credentials are working.So is there a way/script to identify whether user is able to login with the given user ID and password.I tried google but did not get anything.Could please help with this requirement.

  • 1
    Can't you reuse the script which created that user locally on 300+ macinhes? – Ipor Sircer Nov 16 '16 at 10:22
  • 1
    When you have 300+ servers, why can't you afford one more serving as SSO authenticator? – Timothy Truckle Nov 16 '16 at 10:49
  • Actually i am looking for script for the users so that they can validate their credentials is working by using the script – Gomsthyshankar Selvakumar Nov 16 '16 at 11:23
  • 3
    Well, yes. The right way to do it would be to have one server that deal with validating the credentials across all machines in the network. Anyway, what have you got so far? Which part of this is giving you trouble? Presumably, if you're the sysdamin of a 300-machine server farm, you don't need us to explain basic shell scripting! So please edit your question and show us what you've tried and how it failed. That way we won't be giving you the same solutions. – terdon Nov 16 '16 at 11:49
0

REVISITED: I am not going to say how to test a given password. I do not believe an admin should know other users passwords to submit such a test. However, I can help you find a user, or perhaps all users who have never set a password.

As system admin, aka root, you could be trying something such as:

#!/usr/bin/ksh
## pwdchkUser
# Author: Michael Felt and AIXTOOLS, 2016
# example program for checking a single username on a list of hosts
# check user on all hosts listed, line by line in test1.txt

user=$1
cat test1.txt | while read host; do
    ssh root@${host} "(/usr/bin/grep -p ${user}: /etc/security/passwd \
        | grep lastupdate 2>&1 >/dev/null \
        || print $user@host has never set a password)"
done

#!/usr/bin/ksh
## pwdchkUsers
# Author: Michael Felt and AIXTOOLS, 2016
# example program to find all users that have never set a password
# the 'test' is that the keyword 'lastupdate' is missing from the user entry 
# /etc/security/passwd stanza 

host=$1
print "On ${host} the following usernames are known, but have not changed their password"

ssh root@$host '/usr/bin/grep -vp lastupdate /etc/security/passwd \
    | egrep ":$" | cut -d: -f 1'

p.s. I shall not even begin on all the errors in the 'google' script you found. It is unfortunate that you do not recognize the syntax errors in the ssh command you say you 'got via google' - certainly not via SE!


Your solution comes in two pieces a) the script that verifies (must be something different from user exists - as per your question, that is a given) - Once you have this then part two b) configure and use dsh (distributed shell)

Once both are ready you can use

dcp script /some/great/script # copy to all servers in dsh domain

and your user(s) can use:

dsh /some/great/script

to run the command on multiple servers in parallel

Note: there are different ways to be more selective on which servers to run the command on: e.g.,

dsh -n host1,host2,host7 /some/great/script

While I cannot help you with specifics on part a) - not enough info I hope this article will help you with part b) http://www.rootvg.net/content/view/634/88/

p.s. Some of the things you could also consider is YOU running the command - since you can create the user you can see things they probably cannot see.

grep ^$username:!: /etc/passwd

and

/usr/bin/grep -p "flags = ADMCHG" /etc/security/passwd | grep -v password
username:
        flags = ADMCHG
        lastupdate = 1416221835

Explanation: ^username:*: signifies a user that does not have a password, so cannot login because there is no password, while ^username:!: means there is an entry in the shadow password file for user/password verification (or no password required by shadow file)

in /etc/security/password - the shadow file if flags == ADMCHG, there is a password, but the user must change the password before they can stay on the system. Some programs - that use OS credentials and cannot/do not change the password will just exit.

  • I tried the below mentioned script but from google but it is not working I am getting an error ./test: line 9: test1.txt: command not found .#!/bin/bash username=xxxxxxxx passwd=xxxxxxxx cd /tmp for host in test1.txt; do ssh $username@$host $passwd; echo "### $host ###" >> output.txt done – Gomsthyshankar Selvakumar Nov 23 '16 at 10:42
  • where from google? I think, from what I can see here is that it should be "for host in cat test1.txt ; do ... – Michael Felt Nov 23 '16 at 11:01
  • ok - nopw I see it is the formatting characters - test.txt - is it a program? then chmod u+x and call as ./test1.txt, if not then execute either cat test1.txt or eaiser as a comment here try: cat test1.txt | while read host; do ... – Michael Felt Nov 23 '16 at 11:04
  • I tried the below script but it is not working.Could please let me know anything i have missed. #!/bin/bash username=xxxxxxxxxxxx cd /tmp for host in cat test1; do sshpass -p 'xxxxxx' ssh $username@$host |hostname >> output.txt done – Gomsthyshankar Selvakumar Nov 25 '16 at 6:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.