0

I am trying to complete my bash script in order to find which SSH servers on LAN are still active with the ssh keys, but i am frozen at this step:

#!/bin/bash

# LAN SSH KEYS DISCOVERY SCRIPT

</etc/passwd \
grep /bin/bash |
cut -d: -f6 |
sudo xargs -i -- sh -c '
     [ -e "$1" ] && cat "$1"
' -- {}/.ssh/known_hosts |
cut -d' ' -f1 |
tr ',' '\n' |
sed '
     /^\[/{
          s/\[\(.*\)\]:\(.*\)/\1 \2/;
          t;
     };
     s/$/ 22/;
' |
sort -u |
xargs -l1 -- sh -c '
    if echo "~" | nc -q1 -w3 "$1" "$2" | grep -q "^SSH"; then
          echo "#### SUCCESS $1 $2";
    else
          echo "#### ERROR $1 $2";
    fi
' --

# TIME TO TEST WHICH SSH servers are still active with the SSH keys
# AND THIS IS WHERE I AM FROZEN...
# Would love to have bash script that could
# ssh -l $users_that_have_/bin/bash -i $ssh_keys $ssh_servers
# Would also be very nice if it could save active
# SSH servers with the valid keys in output.txt in the format
# username:local-IP:/path/to/SSH_key

there is also another one simpler to read (but with some temp files getting created):

#!/bin/bash

# LAN SSH KEYS DISCOVERY SCRIPT
# TRYING TO FIND THOSE SSH KEYS NOW

cat /etc/passwd | grep /bin/bash > bash_users
cat bash_users | cut -d ":" -f 6 > cutted.bash_users_home_dir
for bash_users in $(cat cutted.bash_users_home_dir)
do
ls -al $bash_users/.ssh/*id_* >> ssh-keys.txt
done

# DISCOVERING THE KNOWN_HOSTS NOW

for known_hosts in $(cat cutted.bash_users_home_dir)
do
cat $bash_users/.ssh/known_hosts | awk '{print $1}' | sort -u >> 
hosts_known.txt
sleep 2
done
hosts_known=$(wc -l hosts_known.txt)
echo "We have $hosts_known known hosts that could be still active via SSH 
keys"

# TIME TO TEST WHICH SSH servers are still active with the SSH keys
# AND THIS IS WHERE I AM FROZEN...
# Would love to have bash script that could
# ssh -l $users_that_have_/bin/bash -i $ssh_keys $ssh_servers
# Would also be very nice if it could save active
# SSH servers with the valid keys in output.txt in the format
# username:local-IP:/path/to/SSH_key

So right now, as stated in the bash script above, I am trying to find how to do some sort of a ssh -l $users_that_have_/bin/bash -i $ssh_keys $ssh_servers and dump the positive logins in an output.txt file in the following format:

username:local-IP:/path/to/SSH_key

To answer DopeGhoti comment:

I'm now trying to figure out how to integrate this into my bash script. Here is my current attempt:

users=$(cat cutted.bash_users)
ssh_keys=$(cat ssh-keys.txt)

if ssh -l $users -i $ssh_keys $hosts_known -o BatchMode=yes -o 
ConnectTimeout=5
then echo $users:$hosts_known:$ssh_keys SUCCESS >> results.txt
else
echo FAILED
fi
3
  • 1
    welcome to U&L, you know ssh have a return code ? along with -o BatchMode=yes this can help automatize test. (e.g. if ssh ... ; then echo good for ... >> good.txt ; else echo bad for ... >> bad.txt ; fi)
    – Archemar
    Nov 1, 2018 at 19:49
  • Also that cat|grep|cut|for can be boiled down to for homedir in $(awk -F: '$7 ~ /\/bin\/bash/ { print $6 }' /etc/passwd); do....
    – DopeGhoti
    Nov 1, 2018 at 20:42
  • So just to clarify: what you are trying to do is, for each user, for every host in their known_hosts, attempt to log into each host with each presumptive private key found in ~username/.ssh?
    – DopeGhoti
    Nov 1, 2018 at 21:00

1 Answer 1

0

Unfortunately, it seems I cannot add a comment (need 50 reputation points), this is why I am adding my reply to you guys. Also, I've previously edited my question but I received this notification:

Your suggested edit is pending review. Patrick Mevzek reviewed this 2 hours ago: Reject This edit was intended to address the author of the post and makes no sense as an edit. It should have been written as a comment or an answer.

welcome to U&L, you know ssh have a return code ? along with -o BatchMode=yes this can help automatize test. (e.g. if ssh ... ; then echo good for ... >> good.txt ; else echo bad for ... >> bad.txt ; fi) – Archemar 54 mins ago Also that cat|grep|cut|for can be boiled down to for homedir in $(awk -F: '$7 ~ //bin/bash/ { print $6 }' /etc/passwd); do.... – DopeGhoti 1 min ago

So just to clarify: what you are trying to do is, for each user, for every host in their known_hosts, attempt to log into each host with each presumptive private key found in ~username/.ssh? – DopeGhoti 25 mins ago : YES

here;

So now I'm trying to figure out how I could make this idea integrate itself into my bash script, something like;

users=$(cat cutted.bash_users)
cat ssh-keys.txt | awk '{print $9}' > cutted.ssh_keys.txt
ssh_keys=$(cat cutted.ssh_keys.txt)

if ssh -l $users -i $ssh_keys $hosts_known -o BatchMode=yes -o ConnectTimeout=5
then echo $users:$hosts_known:$ssh_keys SUCCESS >> results.txt
else
echo $users:$hosts_known:$ssh_keys FAILED >> not-active.txt
fi

If you guys have an idea on how to make this possible, I would be very happy to learn on how to do it

Thanks

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.