Run local scripts on multiple servers using sudo user through a script

Question

I have about 100 remote servers. I want to manage all my servers using one terminal server to update , run commands with sudo privileges.

I need to have one main script that takes another test script as an argument. The main script run through a with loop using a hosts file with remote server names.

The test script has all the actual sudo commands to be run on the remote servers at once

./mainscript hostfile testscript for example, test script may have "sudo yum -y update" or a string of commands.

This seems easy if I login as root user. But I want to run this as user 'admin' who has sudo privileges on all the remote servers. All these scripts are located locally on terminal server.

Please suggest me any ideas you may have to achieve this?

Answer 1

One idea, though it might not be the best out there, is for you to configure ssh to use key based authentication instead of password authentication. This instructions should be sufficient in case you are not aware of it SSH Key Authentication

I don't know what your test script contains nor the complexity of it. let's assume that it is a fair complex script and it saves the output under /tmp/script_output/ and in this case I suggest the following:

while read -r i
do
   scp $2 admin@remote_server:/tmp/
   ssh -t admin@remote_server /tmp/$2
   ssh admin@remote_server rm /tmp/$2
   scp -r admin@remote_server:/tmp/script_output/ /tmp/
   ssh admin@remote_server rm -rf /tmp/script_output
done < "$1"

By the way, from the sudoers

#
# Disable "ssh hostname sudo <cmd>", because it will show the password in clear.
#         You have to run "ssh -t hostname sudo <cmd>".
#
Defaults    requiretty

Answer 2

I had the same problem some time ago. That's my solution:
https://github.com/maciejkorzen/misc-ruby/blob/master/ssh-batch-upload-sftp-and-run.rb

• Download this script.
• Create CSV file with names of servers and passwords (I assume that login is the same on each server).
• Create script that you want to execute.
• Adjust variables in my Ruby script, run it and let it do all the work for you. :-)

Answer 3

The following will allow you to execute sudo commands on multiple hosts while only having to enter your sudo password once at the beginning.

What is missing is the for loop or something that sets the HOSTS variable to the hosts you have. The script creates a file in the temp folder that contains the sudo password, but that file is deleted immediately. This allows the command to use the sudo password without it being displayed in the terminal window or in your script.

#!/bin/bash

if "something" 
 then

 else

cat > /tmp/$HOSTS-pw.sh <<EOS
#!/bin/sh
ssh user@$HOSTS sudo "your command here" <<EOC
$SUDOPW
EOC
EOS

fi

chmod 700 /tmp/$HOSTS-pw.sh
/tmp/$HOSTS-pw.sh >/dev/null
if [ -f /tmp/$HOSTS-pw.sh ]; then rm -f /tmp/$HOSTS-pw.sh; fi

echo "Enter SUDO password:"
read -s SUDOPW

for loop here!

unset SUDOPW
exit 0

Answer 4

Strange way to do this.

I do some things at many servers using clusterssh (type once, do it on every server).

For bigger changes we use our own repositories that are activated on every server. That way we use the OS patch-mechanism to distribute specific changes to a large number of servers.

Answer 5

For such a scenario I have a two scripts. The script runonnodes does all the ssh to the selected serves (a list of servers). The other one named runonnodes_commands is on a network share, which is available on each server. This is the script executed on each selected server.

The first script runonnodes includes mainly:

#!/bin/bash

SELECTEDNODES="node1 node2 node2"

for NODE in $SELECTEDNODES; do
    ssh -t $NODE "sudo su -c /mnt/share/runonnodes_commands"

For this to work, key based authentication is used (my public key in ~/.ssh/authorized_keys) and I am allowed to do sudo su

The script runonnodes_commands contains all the stuff, which has to be done on the nodes, e.g. copy files, install packages:

#!/bin/bash

yum install python