Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • Using expect is a good way to automate that for commands that read the password from a pty (like you mentioned su or login.) You can run expect locally and have it start the ssh connection, so no need to install it on the remote machines. Commented May 29, 2019 at 11:40
  • 1
    Also note that using echo NEWPASS on ssh is quite insecure! It might make it into log files and even be visible from ps, so you'd be leaking your passwords. At the very least, use something like <<<NEWPASS (assuming bash, this is a bash syntax) passing that to the stdin of ssh itself rather than as part of the command string. But expect is possibly a better way to make this slightly more secure (still pretty scary though.) Commented May 29, 2019 at 11:44
  • "For security purposes I have a script to change all keys and user passwords periodically from a central server" - why aren't you using that central server to authenticate users directly? Then no need for password files on any of the satellite systems, and no need for scripts to distribute administrative level passwords (or hashes) Commented Jul 26, 2023 at 10:20
  • Because you'd be unable to authenticate if for some reason connectivity to that one server for down? Even if you have have an HA cluster of LDAP machines, for instance, if the server you need to do maintenance on because it e.g. lost it's primary interface due to some glitch you'd be screwed and couldn't even log in via a console ... sure, you could still boot of a rescue CD, the question is then how much downtime can that one machine afford. Commented Mar 30, 2024 at 18:57