I would like to change the root password on about 20 Linux servers. Mostly CentOS and Ubuntu.
So I have looked at Puppet, chef, and cfengine, but I can't really tell if they can do that, or if they would be over kill for the task?
Does anyone have recommendations how to edit config files, /etc/shadow among others, on many Linux servers?
You could just run the command usermod -p '_hash_' root where hash is the hash of the password appropriate for that system. So a command like usermod -p '$1$aNwwp0wS$RzSqCt3ntYs.V2TxcXheA' root would make root have a password of password.
If you want to do this the right way you would also generat a unique salt and a unique hash for each system. If it is installed you can use mkpasswd for this purpose.
$ # create a md5 password has for 'password'
$ echo 'password' | mkpasswd -s -m md5
$1$mJrKn6xs$NTfRbrqbaVzsqcPzyXXt3/
PS Personally I prefer to set root to have a disabled password and then use ssh key-based authentication for any access to the root account. You should be able to build yourself a script pretty easily to automate the update of the root authorized_keys file. Depending on your SSH log level you will also see which key was used to access the root account, this may be helpful to track down who broke something.
You don't. No really, don't directly edit /etc/shadow. For 20 servers, i would probably just log in and change the root password with passwd.
what you can do if you have to do it often is use Expect and put it in a loop like:
for i in `cat <file_with_server_names>`
do
ssh <user>@$i
<expect stuff here>
done
Sorry for the flimsy psuedo code i havn't used expect in about 6 months.
root is a tricky one, personally I don't like tying it to any external services as a fall back plan in case the network / service is down. Normally i would have suggested LDAP or AD integration (if you already had an AD domain!)
Puppet can manage users (and a plethora of other things). I would warmly recommend any admin with more than 3 servers integrating puppet into their environment. The wiki on puppetlabs.com has many articles that will help you get up and running quickly. The advantages are definitely worth your time. Consider writing this piece of code once:
User {"sandra":
ensure => present,
group => ["sysadmin","dba"]
}
...and have it applied on many servers within a given timeframe.
And yeah, dont edit your shadow file by hand :)
There are also packages like cluster-ssh, but in my experience, while useful, the workflow with this type of software becomes uncomfortable with more than 3-4 servers - this is just screen real-estate wise. I am not even talking about various issues that will arise due to differences in server filesystem layouts (say bye-bye to tab completion), installed packages, etc
If you have ssh key exchange established to all of the systems, I'd consider a basic loop to ssh to each system and update the password. If not, it may make more sense to just ssh to each system individually and change the password. 20 systems isn't that large a number.
