++++++++++++++++++++++++++++++++++++++++++++++++++
标题：Linux操作系统互信配置脚本
时间：2019年5月28日
++++++++++++++++++++++++++++++++++++++++++++++++++
mutual_trust.sh #单项信任配置配置脚本
————————————————————————————————————————————————
#!/usr/bin/env bash
# Configure mutual trust
# v1.0 by Bruce
# 2019年5月20日
# install expect software
rpm -qa |grep expect &> /dev/null
if [ $? -ne 0 ] ; then
yum -y install expect &>/dev/null
if [ $? -ne 0 ] ; then
echo "expect install failed..."
exit
fi
fi
# create muautl trust user
while read user_inform
do
root_ip=`echo $user_inform |awk '{print $1}'`
trust_users=`echo $user_inform |awk '{print $2}'`
trust_users_pass=`echo $user_inform |awk '{print $3}'`
root_pass=`echo $user_inform |awk '{print $4}'`
/usr/bin/expect <<-CREATEUSER
spawn ssh root@$root_ip
expect {
"yes/no" { send "yes\r";exp_continue }
"password:" { send "$root_pass\r" }
}
expect "#" {
send "id $trust_users && echo '$trust_users is exists' || (useradd $trust_users;echo $trust_users_pass |passwd --stdin $trust_users)\r"
send "exit\r"
}
expect eof
CREATEUSER
done &>/dev/null </tmp/check/inform.txt
# create ssh-keygen
# find local system ipaddr for searching username about mutual trust
key_ip=`ip a |grep 'inet ' |grep 'eth' |awk '{print $2}' |awk -F"/" '{print $1}'`
key_user=`grep $key_ip /tmp/check/inform.txt |awk '{print $2}'`
# assign the user's UID to the key_user_id if the user exists
id $key_user &>/dev/null
if [ $? -ne 0 ] ; then
echo "$key_user is not exist...."
exit
else
key_user_id=`id $key_user |awk -F"(" '{print $1}' |awk -F"=" '{print $2}'`
fi
# Determine the user's home directory based on UID
if [ $key_user_id -eq 0 ] ; then
home_dir="/root"
else
home_dir="/home/$key_user"
fi
# change the user for creating ssh-key
su - $key_user <<-EOF
if [ ! -f $home_dir/.ssh/id_rsa ] ; then
ssh-keygen -P "" -f $home_dir/.ssh/id_rsa &>/dev/null
if [ $? -ne 0 ] ; then
echo "ssh-keygen create failed..."
exit
fi
fi
EOF
# Configure one-way mutual trust
while read line
do
# get some information about host's groups
local_ip=`ip a |grep 'inet ' |grep 'eth' |awk '{print $2}' |awk -F"/" '{print $1}'`
local_trust_user=`grep $local_ip /tmp/check/inform.txt |awk '{print $2}'`
trust_ip=`echo $line |awk '{print $1}'`
trust_user=`echo $line |awk '{print $2}'`
trust_password=`echo $line |awk '{print $3}'`
# change ther user for copying ssh-key to other host
su - $local_trust_user <<-ENDCOMMAND
/usr/bin/expect <<-EOF
spawn ssh-copy-id $trust_user@$trust_ip
expect {
"yes/no" { send "yes\r";exp_continue }
"password:" { send "$trust_password\r" }
}
expect eof
EOF
ENDCOMMAND
done &>/dev/null < /tmp/check/inform.txt
————————————————————————————————————————————
start.sh #互信配置启动脚本
————————————————————————————————————————————
#!/usr/bin/env bash
# remote configure others one-way mutual trust
# v1.0 by Bruce
# 2019年5月20日
# call script mutual_trust.sh
bash /tmp/check/mutual_trust.sh
# Redefine the separator
IFS_OLD=$IFS
IFS='
'
# remote some file about configuration mutual trust and exec mutual_trust.sh
for inform in `cat /tmp/check/inform.txt`
do
# echo $inform
# find local system ipaddr for searching username about mutual trust
key_ip=`ip a |grep 'inet ' |grep 'eth' |awk '{print $2}' |awk -F"/" '{print $1}'`
key_user=`grep $key_ip /tmp/check/inform.txt |awk '{print $2}'`
hosts_ip=`echo $inform |awk '{print $1}'`
hosts_user=`echo $inform |awk '{print $2}'`
hosts_root_pass=`echo $inform |awk '{print $4}'`
if [ "$hosts_ip" != "$key_ip" ] ; then
sleep 1
else
continue
fi
# remote translate some file
su - $key_user <<-START
ssh $hosts_user@$hosts_ip <<-EOF
mkdir /tmp/check
EOF
scp -r /tmp/check/mutual_trust.sh $hosts_user@$hosts_ip:/tmp/check/mutual_trust.sh
scp -r /tmp/check/inform.txt $hosts_user@$hosts_ip:/tmp/check/inform.txt
START
# exec nutual_trust.sh
/usr/bin/expect <<-SSHROOT
spawn ssh root@$hosts_ip
expect {
"yes/no" { send "yes\r";exp_continue }
"password:" { send "$hosts_root_pass\r" }
}
expect "#" {
send "cd /tmp/check/;sh /tmp/check/mutual_trust.sh\r"
send "rm -rf /tmp/check/\r"
send "exit\r"
}
expect eof
SSHROOT
done &>/dev/null < /tmp/check/inform.txt
# restore separator
IFS=$IFS_OLD
—————————————————————————————————————————
inform.txt #服务器相关信息
—————————————————————————————————————————
192.168.44.100 tom tom wxsec.com
192.168.44.150 tom tom wxsec.com
192.168.44.200 tom tom wxsec.com
—————————————————————————————————————————
readme.txt #脚本使用指导文件
—————————————————————————————————————————
1. 脚本包含文件如下：
start.sh #互信配置启动脚本
mutual_trust.sh #单向互信配置脚本
inform.txt #配置互信配置文件
readme.txt #脚本使用指导文件
2. 配置文件介绍：
配置内容共分为四列：
第一列：主机名或主机IP地址，如果使用主机名，需要首先手动配置hostsIP地址解析
第二列：需要配置互信的用户名，脚本会根据提供的用户去创建互信用户
第三列：需要配置互信的用户密码，脚本会自动为账户添加密码
第四列：主机的root用户的密码，便于某些需要使用root执行的操作
3. 脚本使用方法：
# tar zxvf mutual_trust.tar.gz
# vim inform.txt #编辑并配置配置文件
# sh start.sh
4. 注意事项：
通过该脚本配置完成互信后，脚本会自动清除脚本身创建的/tmp/check以及该目录下的文件。
但是本地执行脚本的服务器不会自动删除，为避免服务器信息泄露，互信配置完成后续手动删除本地的/tmp/check及该目录下的文件。
脚本中间输出的信息已经全部重定向到/dev/null的空设备中，如需要过程信息，可以打开.sh脚本文件删除重定向即可。
——————————————————————————————————————————