Script to help change passwd in AIX

[lblauen]

I'm looking for a script for AIX to help change roots password on many systems. We have to change roots password every other month and now I log into all the servers and make a new password for root. How can I do this in a script??

for i in `cat aixlist`
do
rsh $i passwd
??????
The aixlist has all the systems I need to figure out a way to type the command changepw test
This should go to each system as my id in this case root and change the password to test. Can this be done and how? I looked at the command from smit and couldn't figure out how to make it non interactive.

 

[columb]

There is (deliberately) no easy solution.

Options are
1) use expect - I've never done this so I can't comment further
2) use your favourite script language to edit /etc/security/passwd so that the encrypted password string is the same on all boxes - very dangerous. if you corrupt /etc/security/passwd you break the box.
3) log on individually and change each one by hand (which is what I do)
4) If you're using AIX 4.3.3 then there is a password amending tool available on the Bull website

http://www.bullfreeware.com/

aixtools package. You can run this remotely or from batch files.

Columb Healy
Living with a seeker after the truth is infinitely preferable to living with one who thinks they've found it.

 

[columb]

There is (deliberately) no easy solution.

Options are
1) use expect - I've never done this so I can't comment further
2) use your favourite script language to edit /etc/security/passwd so that the encrypted password string is the same on all boxes - very dangerous. if you corrupt /etc/security/passwd you break the box.
3) log on individually and change each one by hand (which is what I do)
4) If you're using AIX 4.3.3 then there is a password amending tool available on the Bull website

http://www.bullfreeware.com/

aixtools package. You can run this remotely or from batch files.

BTW - shouldn't this be in the AIX forum

Columb Healy
Living with a seeker after the truth is infinitely preferable to living with one who thinks they've found it.

 

[lblauen]

No this is a script question. I too do #3 but there should be a easyer way to do it.

 

[RodKnowlton]

How many systems are you talking about? Do you really want a tool that will allow a hacker to own all of them at once (not that having the same root password on all servers doesn't already do that)?

You could build a fairly secure solution using ssh/scp, expect, and ssh keys on a removable media, but it would still be a single point of compromise for all of your machines. Plus it wouldn't exactly be easy to implement.

Ease of use and security are diametrically opposed attributes. When it comes to something like the root password, it's better to be on the security side.

Rod Knowlton
IBM Certified Advanced Technical Expert pSeries and AIX 5L
CompTIA Linux+
CompTIA Security+