SSH passing your Public key to all the users on remote host

Question

I've grown tired of typing my password back and forth to all the hosts you connect to, i want to be able to jump to every single user on all the hosts with ease.

So i've made this script with a quite messy oneliner at the end of it.

The script first reads user input where to connect to.

remote_user, remote_host and remote_port.

echo "Enter the user you want to connect with (sudo needs to be enabled and installed)"
read -e rUser

echo "Enter the host you want to connect to"
read -e rHost


echo "Enter the SSH-port"
read -e rPort

read -s -p "Enter Password: " password 

Checks if ssh-key is generated, if not proceeds with ssh-keygen for the user to generate a strong key.

if [ ! -d "$HOME/.ssh" ] && [ ! -f "$HOME/.ssh/id_rsa" ] && [ ! -f "$HOME/.ssh/id_rsa.pub" ]; then
    echo -e "Private / Public keys not generated"
    echo -e "Generating..."
    ssh-keygen -b 4096
fi

After that we proceed with establishing ssh-connection and creating the authorized_keys file on the remote host.

(Annoying 'bug' here you have to enter the password twice, since it doesnt seem possible to read ssh-password from stdin.)

cat "$HOME/.ssh/id_rsa.pub" | ssh "$rUser@$rHost" -p $rPort "cat >> ~/.ssh/authorized_keys"

Since the script will only be run once per remote host, its acceptable.

We continue with the quite messy oneliner.

We're establishing an SSH connection, to solve the problem with password over SSH we pass the -S parameter to SUDO that lets us read the password from STDIN. Now our subsequent SUDO calls will work. We proceed and create the .ssh directories for all the users on the system if they dont exist.

We create the authorized_keys file for all users and set correct owner, then we append authorized_keys file of the user we connected with.

remoteUsers=($(ssh "$rUser@$rHost" -p $remotePort  
'echo '"$password"' | sudo -S ls /home/ && for localUser 
in $(ls /home | grep -v $USER); do sudo mkdir -p /home/$localUser/.ssh && 
sudo touch /home/$localUser/.ssh/authorized_keys 
&& sudo chown "$localUser:$localUser" /home/$localUser/.ssh/authorized_keys && 
cat /home/$USER/.ssh/authorized_keys | sudo tee 
 --append /home/$localUser/.ssh/authorized_keys > /dev/null; done'))

Not that pretty. But i don't know how to improve this without considering another approach for the sudo over SSH problem.

And finally we write our .ssh/config with all the users in it.

for remoteUser in "${remoteUsers[@]}"
do
   cat <<< "Host ${remoteUser}_${rHost}
            HostName $rHost
            Port $rPort
            User $remoteUser" >> /home/$USER/.ssh/config
   done

Below is the script in its entirety.

#!/bin/bash

echo "Enter the user you want to connect with (sudo needs to be enabled and installed)"
read -e rUser # -e Identifier bash feature

echo "Enter the host you want to connect to"
read -e rHost # -e Identifier bash feature


echo "Enter the SSH-port"
read -e rPort

read -s -p "Enter Password: " password 

# Generate private public ssh-keys 
if [ ! -d "$HOME/.ssh" ] && [ ! -f "$HOME/.ssh/id_rsa" ] && [ ! -f "$HOME/.ssh/id_rsa.pub" ]; then
    echo -e "Private / Public keys not generated"
    echo -e "Generating..."
    ssh-keygen -b 4096
fi

# Send public key to remote host
echo "Sending public key to remote host..."
cat "$HOME/.ssh/id_rsa.pub" | ssh "$rUser@$rHost" -p $rPort "cat >> ~/.ssh/authorized_keys"
remoteUsers=($(ssh "$rUser@$rHost" -p $rPort 'echo '"$password"' | sudo -S ls /home/ && for localUser in $(ls /home | grep -v $USER); do sudo mkdir -p /home/$localUser/.ssh && sudo touch /home/$localUser/.ssh/authorized_keys && sudo chown "$localUser:$localUser" /home/$localUser/.ssh/authorized_keys && cat /home/$USER/.ssh/authorized_keys | sudo tee --append /home/$localUser/.ssh/authorized_keys > /dev/null; done'))

for remoteUser in "${remoteUsers[@]}"
do
    cat <<< "Host ${remoteUser}_${rHost}
            HostName $rHost
            Port $rPort
            User $remoteUser" >> /home/$USER/.ssh/config
done

Answer 1

That looks crazy. But some constructive comments:

• Did you check for ssh-copy-id script, that is usually shipped with openssh? It solves for you the first part of your problem in standard way.

• The second problem is in my eyes non-existent. Do you really need your authorized_keys in all accounts? Isn't it enough for one user that can do sudo?

• The third is part is interesting. SSH config file is useful thing and I appreciate that you use it. I see the main plus in the auto-complete of full user_host string in your case (instead of user@host, where ssh would help only with the host part), but if you would use only one user, you would not need that either.

• You need to count with the case that sudo might not accept password without TTY or from pipe on command-line.

• Sending password in command like this might be also security issue, since the command might get logged somewhere on the remote host (debug output or in audit).

Answer 2

The conditions to create keys

The condition on the directory seems a bit excessive here:

if [ ! -d "$HOME/.ssh" ] && [ ! -f "$HOME/.ssh/id_rsa" ] && [ ! -f "$HOME/.ssh/id_rsa.pub" ]; then
    echo -e "Private / Public keys not generated"
    echo -e "Generating..."
    ssh-keygen -b 4096
fi

My concern is that if the key files are missing but the directory exists, the script will not create the keys. But it's not unusual that the directory would exist without keys. For example the directory is created when you connect to a remote server for the first time, to store the known_hosts file. So I suggest to drop the condition on the directory:

if [ ! -f "$HOME/.ssh/id_rsa" ] && [ ! -f "$HOME/.ssh/id_rsa.pub" ]; then

Prefer input redirection instead of cat

Instead of using a cat process:

cat "$HOME/.ssh/id_rsa.pub" | ssh "$rUser@$rHost" -p $rPort "cat >> ~/.ssh/authorized_keys"

It's more efficient and elegant to use input redirection:

ssh "$rUser@$rHost" -p $rPort "cat >> ~/.ssh/authorized_keys" < "$HOME/.ssh/id_rsa.pub"

Running long snippets on a remote server

This is pretty much unreadable:

remoteUsers=($(ssh "$rUser@$rHost" -p $remotePort  
'echo '"$password"' | sudo -S ls /home/ && for localUser 
in $(ls /home | grep -v $USER); do sudo mkdir -p /home/$localUser/.ssh && 
sudo touch /home/$localUser/.ssh/authorized_keys 
&& sudo chown "$localUser:$localUser" /home/$localUser/.ssh/authorized_keys && 
cat /home/$USER/.ssh/authorized_keys | sudo tee 
 --append /home/$localUser/.ssh/authorized_keys > /dev/null; done'))

Here's a more readable way to write it:

remoteUsers=($(ssh "$rUser@$rHost" -p $remotePort  << EOF
echo "$password" | sudo -S ls /home/ && \
for localUser in \$(ls /home | grep -v \$USER); do
    sudo mkdir -p /home/$localUser/.ssh && \
    sudo touch /home/$localUser/.ssh/authorized_keys && \
    sudo chown "$localUser:$localUser" /home/$localUser/.ssh/authorized_keys && \
    cat /home/\$USER/.ssh/authorized_keys | sudo tee --append /home/$localUser/.ssh/authorized_keys > /dev/null
done
EOF
))

Just be careful: notice that the $ that should be executed on the remote and not locally, such as $(ls ...) and $USER must be escaped.

Security

The security concerns raised by @Jakuje are very valid. It would be better to not execute sudo on the remote like this. If ssh-copy-id is not an option, another alternative is to run the script for each remote user one by one, so that there's no more need for sudo.