diff --git a/manage_ssh.conf b/manage_ssh.conf index 16d59f2..6492ba4 100644 --- a/manage_ssh.conf +++ b/manage_ssh.conf @@ -45,6 +45,16 @@ SSH_KEYSCAN_BIN="/usr/bin/ssh-keyscan" # by default -f is used by manage_sudo.sh to supply hostnames, do not add here SSH_KEYSCAN_ARGS="-t rsa" +# whether to start an SSH agent process for the master->client operations [0=No; 1=Yes] +DO_SSH_AGENT=0 + +# whether to start an SSH agent process for the master->slave->client operations [0=No; 1=Yes] +DO_SSH_SLAVE_AGENT=0 + +# location of the SSH private key that should be added to the SSH agent process +# must be a passphrase-less key (required when using DO_SSH_AGENT, DO_SSH_SLAVE_AGENT) +SSH_PRIVATE_KEY="$HOME/.ssh/id_rsa" + # maximum number of background process to spawn (~maxuprc, ~nstrpty etc) MAX_BACKGROUND_PROCS=30 diff --git a/manage_ssh.sh b/manage_ssh.sh index 41eedb9..dce7de1 100644 --- a/manage_ssh.sh +++ b/manage_ssh.sh @@ -2,7 +2,7 @@ #****************************************************************************** # @(#) manage_ssh.sh #****************************************************************************** -# @(#) Copyright (C) 2014 by KUDOS BVBA . All rights reserved. +# @(#) Copyright (C) 2014 by KUDOS BVBA (info@kudos.be). All rights reserved. # # This program is a free software; you can redistribute it and/or modify # it under the same terms of the GNU General Public License as published by @@ -18,13 +18,16 @@ # ----------------------------------------------------------------------------- # @(#) MAIN: manage_ssh.sh # DOES: performs basic functions for SSH controls: update SSH keys locally or -# remote, create SSH key fingerprints or distribute the SSH controls files +# remote, create SSH key fingerprints, distribute the SSH controls files, +# discover SSH host keys. # EXPECTS: (see --help for more options) # REQUIRES: check_config(), check_logging(), check_params(), check_root_user(), # check_setup(), check_syntax(), count_fields(), die(), display_usage(), -# distribute2host(), do_cleanup(), fix2host(), get_linux_version(), -# log(), logc(), resolve_host(), sftp_file(), update2host(), -# update_fingerprints(), wait_for_children(), warn() +# distribute2host(), distribute2slave(), do_cleanup(), fix2host(), +# fix2slave(), get_linux_name(), get_linux_version(), log(), logc(), +# resolve_host(), sftp_file(), start_ssh_agent(), stop_ssh_agent(), +# update2host(), update2slave(), update_fingerprints(), +# wait_for_children(), warn() # For other pre-requisites see the documentation in display_usage() # # @(#) HISTORY: @@ -53,6 +56,9 @@ # @(#) (VRF 1.3.3) [Patrick Van der Veken] # @(#) 2015-09-27: added SSH host keys discovery, re-assigned '-d' command-line # @(#) option to this function (VRF 1.4.0) [Patrick Van der Veken] +# @(#) 2015-10-03: added --slave option, 3 new configuration parameters & supporting +# @(#) functions for master->slave operations, several bug fixes +# @(#) (VRF 1.5.0) [Patrick Van der Veken] # ----------------------------------------------------------------------------- # DO NOT CHANGE THIS FILE UNLESS YOU KNOW WHAT YOU ARE DOING! #****************************************************************************** @@ -66,7 +72,7 @@ # or LOCAL_CONFIG_FILE instead # define the V.R.F (version/release/fix) -MY_VRF="1.4.0" +MY_VRF="1.5.0" # name of the global configuration file (script) GLOBAL_CONFIG_FILE="manage_ssh.conf" # name of the local configuration file (script) @@ -79,11 +85,13 @@ PATH=${PATH}:/usr/bin:/usr/local/bin SCRIPT_NAME=$(basename $0) SCRIPT_DIR=$(dirname $0) OS_NAME="$(uname)" +HOST_NAME="$(hostname)" KEYS_FILE="" KEYS_DIR="" TARGETS_FILE="" FIX_CREATE=0 CAN_DISCOVER_KEYS=0 +CAN_START_AGENT=1 KEY_COUNT=0 KEY_1024_COUNT=0 KEY_2048_COUNT=0 @@ -154,6 +162,18 @@ then print -u2 "ERROR: no value for the SSH_KEYSCAN_BIN setting in the configuration file" exit 1 fi +# DO_SSH_AGENT +if [[ -z "${DO_SSH_AGENT}" ]] +then + print -u2 "ERROR:no value for the DO_SSH_AGENT setting in the configuration file" + exit 1 +fi +# DO_SSH_SLAVE_AGENT +if [[ -z "${DO_SSH_SLAVE_AGENT}" ]] +then + print -u2 "ERROR:no value for the DO_SSH_SLAVE_AGENT setting in the configuration file" + exit 1 +fi # MAX_BACKGROUND_PROCS if [[ -z "${MAX_BACKGROUND_PROCS}" ]] then @@ -240,6 +260,15 @@ then REMOTE_DIR="${ARG_REMOTE_DIR}" fi fi +# --slave +if (( DO_SLAVE )) +then + # requires a list of targets (=slave servers) + [[ -n "${ARG_TARGETS}" ]] || { + print -u2 "ERROR: you must specify a list of targets with the --slave option" + exit 1 + } +fi # --targets if [[ -n "${ARG_TARGETS}" ]] then @@ -296,13 +325,12 @@ then if [[ -z "${ARG_TARGETS}" ]] then TARGETS_FILE="${LOCAL_DIR}/targets" - if [ \( ! -r "${TARGETS_FILE}" \) -a \( ! -r "/var/tmp/targets.${USER}" \) ] + if [[ ! -r "${TARGETS_FILE}" ]] then - print -u2 "ERROR: cannot read file ${TARGETS_FILE} nor /var/tmp/targets.${USER}" + print -u2 "ERROR: cannot read file ${TARGETS_FILE}" + print -u2 "ERROR: possibly this is not a master or slave server" exit 1 fi - # override default targets file - [[ -r "/var/tmp/targets.${USER}" ]] && TARGETS_FILE="/var/tmp/targets.${USER}" else TARGETS_FILE=${TMP_FILE} fi @@ -353,6 +381,23 @@ then print -u2 "WARN: 'ssh-keyscan' tool not found, host key discovery is not possible" CAN_DISCOVER_KEYS=0 fi +# check for SSH agent pre-requisites +if (( DO_SSH_AGENT || DO_SSH_SLAVE_AGENT )) +then + # ssh-agent + which ssh-agent 2>/dev/null + if (( $? )) + then + print -u2 "WARN: ssh-agent not available on ${HOST_NAME}" + CAN_START_AGENT=0 + fi + # private key + if [[ ! -r "${SSH_PRIVATE_KEY}" ]] + then + print -u2 "WARN: SSH private key not found ${SSH_PRIVATE_KEY}, ssh-agent disabled" + CAN_START_AGENT=0 + fi +fi return 0 } @@ -465,21 +510,21 @@ Performs basic functions for SSH controls: update SSH keys locally or remote, create SSH key fingerprints or copy/distribute the SSH controls files Syntax: ${SCRIPT_DIR}/${SCRIPT_NAME} [--help] | (--backup | --check-syntax | --preview-global | --make-finger | --update ) | - (--apply [--remote-dir=] [--targets=,,...]) | - ((--copy|--distribute) [--remote-dir= [--targets=,,...]]) | + (--apply [--slave] [--remote-dir=] [--targets=,,...]) | + ((--copy|--distribute) [--slave] [--remote-dir= [--targets=,,...]]) | (--discover [--targets=,,...]) | - ([--fix-local --fix-dir= [--create-dir]] | [--fix-remote [--create-dir] [--targets=,,...]]) - [--local-dir=] [--no-log] [--log-dir=] [--debug] + ([--fix-local --fix-dir= [--create-dir]] | [--fix-remote [--slave] [--create-dir] [--targets=,,...]]) + [--local-dir=] [--no-log] [--log-dir=] [--debug] Parameters: --apply|-a : apply SSH controls remotely (~targets) --backup|-b : create a backup of the SSH controls repository (SSH master) ---create-dir : also create missing directories when fixing the SSH controls - repository (see also --fix-local/--fix-remote) --check-syntax|-s : do basic syntax checking on SSH controls configuration (access, alias & keys files) --copy|-c : copy SSH control files to remote host (~targets) +--create-dir : also create missing directories when fixing the SSH controls + repository (see also --fix-local/--fix-remote) --debug : print extra status messages on STDERR --discover|-d : discover SSH host keys (STDOUT) --distribute : same as --copy @@ -489,24 +534,25 @@ Parameters: --fix-remote : fix permissions on the remote SSH controls repository --help|-h : this help text --local-dir : location of the SSH control files on the local filesystem. - [default: ${LOCAL_DIR}] + [default: see LOCAL_DIR setting] --log-dir : specify a log directory location. --no-log : do not log any messages to the script log file. --make-finger|-m : create (local) key fingerprints file --preview-global|-p : dump the global access namespace (after alias resolution) --remote-dir : directory where SSH control files are/should be located/copied on/to the target host - [default: ${REMOTE_DIR}] + [default: see REMOTE_DIR setting] +--slave : perform actions in master->slave mode --targets : comma-separated list of target hosts to operate on. Override the hosts contained in the 'targets' configuration file. --update|-u : apply SSH controls locally --version|-V : show the script version/release/fix -Note 1: distribute and update actions are run in parallel across a maximum of - ${MAX_BACKGROUND_PROCS} clients at the same time. +Note 1: copy and apply actions are run in parallel across a maximum of clients + at the same time [default: see MAX_BACKGROUND_PROCS setting] -Note 2: for fix and update actions: make sure correct 'sudo' rules are setup +Note 2: for fix and apply actions: make sure correct 'sudo' rules are setup on the target systems to allow the SSH controls script to run with elevated privileges. @@ -585,7 +631,7 @@ else log "transferred ${KEYS_FILE} to ${SERVER}:${REMOTE_DIR}" else warn "failed to transfer ${KEYS_FILE} to ${SERVER}:${REMOTE_DIR} [RC=${COPY_RC}]" - ERROR_COUNT = $(( ERROR_COUNT + 1 )) + ERROR_COUNT=$(( ERROR_COUNT + 1 )) fi fi # discover a keys blacklist file, also copy it across if we find one @@ -605,7 +651,7 @@ then log "transferred ${BLACKLIST_FILE} to ${SERVER}:${REMOTE_DIR}" else warn "failed to transfer ${BLACKLIST_FILE%!*} to ${SERVER}:${REMOTE_DIR} [RC=${COPY_RC}]" - ERROR_COUNT = $(( ERROR_COUNT + 1 )) + ERROR_COUNT=$(( ERROR_COUNT + 1 )) fi fi fi @@ -613,6 +659,33 @@ fi return ${ERROR_COUNT} } + +# ----------------------------------------------------------------------------- +# distribute SSH controls to a single host in slave mode +function distribute2slave +{ +SERVER="$1" + +# convert line to hostname +SERVER=${SERVER%%;*} +resolve_host ${SERVER} +if (( $? )) +then + warn "could not lookup host ${SERVER}, skipping" + return 1 +fi + +log "copying SSH controls on ${SERVER} in slave mode, this may take a while ..." +( RC=0; ssh -A ${SSH_ARGS} ${SERVER} ${REMOTE_DIR}/${SCRIPT_NAME} --copy; + print "$?" > ${TMP_RC_FILE}; exit +) 2>&1 | logc + +# fetch return code from subshell +RC="$(< ${TMP_RC_FILE})" + +return ${RC} +} + # ----------------------------------------------------------------------------- function do_cleanup { @@ -622,7 +695,7 @@ log "performing cleanup ..." [[ -f ${TMP_FILE} ]] && rm -f ${TMP_FILE} >/dev/null 2>&1 [[ -f ${TMP_MERGE_FILE} ]] && rm -f ${TMP_MERGE_FILE} >/dev/null 2>&1 [[ -f ${TMP_RC_FILE} ]] && rm -f ${TMP_RC_FILE} >/dev/null 2>&1 -log "*** finish of ${SCRIPT_NAME} [${CMD_LINE}] ***" +log "*** finish of ${SCRIPT_NAME} [${CMD_LINE}] /$$@${HOST_NAME}/ ***" return 0 } @@ -643,7 +716,7 @@ then warn "could not lookup host ${SERVER}, skipping" return 1 fi -log "fixing ssh controls on ${SERVER} ..." +log "fixing SSH controls on ${SERVER} ..." if [[ -z "${SSH_UPDATE_USER}" ]] then # own user w/ sudo @@ -669,14 +742,52 @@ RC="$(< ${TMP_RC_FILE})" return ${RC} } +# ----------------------------------------------------------------------------- +# fix SSH controls on a single host/client in slave mode (permissions/ownerships) +# !! requires appropriate 'sudo' rules on remote client for privilege elevation +function fix2slave +{ +SERVER="$1" +SERVER_DIR="$2" + +# convert line to hostname +SERVER=${SERVER%%;*} +resolve_host ${SERVER} +if (( $? )) +then + warn "could not lookup host ${SERVER}, skipping" + return 1 +fi + +log "fixing SSH controls on ${SERVER} in slave mode, this may take a while ..." +( RC=0; ssh -A ${SSH_ARGS} ${SERVER} ${REMOTE_DIR}/${SCRIPT_NAME} --fix-remote --fix-dir=${SERVER_DIR}; + print "$?" > ${TMP_RC_FILE}; exit +) 2>&1 | logc + +# fetch return code from subshell +RC="$(< ${TMP_RC_FILE})" + +return ${RC} +} + +# ----------------------------------------------------------------------------- +function get_linux_name +{ +LSB_NAME="$(lsb_release -is 2>/dev/null | cut -f2 -d':')" + +print "${LSB_NAME}" + +return 0 +} + # ----------------------------------------------------------------------------- function get_linux_version { -LSB_VERSION=$(lsb_release -rs 2>/dev/null | cut -f1 -d'.') +LSB_VERSION="$(lsb_release -rs 2>/dev/null | cut -f1 -d'.')" if [[ -z "${LSB_VERSION}" ]] then - RELEASE_STRING=$(/bin/grep -i 'release' /etc/redhat-release 2>/dev/null) + RELEASE_STRING="$(grep -i 'release' /etc/redhat-release 2>/dev/null)" case "${RELEASE_STRING}" in *release\ 5*) @@ -696,8 +807,9 @@ then else print "${LSB_VERSION}" fi -} +return 0 +} # ----------------------------------------------------------------------------- # log an INFO: message (via ARG). @@ -901,6 +1013,78 @@ cd ${OLD_PWD} return ${SFTP_RC} } +# ----------------------------------------------------------------------------- +# start a SSH agent +function start_ssh_agent +{ +log "requested to start an SSH agent on ${HOST_NAME} ..." + +# is there one still running, then we re-use it +if [[ -n "${SSH_AGENT_PID}" ]] +then + log "SSH agent already running on ${HOST_NAME} with PID: ${SSH_AGENT_PID}" +else + # start the SSH agent + eval $(ssh-agent) >/dev/null 2>/dev/null + + if [[ -z "${SSH_AGENT_PID}" ]] + then + warn "unable to start SSH agent on ${HOST_NAME}" + return 1 + else + log "SSH agent started on ${HOST_NAME}:" + log "$(ps -fp ${SSH_AGENT_PID})" + fi +fi + +# add the private key +log "adding private key ${SSH_PRIVATE_KEY} to SSH agent on ${HOST_NAME} ..." +log "$(ssh-add ${SSH_PRIVATE_KEY} 2>&1)" +if (( $? )) +then + warn "unable to add SSH private key to SSH agent on ${HOST_NAME}" + return 1 +fi + +return 0 +} + +# ----------------------------------------------------------------------------- +function stop_ssh_agent +{ +# stop the SSH agent +log "stopping SSH agent (if needed) on ${HOST_NAME} ..." + +if [[ -n "${SSH_AGENT_PID}" ]] +then + # SIGTERM + log "stopping (TERM) process on ${HOST_NAME} with PID: ${SSH_AGENT_PID}" + log "$(ps -fp ${SSH_AGENT_PID})" + kill -s TERM ${SSH_AGENT_PID} + sleep 3 + + # SIGKILL + if (( $(pgrep -u "${USER}" ssh-agent | grep -c "${SSH_AGENT_PID}") )) + then + log "stopping (KILL) process on ${HOST_NAME} with PID: ${SSH_AGENT_PID}" + log "$(ps -fp ${SSH_AGENT_PID})" + kill -s kill ${SSH_AGENT_PID} + fi + sleep 3 +else + log "no SSH agent running on ${HOST_NAME}" +fi + +# process check +if (( $(pgrep -u "${USER}" ssh-agent | grep -c "${SSH_AGENT_PID}") )) +then + warn "unable to stop running SSH agent on ${HOST_NAME} [PID=${SSH_AGENT_PID}]" + return 1 +fi + +return 0 +} + # ----------------------------------------------------------------------------- # update SSH controls on a single host/client # !! requires appropriate 'sudo' rules on remote client for privilege elevation @@ -942,6 +1126,32 @@ RC="$(< ${TMP_RC_FILE})" return ${RC} } +# ----------------------------------------------------------------------------- +# update SSH controls on a single host/client in slave mode +function update2slave +{ +SERVER="$1" + +# convert line to hostname +SERVER=${SERVER%%;*} +resolve_host ${SERVER} +if (( $? )) +then + warn "could not lookup host ${SERVER}, skipping" + return 1 +fi + +log "applying ssh controls on ${SERVER} in slave mode, this may take a while ..." +( RC=0; ssh -A ${SSH_ARGS} ${SERVER} ${REMOTE_DIR}/${SCRIPT_NAME} --apply; + print "$?" > ${TMP_RC_FILE}; exit +) 2>&1 | logc + +# fetch return code from subshell +RC="$(< ${TMP_RC_FILE})" + +return ${RC} +} + # ----------------------------------------------------------------------------- # update the 'fingerprints' file (must exist beforehand) function update_fingerprints @@ -1138,9 +1348,6 @@ do } ARG_ACTION=7 ;; - -s|--check-syntax|-check-syntax) - ARG_ACTION=8 - ;; -fix-local|--fix-local) (( ARG_ACTION )) && { print -u2 "ERROR: multiple actions specified" @@ -1155,12 +1362,12 @@ do } ARG_ACTION=6 ;; - -m|-make-finger|--make-finger) + -s|-check-syntax|--check-syntax) (( ARG_ACTION )) && { print -u2 "ERROR: multiple actions specified" exit 1 } - ARG_ACTION=3 + ARG_ACTION=8 ;; -u|-update|--update) (( ARG_ACTION )) && { @@ -1199,6 +1406,9 @@ do --remote-dir=*) ARG_REMOTE_DIR="${PARAMETER#--remote-dir=}" ;; + -slave|--slave) + DO_SLAVE=1 + ;; -targets=*) ARG_TARGETS="${PARAMETER#-targets=}" ;; @@ -1237,15 +1447,32 @@ check_params && check_config && check_setup && check_logging # catch shell signals trap 'do_cleanup; exit' 1 2 3 15 -log "*** start of ${SCRIPT_NAME} [${CMD_LINE}] ***" +log "*** start of ${SCRIPT_NAME} [${CMD_LINE}] /$$@${HOST_NAME}/ ***" (( ARG_LOG )) && log "logging takes places in ${LOG_FILE}" log "runtime info: LOCAL_DIR is set to: ${LOCAL_DIR}" case ${ARG_ACTION} in - 1) # apply SSH controls remotely + 1) # apply SUDO controls remotely log "ACTION: apply SSH controls remotely" check_root_user && die "must NOT be run as user 'root'" + # start SSH agent (if needed) + if (( DO_SSH_AGENT && CAN_START_AGENT )) + then + start_ssh_agent + if (( $? )) + then + die "problem with launching an SSH agent, bailing out" + fi + fi + if (( DO_SLAVE && DO_SSH_SLAVE_AGENT && CAN_START_AGENT )) + then + start_ssh_agent + if (( $? )) + then + die "problem with launching an SSH agent, bailing out" + fi + fi # build clients list (in array) cat "${TARGETS_FILE}" | grep -v -E -e '^#' -e '^$' |\ { @@ -1261,7 +1488,12 @@ case ${ARG_ACTION} in COUNT=${MAX_BACKGROUND_PROCS} for CLIENT in ${CLIENTS[@]} do - update2host ${CLIENT} & + if (( DO_SLAVE )) + then + update2slave ${CLIENT} & + else + update2host ${CLIENT} & + fi PID=$! log "updating ${CLIENT} in background [PID=${PID}] ..." # add PID to list of all child PIDs @@ -1280,12 +1512,31 @@ case ${ARG_ACTION} in # final wait for background processes to be finished completely wait_for_children ${PIDS} || \ warn "$? background jobs (possibly) failed to complete correctly" - + # stop SSH agent if needed + (( ( DO_SSH_AGENT || ( DO_SLAVE && DO_SSH_SLAVE_AGENT )) && CAN_START_AGENT )) && \ + stop_ssh_agent log "finished applying SSH controls remotely" ;; 2) # copy/distribute SSH controls log "ACTION: copy/distribute SSH controls" check_root_user && die "must NOT be run as user 'root'" + # start SSH agent (if needed) + if (( DO_SSH_AGENT && CAN_START_AGENT )) + then + start_ssh_agent + if (( $? )) + then + die "problem with launching an SSH agent, bailing out" + fi + fi + if (( DO_SLAVE && DO_SSH_SLAVE_AGENT && CAN_START_AGENT )) + then + start_ssh_agent + if (( $? )) + then + die "problem with launching an SSH agent, bailing out" + fi + fi # build clients list (in array) cat "${TARGETS_FILE}" | grep -v -E -e '^#' -e '^$' |\ { @@ -1301,7 +1552,12 @@ case ${ARG_ACTION} in COUNT=${MAX_BACKGROUND_PROCS} for CLIENT in ${CLIENTS[@]} do - distribute2host ${CLIENT} & + if (( DO_SLAVE )) + then + distribute2slave ${CLIENT} & + else + distribute2host ${CLIENT} & + fi PID=$! log "copying/distributing to ${CLIENT} in background [PID=${PID}] ..." # add PID to list of all child PIDs @@ -1320,6 +1576,9 @@ case ${ARG_ACTION} in # final wait for background processes to be finished completely wait_for_children ${PIDS} || \ warn "$? background jobs (possibly) failed to complete correctly" + # stop SSH agent if needed + (( ( DO_SSH_AGENT || ( DO_SLAVE && DO_SSH_SLAVE_AGENT )) && CAN_START_AGENT )) && \ + stop_ssh_agent log "finished copying/distributing SSH controls" ;; 3) # create key fingerprints @@ -1423,24 +1682,29 @@ case ${ARG_ACTION} in # check for SELinux labels case ${OS_NAME} in *Linux*) - case "$(getenforce)" in - *Permissive*|*Enforcing*) - LINUX_VERSION=$(get_linux_version) - case "${LINUX_VERSION}" in - 5) - chcon -R -t sshd_key_t "${FIX_DIR}/keys.d" + LINUX_NAME="$(get_linux_name)" + LINUX_VERSION="$(get_linux_version)" + case ${LINUX_NAME} in + *Centos*|*RHEL*) + case "$(getenforce 2>/dev/null)" in + *Permissive*|*Enforcing*) + case "${LINUX_VERSION}" in + 5) + chcon -R -t sshd_key_t "${FIX_DIR}/keys.d" + ;; + 6|7) + chcon -R -t ssh_home_t "${FIX_DIR}/keys.d" + ;; + *) + chcon -R -t etc_t "${FIX_DIR}/keys.d" + ;; + esac ;; - 6|7) - chcon -R -t ssh_home_t "${FIX_DIR}/keys.d" - ;; - *) - chcon -R -t etc_t "${FIX_DIR}/keys.d" + *Disabled*) + : ;; esac ;; - *Disabled*) - : - ;; esac ;; *) @@ -1455,6 +1719,23 @@ case ${ARG_ACTION} in 6) # fix remote directory structure/perms/ownerships log "ACTION: fix remote SSH controls repository" check_root_user && die "must NOT be run as user 'root'" + # start SSH agent (if needed) + if (( DO_SSH_AGENT && CAN_START_AGENT )) + then + start_ssh_agent + if (( $? )) + then + die "problem with launching an SSH agent, bailing out" + fi + fi + if (( DO_SLAVE && DO_SSH_SLAVE_AGENT && CAN_START_AGENT )) + then + start_ssh_agent + if (( $? )) + then + die "problem with launching an SSH agent, bailing out" + fi + fi # derive SSH controls repo from $REMOTE_DIR: # /etc/ssh_controls/holding -> /etc/ssh_controls FIX_DIR="$(print ${REMOTE_DIR%/*})" @@ -1475,9 +1756,14 @@ case ${ARG_ACTION} in COUNT=${MAX_BACKGROUND_PROCS} for CLIENT in ${CLIENTS[@]} do - fix2host ${CLIENT} "${FIX_DIR}" & + if (( DO_SLAVE )) + then + fix2slave ${CLIENT} "${FIX_DIR}" & + else + fix2host ${CLIENT} "${FIX_DIR}" & + fi PID=$! - log "copying/distributing to ${CLIENT} in background [PID=${PID}] ..." + log "fixing SSH controls on ${CLIENT} in background [PID=${PID}] ..." # add PID to list of all child PIDs PIDS="${PIDS} ${PID}" COUNT=$(( COUNT - 1 )) @@ -1494,6 +1780,9 @@ case ${ARG_ACTION} in # final wait for background processes to be finished completely wait_for_children ${PIDS} || \ warn "$? background jobs (possibly) failed to complete correctly" + # stop SSH agent if needed + (( ( DO_SSH_AGENT || ( DO_SLAVE && DO_SSH_SLAVE_AGENT )) && CAN_START_AGENT )) && \ + stop_ssh_agent log "finished applying fixes to the remote SSH control repository" ;; 7) # dump the configuration namespace