* Added support to specify @group values for the --targets parameter and in the targets file(s)

* Added support for nested aliases: up to 5 levels deep instead of just
one level
* Added --resolve-alias/--alias command-line parameter to manually check
the resolution any alias
* Fixed propagation of --debug flag (to clients & slaves)
* Fixed propagation of --create-dir flag (to clients & slaves)
* Fixed problem in --fix-local routine (by adding optional --fix-user
command-line parameter and code)
* Fixed check when adding key to ssh-agent
* Added checking on alias resolution in --check-syntax routine
* Better trap setting
* Added typeset-ing to vars
* Switched version numbering (now date based)
* Code cleanup (now error & warning free in shellcheck/perlcritic
linters)

manage_ssh.conf

@@ -13,7 +13,7 @@
 # (leave blank for current user)
 SSH_TRANSFER_USER=""
 
-# name of the OS group that should own the SSH controls files
+# name of the UNIX group that should own the SSH controls files (must exist already)
 SSH_OWNER_GROUP="sshadmin"
 
 # whether a 'chmod' needs to be executed after each sftp transfer [0=No; 1=Yes]

update_ssh.pl

@@ -41,12 +41,14 @@ use Pod::Usage;
 #******************************************************************************
 
 # ------------------------- CONFIGURATION starts here -------------------------
-# define the V.R.F (version/release/fix)
+# define the version (YYYY-MM-DD)
-my $MY_VRF = "1.2.0";
+my $script_version = "2018-11-03";
 # name of global configuration file (no path, must be located in the script directory)
 my $global_config_file = "update_ssh.conf";
 # name of localized configuration file (no path, must be located in the script directory)
 my $local_config_file = "update_ssh.conf.local";
+# maxiumum level of recursion for alias resolution
+my $max_recursion = 5;
 # selinux context labels of key files for different RHEL version
 my %selinux_contexts = ( '5' => 'sshd_key_t',
                          '6' => 'ssh_home_t',
@@ -57,7 +59,7 @@ my ($debug, $verbose, $preview, $remove, $global, $use_fqdn) = (0,0,0,0,0,0);
 my (@config_files, @zombie_files, $access_dir, $blacklist_file);
 my (%options, @uname, @pwgetent, @accounts, %aliases, %keys, %access, @blacklist);
 my ($os, $hostname, $run_dir);
-my ($selinux_status, $selinux_context, $linux_version, $has_selinux) = ("","","",0);
+my ($selinux_status, $selinux_context, $linux_version, $has_selinux, $recursion_count) = ("","","",0,1);
 $|++;
 
 
@@ -185,7 +187,7 @@ pod2usage(-verbose => 0) unless (%options);
 # check version parameter
 if ($options{'version'}) {
     $verbose = 1;
-    do_log ("INFO: $0: version $MY_VRF");
+    do_log ("INFO: $0: version $script_version");
     exit (0);
 }
 # check help parameter
@@ -310,7 +312,7 @@ do_log ("INFO: ".scalar (@accounts)." user accounts found on $hostname");
 print Dumper (\@accounts) if $debug;
 
 # -----------------------------------------------------------------------------
-# read aliases for teams, servers and users
+# read aliases for teams, servers and users (and resolve group definitions)
 # result: %aliases
 # -----------------------------------------------------------------------------
 
@@ -334,13 +336,45 @@ close (ALIASES);
 do_log ("DEBUG: dumping unexpanded aliases:");
 print Dumper (\%aliases) if $debug;
 
-# we can nest aliases one level deep, so do a one-level recursive sort of lookup
+# resolve aliases recursively to a maxium of $max_recursion
-# of the remaining '@' aliases. Input should be passed as comma-separated
+while ($recursion_count <= $max_recursion) {
-# string to resolve_aliases so don't forget to smash everything back together
+    # crawl over all items in the hash %aliases
-# first.
+    foreach my $key (keys (%aliases)) {
-foreach my $key (keys (%aliases)) {
+        # crawl over all items in the array @{aliases{$key}}
-
+        my @new_array; my @filtered_array;  # these are the working stashes
-    $aliases{$key} = [resolve_aliases (join (",", @{$aliases{$key}}))]; 
+        do_log ("DEBUG: expanded alias $key before recursion $recursion_count [$hostname]");
+        print Dumper (\@{$aliases{$key}}) if $debug;
+        foreach my $item (@{$aliases{$key}}) {
+            # is it a group?
+            if ($item =~ /^\@/) {
+                # expand the group if it exists
+                if ($aliases{$item}) {
+                    # add current and new items to the working stash
+                    if (@new_array) {
+                        push (@new_array, @{$aliases{$item}});
+                    } else {
+                        @new_array = (@{$aliases{$key}}, @{$aliases{$item}});
+                    }
+                    # remove the original group item from the working stash
+                    @filtered_array = grep { $_ ne $item } @new_array;
+                    @new_array = @filtered_array;
+                } else {
+                    do_log ("WARN: unable to resolve alias $item [$hostname]");
+                }
+            # no group, just add the item as-is to working stash
+            } else {
+                push (@new_array, $item);
+            }
+        }
+        # filter out dupes
+        my %seen;
+        @filtered_array = grep { not $seen{$_}++ } @new_array;
+        # re-assign working stash back to our original hash key
+        @{$aliases{$key}} = @filtered_array;
+        do_log ("DEBUG: expanded alias $key after recursion $recursion_count [$hostname]");
+        print Dumper (\@{$aliases{$key}}) if $debug;
+    }
+    $recursion_count++;
 }
 
 do_log ("INFO: ".scalar (keys (%aliases))." aliases found on $hostname");
@@ -766,11 +800,3 @@ S<       >Show version of the script.
 =head1 AUTHOR
 
 (c) KUDOS BVBA, Patrick Van der Veken
-
-=head1 history
-
-@(#) 2014-12-04: VRF 1.0.0: first version [Patrick Van der Veken]
-@(#) 2014-12-16: VRF 1.0.1: added SELinux context, new config option 'selinux_context' [Patrick Van der Veken]
-@(#) 2015-08-08: VRF 1.0.2: small fix for 'cut' command [Patrick Van der Veken]
-@(#) 2015-08-15: VRF 1.1.0: replace uname/hostname syscalls, now support for FQDN via $use_fqdn, other fixes [Patrick Van der Veken]
-@(#) 2015-08-26: VRF 1.2.0: replace read of /etc/passwd by pwgetent() call, small and not so small fixes [Patrick Van der Veken]