I would like to write a Korn shell script that reads from a list of
servers and for each server, executes a remote shell command that
resets a user's password. However, I want to know if there might be
another way to do this instead of rsh because I think that for
security reasons, all the Berkely commands have been disabled. Does
anybody have any suggestions?

In article 
<27421fb7-3570-434f-adbd-9137eeff42b9@f24g2000prh.googlegroups.com>,
 Jim Nathan <jamcnat@gmail.com> wrote:

> I would like to write a Korn shell script that reads from a list of
> servers and for each server, executes a remote shell command that
> resets a user's password. However, I want to know if there might be
> another way to do this instead of rsh because I think that for
> security reasons, all the Berkely commands have been disabled. Does
> anybody have any suggestions?

This was how I did it in the smallish environment of 30 big servers.  I 
had one machine setup to allow rsh into root.  This was some 10 years 
ago before ssh was installed.  The head of the data center had this 
thing about not installing stuff on production machines unless there was 
a case for it.  The only reason I go to do a project using a web 
interface was because SUN distributed a version of Apache on 2.6 for a 
product that was on that machine.  Same with perl.

Anyway, lots of people will say to use ssh rather than rsh.  And if 
you're going to change passwords from a script, you'll have to install 
expect.  passwd is specifically written to accept input only from a 
terminal running a shell.  expect gets around that:

http://www.exect.nist.gov

-- 
DeeDee, don't press that button!  DeeDee!  NO!  Dee...
[I filter all Goggle Groups posts, so any reply may be automatically by ignored]

>And if 
>you're going to change passwords from a script, you'll have to install 
>expect.  passwd is specifically written to accept input only from a 
>terminal running a shell.  expect gets around that:

>http://www.exect.nist.gov

It's probably no big deal to install expect, but there's a lot of other
ways to do it.

A simple PAM app, pam_start, pam_chauthtok, pam_end and a conv function
is a simple homegrown program that uses only published interfaces...

-Mike