From: Matt Lawrence <matt@...>
Date: 2008-05-27T10:03:15+09:00
Subject: Re: Need your recommendations for TCP Server/Client design

On Mon, 26 May 2008, Victor Reyes wrote:

>   2. ssh *IS permitted.*
>   3. We are less than than 10 UNIX admins.
>   4. We have over 100 AIX servers behind splitted among vlans and each
>   behind different firewalls.

10 admins for only 100 servers?  You've got it easy!

>   8. My *first solution* was using *ssh* as it is fully allowed by the sec
>   group. Since authenticating would be impractical when executing a cmd on
>   over 100 servers, we created public/private keys, which was a pain below the
>   waist to distribute for everyone. Also, since in many instances we needed to
>   run *root* commands, that was a real problem since we would have to
>   either setup keys for root or implement* sudo*. That's why I decided to
>   create my own poor-man distributed remote command processor.

You only need to distribute keys the hard way once.  After that, you can 
use the existing account to distribute more keys.  In my last job, this 
was known as the "abuse matt" option since I was the first person to have 
keys everywhere.  Using sudo is a very good idea, I highly recommend you 
install and configure it.

>   1. log-in with her userid as we do daily and su to root.
>   2. Execute a root cmd remotely on a server or multiple servers and
>   receive the reply on the local server. We use one server as a the main
>   server. Kind of a control work station.
>   3. The communication between the main (local) server and the remote
>   server(s) must be "secured" (ssh, ssl, encryption, whatever)

Take a look at gsh/ghosts.  Written in perl, but it works very well.

-- Matt
It's not what I know that counts.
It's what I can remember in time to use.