TweetFollow Us on Twitter

Mac in the Shell: Mass Remote Management with dshell

Volume Number: 24 (2008)
Issue Number: 01
Column Tag: Mac in the Shell

Mac in the Shell: Mass Remote Management with dshell

Or, mass remote management without ARD

by Edward Marczak

Introduction

A feature article this month covers methods to manage an army of Macs post-deployment. In other words, after they've been imaged and rolled out to the masses. The products and methods listed there are certainly applicable and appropriate for many situations. I'm going to describe yet another method that comes in handy in other situations. dsh, the distributed shell, can run a command over groups of machines that you specify. It performs this magic over ssh, so, you can affect machines over LAN or WAN links, near or far. Since OS X and other machines have ssh in their base distribution, you can command across platforms. This article explains how you, too, can send out commands to all or a group of your Macs - simultaneously - with a single press of the return key.

Getting the Goods

While there are many nice apps in the base distribution of OS X, dsh is not one of them. dsh is an agentless controlling app, so fortunately, you only need to retrieve, compile and install on one host, or any admin station that you need. You'll need a compiler on some station to compile the program - typically meaning having Apple's developer tools installed.

Two downloads are needed to get us going. Visit this page:

http://www.netfort.gr.jp/~dancer/software/downloads/list.cgi

and retrieve the latest versions of dsh and libdshconfig. As of this writing, they are:

http://www.netfort.gr.jp/~dancer/software/downloads/dsh-0.25.9.tar.gz

http://www.netfort.gr.jp/~dancer/software/downloads/libdshconfig-0.20.9.tar.gz

It's easy to take care of everything while in terminal: just use curl to download the files needed (use "curl -O http://.."), tar to unpack (tar xzvf filename) and then it's simple to compile. Both pieces of code compile cleanly in OS X 10.4 and 10.5, and install in /usr/local by default. Enter the libdshconfig directory that you just unpacked, and simply enter the following commands (your entries in bold):

$ ./configure
checking for a BSD-compatible install... /usr/bin/install -c
[output snipped]
config.status: creating Makefile
config.status: creating config.h
config.status: executing depfiles commands
$ make
make  all-am
[output snipped]
creating libdshconfig.la
(cd .libs && rm -f libdshconfig.la && ln -s ../libdshconfig.la libdshconfig.la)
$ sudo make install
Password:
/bin/sh ./mkinstalldirs /usr/local/lib
[output snipped]
 /usr/bin/install -c -m 644 libdshconfig.h /usr/local/include/libdshconfig.h

Next, we need to do the same for dsh itself. Change into the dsh directory you unpacked, and repeat the same process that you just went through for libdshconfig (configure, make, sudo make install). The entire process should take you less than 5 minutes. Literally.

While you can alter the install directory, I recommend that you leave the default values, and have the binaries and config files installed under /usr/local. I'll be referencing that as the install location throughout this article.

You can verify installation by typing "/usr/local/bin/dsh". You should be told, "dsh: no machine specified", and dsh would be right.

The configuration

Now that we have dsh installed on our administrative machine, how do we use it? Fortunately, under Leopard, /usr/local is a 'blessed' location, and is already in our $MANPATH. If you're using 10.4, you'll need to add "/usr/local/share/man" to $MANPATH and export it, or re-source your init file. dsh comes with some short-but-useful man pages. First, we'll need to update the configuration file.

If you left each application take the default values during their configure stage, and I recommend that you do, you'll find the main config file at /usr/local/etc/dsh.conf. We need to make one change to this file. So, whip out your favorite text editor, and change the line that reads:

remoteshell =rsh

to read:

remoteshell =ssh

(If you're daring, this can be achieved in one line with sed: sudo sed -i .back s/rsh/ssh/ dsh.conf). You may also want to change the "waitshell" value from "1" to "0". With a setting of 1, dsh will block execution until the previous machine has returned. As I said, you may want to change this. It's really applicable for very large rollouts. There's a man page available for the configuration file accessible with "man dsh.conf".

Determining the Target Machines

Before we continue, we need to take a step back and plan things out a bit. We need to determine which machines we're going to be targeting. Since we've chosen ssh as the remote mechanism, each machine that we're going to want to control needs ssh enabled. Now a days, this is the default for most platforms and distributions. That said, unless we want to enter our password each time we make a dsh run, we're going to want to create a public key and install it on any machine that we want to administer. Also, we also need a list of computers for dsh. This list basically tells dsh, "hey - run this command on all of these machines."

ssh was covered extensively in this column in the October 2007 issue, but, as a quick refresher, here's the sequence of creating a public key for ssh's use:

$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/admin/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /Users/admin/.ssh/id_rsa.
Your public key has been saved in /Users/admin/.ssh/id_rsa.pub.
The key fingerprint is:
6e:4b:ca:45:2d:c7:3d:14:d2:34:1e:ad:45:a5:fc:8e admin@machine-name.local

In this sequence, you simply press enter when asked for the passphrase and to verify. Notice that the output tells you that "your public key has been saved in...". Change directory to ~/.ssh. We need to copy the contents of the newly generated id_rsa.pub file to each machine that we're going to manage. Fortunately, this is a one-time step.

Easiest instructions to write: ssh to the machine you're going to target, using the admin-level account that you'll be running remote commands with:

ssh admin@remote.example.com

Once in, run this command:

ssh user@my.machine.com "cat ~/.ssh/id_rsa.pub" >> ~/.ssh/authorized_keys

where 'user' is the user account that you just had generate the key for, and "my.machine.com" is the machine where that user id resides - likely the machine you're on right now. Once done, type exit, and then try to ssh again. This time, you should not be asked for a password, but rather, simply receive a remote shell.

In the event that you cannot ssh back to your machine, you can always manually copy your key to the remote machine and add its contents to the ~/.ssh/authorized_keys file on the target account. For more about ssh, creating ssh keys and troubleshooting, see my ssh article in the October 200 issue of MacTech Magazine.

While you are accessing each remote machine, you need to keep a list of the account that you're accessing it with, and its fully qualified domain name (FQDN) or IP address. Once complete, take this list and enter it into /usr/local/etc/machines.list in this format:

/usr/local/etc/machines.list
nyadmin@ny.radiotope.com
caadmin@ca.radiotope.com
fladmin@fl.radiotope.com
azadmin@az.radiotope.com

Now comes the fun part!

Spreading the Joy

Let's start with a easy one: viewing the uptime statistics on all of the machines we've identified. This is as easy as:

$ dsh -a uptime 16:38 up 14 days, 9:27, 2 users, load averages: 0.19 0.13 0.16 16:38 up 59 days, 7:09, 1 user, load averages: 0.02 0.02 0.00 13:42 up 93 days, 3:25, 2 users, load averages: 0.02 0.02 0.00 1:39PM up 213 days, 4:01, 0 users, load averages: 0.12, 0.08, 0.04

It's a complete coincidence that those are in order of uptime! However, that raises the question: what order are they in? The "-M" switch will prepend the machine name before its output. Let's see that in action:

$ dsh -M -a uptime
nyadmin@ny.radiotope.com: 16:41  up 14 days,  9:30, 2 users, load averages: 0.47 0.27 0.21
fladmin@fl.radiotope.com: 16:41  up 59 days,  7:12, 1 user, load averages: 0.00 0.00 0.00
azadmin@az.radiotope.com: 13:45  up 93 days,  3:28, 2 users, load averages: 0.01 0.02 0.00
caadmin@ca.radiotope.com:  1:42PM  up 213 days,  4:04, 0 users, load averages: 0.04, 0.07, 0.04

There, that's a little better. The "-a" switch tells dsh to run the command against all machines that we've defined.

If you opted to not use a waitshell - your config file still has the line "waitshell =1" - you can override this at runtime using the "-c" switch. Also, if there's a machine that you have not added to your machines.list file, but want to use it ad-hoc, use the "-m" switch. Combining all of these options would look like this:

$ dsh -M -c -m txadmin@tx.radiotope.com -a 'last | head -1'
fladmin@fl.radiotope.com: fladmin  ttyp0    192.168.70.108   Thu Nov 29 15:22 - 15:22  (00:00)
caadmin@caadmin.radiotope.com: caadmin  ttyp1    192.168.70.108   Thu Nov 29 15:09 - 15:09  (00:00)
nyadmin@ny.radiotope.com: nyadmin  ttyp2    192.168.70.108   Thu Nov 29 12:29 - 12:29  (00:00)
Password:
txadmin@tx.radiotope.com: root      ttys000  w1.z2.nyc-ny.example.net Thu Nov 29 09:29 - 09:35  (00:05)
fladmin@fl.radiotope.com: fladmin          ttyp0    10.0.2.3       Thu Nov 29 13:37 - 13:37  (00:00)

In one fell swoop, this runs the command "last | head -1" on all machine defined in our machines.list file and additionally on "tx.radiotope.com". You'll see the "Password:" prompt in the output above as tx.radiotope.com wasn't preconfigured and is using password authentication. Once the (correct) password is entered, it happily gives us the output we're looking for, just like the other machines.

Final Tips

dsh is useful enough already, but how can we make our lives even easier? First, you may not always want to run all commands on all machines. There are two ways around this. One way is to use a group file. Simply create a file using the same format as machines.list and store it in /usr/local/etc/group/groupname. So, let's say we wanted to target all of our West Coast servers. We could create /usr/local/etc/group/west_coast and add to it:

/usr/local/etc/group/west_coast
waadmin@wa.radiotope.com
caadmin@ca.radiotope.com
oradmin@or.radiotope.com

Now, we can run commands against just this group:

$ dsh -M -g west_coast w

This will give us "who" (w) information from each server in the "west_coast" group.

Also, you can specify full server lists in an ad-hoc fashion. Create a file using the machines.list format, and specify it with the "-f" switch.

Nicely, if a machine definition ends up in multiple files, specifying it multiple times will be reduced to a single invocation.

The real magic here is that all input to dsh are simple text files. Decisions can be made, results grabbed from a database, files created on the fly and commands send to appropriate groups of machines. Think about how you could group machines: by location, by service (web, directory services), by class (PPC, dual-proc), by use (administrative, development), etc.

In Conclusion...

Despite the subhead, I don't believe dsh is meant to replace ARD. However, for server management, it may fit into your workflow better and can reach out to machines that ARD can't touch (think Linux or BSD servers...even Windows, with the right software and mindset). This can give you some incredible control over armies of machines. You have all the power of a shell on the remote machine. You can be very creative and powerful with this!

Until I found dshell, I used to do something similar by using a for loop to execute commands across machines:

for i in `cat servers.txt`; do
ssh root@$i softwareupdate -i -a
done

However, dsh has been thought out much more than the "for-loop-solution" and is much more extendible.

Don't run dsh in your production environment until you read the man page, which details some other options for limiting how many remote machines are accessed at any given time. (Look for the -N and -F options, specifically).

Media of the month: Walt Whitman, The Complete Poems. Start the year off with some poetry - especially if it's not your usual fare. Walt Whitman doesn't do it for you? Check out James Joyce or Emily Dickenson - there are amazing gems in that timeless writing.

Happy New Year!


Ed Marczak is the owner of Radiotope, a technology solution provider. He is also a husband, father and avid wearer of pants. tail -f /dev/brain at http://www.radiotope.com/writing

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

TunnelBear 3.0.1 - Subscription-based pr...
TunnelBear is a subscription-based virtual private network (VPN) service and companion app, enabling you to browse the internet privately and securely. Features Browse privately - Secure your data... Read more
ExpanDrive 5.4.0 - Access cloud storage...
ExpanDrive builds cloud storage in every application, acts just like a USB drive plugged into your Mac. With ExpanDrive, you can securely access any remote file server directly from the Finder or... Read more
Opera 40.0.2308.62 - High-performance We...
Opera is a fast and secure browser trusted by millions of users. With the intuitive interface, Speed Dial and visual bookmarks for organizing favorite sites, news feature with fresh, relevant content... Read more
Apple iOS 10.0.2 - The latest version of...
iOS 10 is the biggest release of iOS ever. A massive update to Messages brings the power of the App Store to your conversations and makes messaging more personal than ever. Find your route with... Read more
Herald 7.0 - Notification plugin for Mai...
Note: Versions 2.1.3 (for OS X 10.7), 3.0.6 (for OS X 10.8), 4.0.8 (for OS X 10.9), 5.0.2 (for OS X 10.10), and 6.0.3 (for OS X 10.11) are no longer supported by the developer. Herald is a... Read more
Postbox 5.0.2 - Powerful and flexible em...
Postbox is a new email application that helps you organize your work life and get stuff done. It has all the elegance and simplicity of Apple Mail, but with more power and flexibility to manage even... Read more
Yummy FTP Pro 1.11.10 - $29.99
Yummy FTP Pro is an advanced Mac file transfer app which provides a full-featured professional toolkit combined with blazing speeds and impeccable reliability, so whether you want to transfer a few... Read more
Tidy Up 4.1.17 - $29.99
Tidy Up is a full-featured duplicate finder and disk-tidiness utility. Features With Tidy Up you can search for duplicate files and packages by the owner application, content, type, creator,... Read more
Logitech Control Center 3.9.5 - Keyboard...
Logitech Control Center (LCC) is designed to support OS X and allows you to take full advantage of your Logitech keyboard, mouse, or trackball. With the LCC you can: Browse the Internet using... Read more
Macgo Blu-ray Player 2.16.17 - Blu-ray p...
Macgo Blu-ray Player can bring you the most unforgettable Blu-ray experience on your Mac. Overview Macgo Mac Blu-ray Player can satisfy just about every need you could possibly have in a Blu-ray... Read more

How to build and care for your team in D...
Before you hit the trail and become a dog sledding legend, there’s actually a fair bit of prep work to be done. In Dog Sled Saga, you’re not only racing, you’re also building and caring for a team of furry friends. There’s a lot to consider—... | Read more »
How to win every race in Dog Sled Saga
If I had to guess, I’d say Dog Sled Saga is the most adorable racing game on the App Store right now. It’s a dog sled racing sim full of adorable, loyal puppies. Just look at those fluffy little tails wagging. Behind that cute, pixelated facade is... | Read more »
Let the war games commence in Gunship Ba...
Buzz Lightyear famously said, “This isn’t flying, this is falling – with style!” In the case of Gunship Battle: Second War, though, this really is flying - with style! The flight simulator app from Joycity puts you in control of 20 faithfully... | Read more »
How to get a high score in Fired Up
Fired Up is Noodlecake Games’ high score chasing, firefighting adventure. You take control of a wayward firefighter who propels himself up the side of a highrise with blasts of water. Sound silly? It is. It’s also pretty difficult. You can’t... | Read more »
NBA 2K17 (Games)
NBA 2K17 1.0 Device: iOS iPhone Category: Games Price: $7.99, Version: 1.0 (iTunes) Description: Following the record-breaking launch of NBA 2K16, the NBA 2K franchise continues to stake its claim as the most authentic sports video... | Read more »
Dog Sled Saga (Games)
Dog Sled Saga 1.0.1 Device: iOS Universal Category: Games Price: $3.99, Version: 1.0.1 (iTunes) Description: A game by Dan + Lisa As a rookie musher, foster a dogsledding team whose skills will grow if they're treated right. Week by... | Read more »
60 Seconds! Atomic Adventure (Games)
60 Seconds! Atomic Adventure 1.2 Device: iOS Universal Category: Games Price: $2.99, Version: 1.2 (iTunes) Description: 60 Seconds! is a dark comedy atomic adventure of scavenge and survival. Collect supplies and rescue your family... | Read more »
Tons of Bullets! (Games)
Tons of Bullets! 1.0 Device: iOS Universal Category: Games Price: $1.99, Version: 1.0 (iTunes) Description: Tons of BulletsA retro 2D pixel platformer infused with tons of bullets and tons of features!Fight as Kenji the Ninja and... | Read more »
Sorcery! 4 (Games)
Sorcery! 4 1.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0 (iTunes) Description: *** PLEASE NOTE: Sorcery! 4 requires a minimum of iPad 3 or iPhone 4 *** An epic adventure through a cursed citadel of monsters,... | Read more »
Building the perfect Animation Throwdown...
Animation Throwdown is a casual card game full of plenty of inside jokes from some of your favorite cartoons. It’s accessible as far as card games go, but that’s not to say that it hands your victories to you easily. There’s quite a bit that goes... | Read more »

Price Scanner via MacPrices.net

Duplicate Sweeper Free On Mac App Store For O...
To celebrate the launch of Apple’s latest macOS Sierra, Stafford, United Kingdom based Wide Angle Software has announced that its duplicate file finder software, Duplicate Sweeper, is now available... Read more
13-inch Retina MacBook Pros on sale for up to...
B&H Photo has 13″ Retina Apple MacBook Pros on sale for up to $150 off MSRP. Shipping is free, and B&H charges NY tax only: - 13″ 2.7GHz/128GB Retina MacBook Pro: $1174.99 $125 off MSRP - 13... Read more
Evidence Surfaces Pointing To New A10X Chip F...
Citing a job description for a Project Lead position at Apple’s Austin, Texas engineering labs, Motley Fool’s Ashraf Eassa deduces that development is progressing well on Apple’s next-generation in-... Read more
Check Print’R for macOS Allows Anyone to Easi...
Delaware-based Match Software has announced the release and immediate availability of Check Print’R 3.21, an important update to their easy-to-use check printing application for macOS. Check Print’R... Read more
Apple refurbished 11-inch MacBook Airs availa...
Apple has Certified Refurbished 11″ MacBook Airs (the latest models), available for up to $170 off the cost of new models. An Apple one-year warranty is included with each MacBook, and shipping is... Read more
Apple refurbished 15-inch Retina MacBook Pros...
Apple has Certified Refurbished 2015 15″ Retina MacBook Pros available for up to $380 off the cost of new models. An Apple one-year warranty is included with each model, and shipping is free: - 15″ 2... Read more
Major Version 5 Release Of Free myTuner Radio...
AppGeneration Software has announced the release of myTuner Radio 5.0.1, an important update to their live radio app for iOS and Android platforms. With myTuner Radio, you can listen to more than 30,... Read more
TheAppStore Searches And Filters iOS And macO...
Boston based InchWest has announced the official launch of TheAppStore, a free web based service that lets users search iOS and Mac apps on the web without iTunes or the App store. TheAppStore... Read more
2TB Time Capsule on sale for $199, save $100
Amazon has 2TB Apple Time Capsules on sale for $199 including free shipping. Their price is $100 off MSRP. Choose Amazon as the seller when making your purchase, rather than a third party seller. Read more
12-inch 1.2GHz Rose Gold Retina MacBook on sa...
Amazon.com has the 2016 12″ 1.2GHz Rose Gold Retina MacBook on sale for $1254.02 including free shipping. Their price is $345 off MSRP, and it’s the lowest price available for this model from any... Read more

Jobs Board

Restaurant Manager (Neighborhood Captain) - A...
…in every aspect of daily operation. WHY YOU'LL LIKE IT: You'll be the Big Apple . You'll solve problems. You'll get to show your ability to handle the stress and Read more
*Apple* Retail - Multiple Positions- Napervi...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
US- *Apple* Store Leader Program - Apple (Un...
…Summary Learn and grow as you explore the art of leadership at the Apple Store. You'll master our retail business inside and out through training, hands-on Read more
*Apple* Retail - Multiple Positions (US) - A...
Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, you're also the Read more
Restaurant Manager (Neighborhood Captain) - A...
…in every aspect of daily operation. WHY YOU'LL LIKE IT: You'll be the Big Apple . You'll solve problems. You'll get to show your ability to handle the stress and Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.