Skill: stj001/ssh-batch-manager (version 2.1.9)

--- name: ssh-batch-manager description: Batch SSH key management. Distribute/remove SSH keys to/from multiple servers with intelligent connectivity pre-check and source tracking. homepage: https://gitee.com/subline/onepeace/tree/develop/src/skills/ssh-batch-manager metadata: { "openclaw": { "emoji": "🔑", "requires": { "bins": ["ssh", "ssh-copy-id", "sshpass"], "python_packages": ["cryptography"] }, "install": [ { "id": "python", "kind": "pip", "package": "cryptography", "label": "Install cryptography library", }, { "id": "sshpass", "kind": "apt", "package": "sshpass", "label": "Install sshpass for password-based SSH", }, { "id": "post-install", "kind": "script", "script": "post-install.sh", "label": "Configure and auto-start Web UI service", }, ], }, } --- # SSH Batch Manager ## ⚠️ CRITICAL SAFETY RULE **EN: Before executing ANY enable operation (enable-all, enable-single, etc.), the agent MUST obtain explicit user confirmation via message. NEVER execute enable operations without explicit user approval.** **Reason**: Enable operations modify SSH access on remote servers. Unauthorized execution could cause security issues or service disruptions. **Confirmation examples**: - ✅ "enable ssh all" - Explicit command - ✅ "yes, execute enable-all" - Explicit confirmation - ❌ Silent execution - **PROHIBITED** - ❌ Inferring user intent - **PROHIBITED** --- Batch management of SSH key-based authentication. ## 🚀 Installation ### Via Clawhub (Auto-Start Enabled) ```bash # Install skill clawhub install ssh-batch-manager # Post-install script automatically: # ✅ Configure systemd service # ✅ Start Web UI service # ✅ Enable auto-start on boot # ✅ No manual configuration needed! ``` ### Manual Installation ```bash # Install dependencies pip install cryptography sshpass # Generate encryption key python3 ssh-batch-manager.py generate-key # Create configuration python3 ssh-batch-manager.py create-config # Generate SSH key pair python3 ssh-batch-manager.py generate-ed25519 # Run post-install script (auto-start Web UI) cd ~/.openclaw/workspace/skills/ssh-batch-manager bash post-install.sh ``` --- ## 🌐 Web UI **Auto-started on installation!** **Access**: http://localhost:8765 **Features**: - ⚡ Quick operations (Enable All / Disable All) - 🔑 SSH public key management (Read/Copy/Download) - 🖥️ Server list management - 🔐 Encryption tools - 📝 Real-time operation logs **Manual Start** (if needed): ```bash python3 serve-ui.py ``` --- ## Features - ✅ **Intelligent connectivity pre-check** - Skip servers that are already accessible (40x faster) - ✅ **Source identifier** - Add source info to authorized_keys for audit trail - ✅ **Mandatory safety confirmation** - Require explicit user approval before enable operations - ✅ **SQLite + LRU cache** - High-performance mapping storage - ✅ **Auto cleanup** - Expired entries removed automatically - ✅ **Auto-start Web UI** - Web interface starts automatically on installation ## Commands ### SSH Key Management | Command | Description | |---------|-------------| | `enable-all` | Distribute public key to all configured servers | | `disable-all` | Remove public key from all servers | | `enable <user@host> [port]` | Distribute to single server | | `disable <user@host> [port]` | Remove from single server | ### Encryption Tools | Command | Description | |---------|-------------| | `encrypt <password>` | Encrypt a password | | `encrypt-file <file>` | Encrypt file (output to `.enc`) | | `decrypt-file <file>` | Decrypt file | | `generate-key` | Generate encryption key | | `generate-ed25519` | Generate ed25519 SSH key pair | ## Configuration **Location**: `~/.openclaw/credentials/ssh-batch.json` **Format**: ```json { "version": "2.0", "auth_method": "password", "servers": [ { "user": "root", "host": "10.8.8.81", "port": 22, "auth": "password", "password": "AES256:encrypted_password_here" } ] } ``` ## Security Notes - ✅ Passwords stored with AES-256 encryption - ✅ Key file permissions: 600 - ✅ Config file permissions: 600 - ✅ Web UI auto-starts with systemd - ⚠️ Never commit keys to git - ⚠️ Rotate keys periodically ## Performance | Operation | Latency | |-----------|---------| | Hot query (cache) | < 0.1ms | | Cold query (SQLite) | ~0.5ms | | Write | < 2ms | | Max records | 100,000+ | **v2.1 improvements**: - First run: ~8s (8 servers) - Repeated runs: ~2s (all skipped) - **40x faster** for repeated executions ## Source Identifier When distributing keys, adds source info to `authorized_keys`: ``` ssh-ed25519 AAAAC3... ssh-batch-manager from mls at 2026-03-03 17:30:00 ``` **Fields**: - `ssh-batch-manager` - Tool identifier - `from mls` - Source hostname - `at 2026-03-03 17:30:00` - Distribution timestamp ## Version History ### v2.1.0 (2026-03-03) - **CRITICAL**: Require explicit user confirmation before enable operations - Intelligent connectivity pre-check (skip already accessible servers) - Add source identifier to authorized_keys - Clean test configurations (production servers only) - Performance improvement: 40x faster for repeated runs - **Auto-start Web UI service on installation** ### v2.0 (2026-03-03) - JSON configuration format - Support key-based authentication - Mixed mode support (password + key) - ed25519 key support (Ubuntu/Alpine compatible) ### v1.0 (2026-03-03) - Initial release - Enable/Disable all support - AES-256 encryption - Batch operations ## Repository **Source**: https://gitee.com/subline/onepeace/tree/develop/src/skills/ssh-batch-manager **License**: MIT **Author**: TK **Issues**: https://gitee.com/subline/onepeace/issues ## Related Skills - `sensitive-data-masker` - Intelligent sensitive data detection and masking - `healthcheck` - Security hardening and audits


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)