SSH Batch Manager

⚠️ CRITICAL SAFETY RULE

EN: Before executing ANY enable operation (enable-all, enable-single, etc.), the agent MUST obtain explicit user confirmation via message. NEVER execute enable operations without explicit user approval.

Reason: Enable operations modify SSH access on remote servers. Unauthorized execution could cause security issues or service disruptions.

Confirmation examples:

• - ✅ "enable ssh all" - Explicit command
• ✅ "yes, execute enable-all" - Explicit confirmation
• ❌ Silent execution - PROHIBITED
• ❌ Inferring user intent - PROHIBITED

---

Batch management of SSH key-based authentication.

🚀 Installation

Via Clawhub (Auto-Start Enabled)

CODEBLOCK0

Manual Installation

CODEBLOCK1

---

🌐 Web UI

Auto-started on installation!

Access: http://localhost:8765

Features:

• - ⚡ Quick operations (Enable All / Disable All)
• 🔑 SSH public key management (Read/Copy/Download)
• 🖥️ Server list management
• 🔐 Encryption tools
• 📝 Real-time operation logs

Manual Start (if needed):

python3 serve-ui.py

---

Features

• - ✅ Intelligent connectivity pre-check - Skip servers that are already accessible (40x faster)
• ✅ Source identifier - Add source info to authorized_keys for audit trail
• ✅ Mandatory safety confirmation - Require explicit user approval before enable operations
• ✅ SQLite + LRU cache - High-performance mapping storage
• ✅ Auto cleanup - Expired entries removed automatically
• ✅ Auto-start Web UI - Web interface starts automatically on installation

Commands

SSH Key Management

Command	Description
INLINECODE0	Distribute public key to all configured servers
INLINECODE1

Remove public key from all servers | | enable <user@host> [port] | Distribute to single server | | disable <user@host> [port] | Remove from single server |

Encryption Tools

Command	Description
INLINECODE4	Encrypt a password
INLINECODE5

Encrypt file (output to .enc) | | decrypt-file <file> | Decrypt file | | generate-key | Generate encryption key | | generate-ed25519 | Generate ed25519 SSH key pair |

Configuration

Location: INLINECODE10

Format:
CODEBLOCK3

Security Notes

• - ✅ Passwords stored with AES-256 encryption
• ✅ Key file permissions: 600
• ✅ Config file permissions: 600
• ✅ Web UI auto-starts with systemd
• ⚠️ Never commit keys to git
• ⚠️ Rotate keys periodically

Performance

Operation	Latency
Hot query (cache)	< 0.1ms
Cold query (SQLite)

~0.5ms | | Write | < 2ms | | Max records | 100,000+ |

v2.1 improvements:

• - First run: ~8s (8 servers)
• Repeated runs: ~2s (all skipped)
• 40x faster for repeated executions

Source Identifier

When distributing keys, adds source info to authorized_keys:

CODEBLOCK4

Fields:

• - ssh-batch-manager - Tool identifier
• INLINECODE13 - Source hostname
• INLINECODE14 - Distribution timestamp

Version History

v2.1.0 (2026-03-03)

• - CRITICAL: Require explicit user confirmation before enable operations
• Intelligent connectivity pre-check (skip already accessible servers)
• Add source identifier to authorized_keys
• Clean test configurations (production servers only)
• Performance improvement: 40x faster for repeated runs
• Auto-start Web UI service on installation

v2.0 (2026-03-03)

• - JSON configuration format
• Support key-based authentication
• Mixed mode support (password + key)
• ed25519 key support (Ubuntu/Alpine compatible)

v1.0 (2026-03-03)

• - Initial release
• Enable/Disable all support
• AES-256 encryption
• Batch operations

Repository

Source: https://gitee.com/subline/onepeace/tree/develop/src/skills/ssh-batch-manager

License: MIT

Author: TK

Issues: https://gitee.com/subline/onepeace/issues

Related Skills

• - sensitive-data-masker - Intelligent sensitive data detection and masking
• INLINECODE16 - Security hardening and audits