password_reset

#!/bin/bash
set -euo pipefail
IFS=$'\n\t'

TMP=$(mktemp -d )
function finish {
  openssl smime -encrypt -aes128 -in "$TMP/content" -to "${RECIPIENTS%,}" -subject "Root password change" -from "root <root@$(hostname -f)>" "$TMP"/cert*  | sendmail -ti
  rm -rf "$TMP"
}
trap finish EXIT

RECIPIENTS=""
while IFS=: read -a cert; do
  tail -n +"${cert}" "${BASH_SOURCE}" | awk '1;/END CERTIFICATE/{exit}' > "$TMP/cert_${cert}.pem"
  RECIPIENTS="$RECIPIENTS$(openssl x509 -noout -email -in "$TMP/cert_${cert}.pem"),"
done < <(grep -n "[B]EGIN CERTIFICATE" "${BASH_SOURCE}")
echo "Content-Type: text/plain; charset=utf-8" > "$TMP/content"
echo >> "$TMP/content"
for host in $(gethosts); do
  echo -n "$host " >> "$TMP/content"
  echo "root:$(apg -n 1 -m 15)" | tee -a "$TMP/content" | ssh "${host}" "chpasswd" 2> "$TMP/error" || cat <(echo -n "Ignore previous host, password not changed -> ") "$TMP/error" >> "$TMP/content"
done

exit 0
# Put any certificates that should be used to encrypt the password file to after this comment. You should create an RSA cert with a 2048
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----