Implementing ZShut: A Step-by-Step Setup for Administrators
1. Prerequisites
- Admin access: Root or administrator privileges on target machines.
- Network reachability: SSH or management ports open between admin host and targets.
- Dependencies: Ensure Python 3.8+ and OpenSSL (or other crypto library ZShut requires) are installed.
- Backup plan: Have console or out-of-band access (iDRAC, iLO, KVM) in case remote shutdown fails.
2. Install ZShut on the Administrator Host
- Download latest ZShut package (assume tarball or installer).
- Verify checksum/signature.
- Install:
bash
sudo tar xzf zshut-<version>.tar.gz -C /opt/ sudo /opt/zshut/install.sh - Confirm binary:
bash
/opt/zshut/bin/zshut –version
3. Configure Authentication and Keys
- Generate a key pair on the admin host:
bash
/opt/zshut/bin/zshut-keygen -o /etc/zshut/adminkey - Copy public key to each target’s ZShut agent directory:
bash
scp /etc/zshut/admin_key.pub admin@target:/etc/zshut/authorizedadmins - Set permissions:
bash
sudo chown root:root /etc/zshut/authorized_admins sudo chmod 600 /etc/zshut/authorizedadmins
4. Install and Configure ZShut Agent on Targets
- Install agent package:
bash
sudo tar xzf zshut-agent-<version>.tar.gz -C /opt/ sudo /opt/zshut-agent/install.sh - Configure agent settings in /etc/zshut/agent.conf:
- ListenAddress: 0.0.0.0 or specific interface
- Port: 6420 (or your chosen port)
- AuthorizedAdminsFile: /etc/zshut/authorizedadmins
- Start and enable agent:
bash
sudo systemctl enable –now zshut-agent sudo systemctl status zshut-agent
5. Network and Firewall Rules
- Open agent port on targets (example for UFW):
bash
sudo ufw allow 6420/tcp sudo ufw reload - Restrict access to admin host IPs where possible.
6. Test Basic Operations
- From admin host, list agents:
bash
/opt/zshut/bin/zshut list - Send a dry-run shutdown:
bash
/opt/zshut/bin/zshut shutdown –target target-host –dry-run - Perform a real shutdown:
bash
/opt/zshut/bin/zshut shutdown –target target-host –reason “Maintenance” - Verify target logs (/var/log/zshut-agent.log) for receipt and action.
7. Implement Safety Controls
- Approval workflows: Require multi-admin approval for production shutdowns.
- Grace periods & warnings: Configure 5–10 minute user warnings and save hooks.
- Whitelist critical systems: Exempt critical infrastructure or require extra confirmation.
8. Monitoring and Logging
- Centralize logs using syslog/rsyslog or ELK stack.
- Enable audit trails on admin host for all shutdown commands.
- Set alerts for failed/unauthorized shutdown attempts.
9. Backup and Recovery Procedures
- Document manual recovery steps for systems left powered off.
- Keep out-of-band access credentials current.
- Regularly test recovery process in a non-production environment.
10. Maintenance and Updates
- Subscribe to ZShut release notes and apply security patches promptly.
- Rotate admin keys periodically and after personnel changes.
- Run quarterly drills to validate shutdown and recovery workflows.
If you want, I can produce sample config files for zshut-agent.conf, a systemd unit, or a shell script to deploy keys to multiple targets.
Leave a Reply