This patch extends the '-H' option to support NIS netgroups and introduces an exclude option '-E' to ignore certain hosts from existing groups.

Sorry, this is off course not a defect but a proposed enhancement.

Hi!

A bit delayed, but I finally I found time to rework this patch as you suggested.

There are actually two patches:

cli_exclude.patch:

introduces an exclude Option '-E'. Its arguments are compiled into a regular expression and matching hosts will be subtracted from the given host list. For NIS netgroups this is an important features since these are rather static in nature.

I chose to centralise the host-option parsing code and put it in psshtutil.py.

nis_support.patch (depends on the former patch)

This patch enables the use of NIS netgroups preceded by an '@' prefix with the '-H' option. It depends on ctypes and libc6.so and will therefore most likely not work on Windows hosts. But if you do not use netgroups the corresponding code is never run.

I will gladly answer questions and am open for feedback. Feel free to use this as you consider appropriate.

This version of nis_support.patch should work a lot better. Sorry for the confusion.

It seems like there are potentially two ways to do specify exclusions: 1) an exclude option (as in this patch), 2) prefixing a host with a "-". I admit I haven't really thought about this enough to have a preference. Is there any particular reason that the exclude option is better?

The reliance on ctypes makes me a little uncomfortable, but this seems like a useful enough use case that I can see including it. It might be helpful, though, to give a message like "netgroups are not supported on this platform" if an "@" is specified but ctypes can't load.

One might argue that a command like

$ pss -H -help -h myhosts.txt ...

looks confusing (help would in this case be a host called help). That is: provided optparser is not offended by option values starting with '-' and throws an exception.

The exclude-patch arguments are actually exclude patterns and I consider this a more convenient feature than just excluding individual strings prefixed by a '-'.

This is a modified nis_support.patch. I prints a more detailed error message and raises an exception in case libc.6.so cannot be loaded.

Additionally resolve_netgroup() expects the netgroup strings including the leading '@'.

Would this suit your expectations better?

This is looking pretty good. I'll be sure to include this in the next release. Thank you very much for your contribution.

Hi Andrew, I thought a README might be helpful. The patch is attached to this message.