I need some advice/discuss on fixing/extending shadow

Things now are sligly slower .. Christmans comes :)
I found more time in bigger piece for rething some plans around 
shadow.

First: shadow have one IMO critacal bug in useradd/usermod when 
usermod/useradd must create directory fo home directory if parent 
directory does not exist. This was repered by Debian pople.

This can be solved by:
- recursive checking and create all neccessary parent directories using
  UMASK,
- exit with verbose error message about for create by hand neccessary 
  directories and setum uid/gid/attrs.

I thing second is correct because:

- on using useradd/usermod someone can pass directory with typos and it 
  can be source some kind of bad scenarios,

- in case for example empty on two level /foo/bar/user tree (if only /foo 
  exist before) for home direcroty paren directory will probably require 
  some setup using chmod/chown/chattr by hand if will be shared by users 
  with common group or few groups.

Now I have few feresh Solarises around and I'm during prepare integrated 
enviroment for share resources by users across this systems. Some users
will be keeped centraly in LDAP database but some other not. Also I'm not 
alone on administration tasks in this enviroment. So .. I need some tools 
set which can work possibly similar in Solaris and Linux.

I see some good things in shadow like tools in Solaris and some things I 
want to integrate on shadow.
Example: in useradd instead extending set of options by adding next 
--<switch> for diffrent things is possible use some template for pass many 
properties for created acount.

[Solaris 10]# useradd -D
group=other,1  project=default,3  basedir=/home
skel=/etc/skel  shell=/bin/bash  inactive=0
expire=  auths=  profiles=  roles=  limitpriv=
defaultpriv=  lock_after_retries=

All above variables can be used by "useradd -K <key>=<value>".
For compare current status useradd from shadow:

[Linux]# useradd -D
GROUP=1000
HOME=/home/users
INACTIVE=-1
EXPIRE=
SHELL=/bin/bash
SKEL=/etc/skel
CREATE_MAIL_SPOOL=yes

Current shadow useradd have undocumented -O option. Fragment from
useradd source code:

                case 'O':
                        /*
                         * override login.defs defaults (-O name=value)
                         * example: -O UID_MIN=100 -O UID_MAX=499
                         * note: -O UID_MIN=10,UID_MAX=499 doesn't work yet
                         */
                        cp = strchr (optarg, '=');
                        if (!cp) {
                                fprintf (stderr,
                                         _("%s: -O requires NAME=VALUE\n"),
                                         Prog);
                                exit (E_BAD_ARG);
                        }
                        /* terminate name, point to value */
                        *cp++ = '\0';
                        if (putdef_str (optarg, cp) < 0)
                                exit (E_BAD_ARG);
                        break;

IMO it will be good kill -O an move this to -K. Also move UID_MIN, UID_MAX 
from login.defs to /etc/default/useradd.
BTW: existing above is why I still resist on integrate handle -r option
(add system account) patch from RH/FC useradd to shadow CVS tree.
It can be now reached without patching useradd by use -O UID_MIN=0.
-r is _redundand_ .. even now.

Next ..
I don't know how hard for accept will be change for example
HOME= -> basedir=, GROUP= -> group= etc. in /etc/default/useradd (?).

IMO make shadow possibly Solaris compliant will open some new possibilites 
afer upcomming OpenSolaris release source code after make Solaris 
development widely opened for open source developers. I think it will make 
better shadow future .. and will allow coexistance Linux and 
Solaris slightly easier (for both ponit of view).

On packaging level in variouse distribution this change in 
/etc/default/useradd can be plugged by simple trigger script on upgrade 
(one sed command).
Other side is how many people this kind of change will disturbe/drive to 
crazy ? ;>

On walking this path I predict it will good prepare some kind "information 
campaining" _before_ start changes. I accep all thing (probably also not 
only good) wich will happen when shadow will walk this path ..  and I 
caunt on some people which will help me on this :)

Next minor thing.
Sometimes I have some set of users for migrate from one system to another 
(not so offen :). I think on this king jobs will be better handled if some 
tools will have {-t|--test} option. Tools .. like useradd, groupadd, 
usermod, groupmod and newusers. All for allow perform two stage 
batch/massive moving/changing/create accounts. On first test stage only 
will be performed for example checking is created account (by useradd) 
will not overlap with some existing accounts (in uid/gid/directories 
area).

Next.
In longer perion I plan completly remove using login.defs and move 
all what is neccessary to /etc/default/<command>.


Simple .. I need some avices/opinions/discusses about above.
And forgiveme me my not so good english ;>

I'm sending this email to two mailing list: Debian shadow package list and 
official shadow package mailing list. So be warned before reply.
Probaly best place for some common discuss will be mailing list 
@pld.org.pl.
Also probably it will be good have around shadow package maintainers from 
other distributions. If someone will know some contact adresses please 
inform/forward this email to them.

kloczek
PS. BTW bug with exit with slightly not understendable error message in
useradd when parent directory not exist also exist in Solaris useradd :^)
-- 
-----------------------------------------------------------
*Ludzie nie mają problemów, tylko sobie sami je stwarzają*
-----------------------------------------------------------
Tomasz Kłoczko, sys adm @zie.pg.gda.pl|*e-mail: [email protected]*

_______________________________________________
shadow mailing list
[email protected]
http://mail.pld.org.pl/mailman/listinfo/shadow