user/group admin scripts (Was: RE: Nice feature)

On Tue, 2004-12-21 at 22:50, Ryan Golhar wrote:
> The things I'm looking for in particular:
> 
> 1.  Uniqueness of User IDs
> 2.  Ability to specify primary group id
> 5.  Ability to set an initial password
> 
> I was able to script my own script minus the uniqueness of user id, and
> I ran into trouble setting the initial password.  If your script does
> this, then it has everything I need, and would like to get a copy if
> possible.  

hmmm... ok. but a word of warning, I am not a talented perl hacker so
these scripts may not be fully robust. Provided you have the required
modules they seem to behave themselves. I dont really use the lusermod
script as I prefer to do as much as possible from a browser so it may
not have much functionality.

I have left attributions at the top of the scripts/module to credit the
original author. I cant remember where I originally found them.

You will have to tweak ldaputils.pm to look for your config file in the
correct place and also each script to point to your perl libraries and
ldaputils.pm. Most functionality should be self explanatory. I've tried
to emulate the functionality of the user{add,mod,del} tools in
linux/unix.

In the config file you can (must) specify lots of stuff. If you give a
home directory prefix and run the script as root on the file server, the
ldapadd script will attempt to create the home directory for you. ie
home directories may be created as /raid3/users/home/fred but when fred
logs in on a host his home directory may be /home/fred as mounted from
the file server. hope that makes sense.

if you have ldap problems (as opposed to perl problems) turn on the
debugging in the config file to see where the script is failing. I've
included the ability to read the rootpw attribute from a file so that
the scripts can be used in an automated fashion if required.

The password is encrypted in CRYPT form in the script but you could use
any encryption method. See the openldap faq-o-matic for example code. I
use CRYPT for legacy support of Irix boxes. Oh that reminds me. there is
a small error in the usage info - you can no longer specify an already
encrypted password. Perhaps I (or someone) should write that back in...

there is lots of room for improvement. I'd like to have a switch to
specify encryption method so I can have SSHA passwords. I'd also like it
to be more tolerant of errors in the config file and to assume sensible
defaults. Best practice would be to keep the next available uidnumber in
the directory itself rather than performing a search each time. As so
often happens, you get it to a "good enough" state and there it stays!
Anyone should feel free to modify and improve these scripts, and to post
the results to the ldap-interop list.

comments welcome

GREG



> 
> Thanks,
> 
> Ryan
> 
> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]] On Behalf Of
> Greg Matthews
> Sent: Tuesday, December 21, 2004 4:58 AM
> To: [email protected]
> Subject: Re: [Directoryadmin-list] Nice feature
> 
> 
> I too have some perl scripts to replace useradd/userdel etc. They are
> based on some that I found on the net but heavily modified to add most
> of the required posix attributes and check for uidnumber uniqueness etc
> (this was the biggest priority for me otherwise you may as well use a
> browser). They are also quite strict about encryption to protect the
> manager password, and use a config file for site preferences. This is a
> bit off-topic for the DA list but if anyone is interested I dont mind
> posting them to the interop list:
> http://lists.fini.net/mailman/listinfo/ldap-interop
> 
> There are other utils available. I spent a while trying to get "cpu" to
> work on solaris. I could get it to compile but not run. This is a
> drop-in replacment for the user/group tools and works well on linux:
> http://cpu.sourceforge.net/ Looking at recent release notes it may work
> on Solaris now.
> 
> There is also LED which allows you to edit what looks like a flat file
> and transcribes the changes to the LDAP directory:
> http://sourceforge.net/projects/led
> 
> hth
> 
> G
> 
> > 
> > --
> > mike
> > 
> > 
> > -------------------------------------------------------
> > SF email is sponsored by - The IT Product Guide
> > Read honest & candid reviews on hundreds of IT Products from real 
> > users. Discover which products truly live up to the hype. Start 
> > reading now. http://productguide.itmanagersjournal.com/
> > _______________________________________________
> > Directoryadmin-list mailing list 
> > [email protected]
> > https://lists.sourceforge.net/lists/listinfo/directoryadmin-list
-- 
Greg Matthews
iTSS Wallingford	01491 692445