examples/LDAP/smbldap-tools/smbldap-useradd.pl

   1 #!/usr/bin/perl -w
   2
   3 #  This code was developped by IDEALX (http://IDEALX.org/) and
   4 #  contributors (their names can be found in the CONTRIBUTORS file).
   5 #
   6 #                 Copyright (C) 2002 IDEALX
   7 #
   8 #  This program is free software; you can redistribute it and/or
   9 #  modify it under the terms of the GNU General Public License
  10 #  as published by the Free Software Foundation; either version 2
  11 #  of the License, or (at your option) any later version.
  12 #
  13 #  This program is distributed in the hope that it will be useful,
  14 #  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15 #  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 #  GNU General Public License for more details.
  17 #
  18 #  You should have received a copy of the GNU General Public License
  19 #  along with this program; if not, write to the Free Software
  20 #  Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
  21 #  USA.
  22
  23 # Purpose of smbldap-useradd : user (posix,shadow,samba) add
  24
  25 use strict;
  26
  27 use FindBin;
  28 use FindBin qw($RealBin);
  29 use lib "$RealBin/";
  30 use smbldap_tools;
  31 use smbldap_conf;
  32
  33 #####################
  34
  35 use Getopt::Std;
  36 my %Options;
  37
  38 my $ok = getopts('anmwPG:u:g:d:s:c:k:A:B:C:D:E:F:H:N:S:?', \%Options);
  39
  40 if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) ) {
  41   print "Usage: $0 [-awmugdsckGPABCDEFH?] username\n";
  42   print "  -a   is a Windows User (otherwise, Posix stuff only)\n";
  43   print "  -w   is a Windows Workstation (otherwise, Posix stuff only)\n";
  44   print "  -u   uid\n";
  45   print "  -g   gid\n";
  46   print "  -G   supplementary comma-separated groups\n";
  47   print "  -n   do not create a group\n";
  48   print "  -d   home\n";
  49   print "  -s   shell\n";
  50   print "  -c   gecos\n";
  51   print "  -m   creates home directory and copies /etc/skel\n";
  52   print "  -k   skeleton dir (with -m)\n";
  53   print "  -P   ends by invoking smbldap-passwd.pl\n";
  54   print "  -A   can change password ? 0 if no, 1 if yes\n";
  55   print "  -B   must change password ? 0 if no, 1 if yes\n";
  56   print "  -C   sambaHomePath (SMB home share, like '\\\\PDC-SRV\\homes')\n";
  57   print "  -D   sambaHomeDrive (letter associated with home share, like 'H:')\n";
  58   print "  -E   sambaLogonScript (DOS script to execute on login)\n";
  59   print "  -F   sambaProfilePath (profile directory, like '\\\\PDC-SRV\\profiles\\foo')\n";
  60   print "  -H   sambaAcctFlags (samba account control bits like '[NDHTUMWSLKI]')\n";
  61   print "  -N   canonical name\n";
  62   print "  -S   surname\n";
  63   print "  -?   show this help message\n";
  64   exit (1);
  65 }
  66
  67
  68 # cause problems when dealing with getpwuid because of the
  69 # negative ttl and ldap modification
  70 my $nscd_status = system "/etc/init.d/nscd status >/dev/null 2>&1";
  71
  72 if ($nscd_status == 0) {
  73   system "/etc/init.d/nscd stop > /dev/null 2>&1";
  74 }
  75
  76
  77 # Read options
  78 my $userUidNumber = $Options{'u'};
  79 if (!defined($userUidNumber)) {
  80   # find first unused uid starting from $UID_START
  81   while (defined(getpwuid($UID_START))) {
  82         $UID_START++;
  83   }
  84   $userUidNumber = $UID_START;
  85 } elsif (getpwuid($userUidNumber)) {
  86   die "Uid already exists.\n";
  87 }
  88
  89 if ($nscd_status == 0) {
  90   system "/etc/init.d/nscd start > /dev/null 2>&1";
  91 }
  92
  93
  94 my $createGroup = 0;
  95 my $userGidNumber = $Options{'g'};
  96 # gid not specified ?
  97 if (!defined($userGidNumber)) {
  98   # windows machine => $_defaultComputerGid
  99   if (defined($Options{'w'})) {
 100         $userGidNumber = $_defaultComputerGid;
 101         #    } elsif (!defined($Options{'n'})) {
 102         # create new group (redhat style)
 103         # find first unused gid starting from $GID_START
 104         #       while (defined(getgrgid($GID_START))) {
 105         #               $GID_START++;
 106         #       }
 107         #       $userGidNumber = $GID_START;
 108
 109         #       $createGroup = 1;
 110
 111   } else {
 112         # user will have gid = $_defaultUserGid
 113         $userGidNumber = $_defaultUserGid;
 114   }
 115 } else {
 116   my $gid;
 117   if (($gid = parse_group($userGidNumber)) < 0) {
 118         print "$0: unknown group $userGidNumber\n";
 119         exit (6);
 120   }
 121   $userGidNumber = $gid;
 122 }
 123
 124 # Read only first @ARGV
 125 my $userName = $ARGV[0];
 126
 127 # untaint $userName (can finish with one or two $)
 128 if ($userName =~ /^([\w -]+\$?)$/) {
 129   $userName = $1;
 130 } else {
 131   print "$0: illegal username\n";
 132   exit (1);
 133 }
 134
 135 # user must not exist in LDAP (should it be nss-wide ?)
 136 my ($rc, $dn) = get_user_dn2($userName);
 137 if ($rc and defined($dn)) {
 138   print "$0: user $userName exists\n";
 139   exit (9);
 140 } elsif (!$rc) {
 141   print "$0: error in get_user_dn2\n";
 142   exit(10);
 143 }
 144
 145 my $group_entry;
 146 my $userGroupSID;
 147 my $userRid;
 148 if ($Options{'a'}) {
 149         # as grouprid we use the value of the sambaSID attribute for
 150         # group of gidNumber=$userGidNumber
 151         $group_entry = read_group_entry_gid($userGidNumber);
 152         $userGroupSID = $group_entry->get_value('sambaSID');
 153         unless ($userGroupSID) {
 154           print "$0: unknown group SID not set for unix group $userGidNumber\n";
 155           print "check if your unix group is mapped to an NT group\n";
 156           exit (7);
 157         }
 158
 159         # as rid we use 2 * uid + 1000
 160         $userRid = 2 * $userUidNumber + 1000;
 161         # let's test if this SID already exist
 162         my $user_sid="$SID-$userRid";
 163         my $test_exist_sid=does_sid_exist($user_sid,$usersdn);
 164         if ($test_exist_sid->count == 1) {
 165                 print "User SID already owned by\n";
 166                 # there should not exist more than one entry, but ...
 167                 foreach my $entry ($test_exist_sid->all_entries) {
 168                         my $dn= $entry->dn;
 169                         chomp($dn);
 170                         print "$dn\n";
 171                 }
 172                 exit(7);
 173         }
 174 }
 175
 176 my $userHomeDirectory;
 177 my ($userCN, $userSN);
 178 my $tmp;
 179 if (!defined($userHomeDirectory = $Options{'d'})) {
 180   $userHomeDirectory = $_userHomePrefix."/".$userName;
 181 }
 182 $_userLoginShell = $tmp if (defined($tmp = $Options{'s'}));
 183 $_userGecos = $tmp if (defined($tmp = $Options{'c'}));
 184 $_skeletonDir = $tmp if (defined($tmp = $Options{'k'}));
 185 $userCN = ($Options{'c'} || $userName);
 186 $userCN = $tmp if (defined($tmp = $Options{'N'}));
 187 $userSN = $userName;
 188 $userSN = $tmp if (defined($tmp = $Options{'S'}));
 189
 190
 191 ########################
 192
 193 my $ldap_master=connect_ldap_master();
 194
 195 # MACHINE ACCOUNT
 196 if (defined($tmp = $Options{'w'})) {
 197
 198   # add a trailing dollar if missing
 199   if ($userName =~ /[^\$]$/s) {
 200         $userName .= "\$";
 201   }
 202
 203   #print "About to create machine $userName:\n";
 204
 205   if (!add_posix_machine ($userName, $userUidNumber, $userGidNumber)) {
 206         die "$0: error while adding posix account\n";
 207   }
 208
 209   if (!$with_smbpasswd) {
 210         # (jtournier)
 211         # Objectclass sambaSamAccount is now added directly by samba when joigning the domain (for samba3)
 212         #if (!add_samba_machine_mkntpwd($userName, $userUidNumber)) {
 213         #  die "$0: error while adding samba account\n";
 214         #}
 215   } else {
 216         if (!add_samba_machine($userName)) {
 217           die "$0: error while adding samba account\n";
 218         }
 219         my $modify = $ldap_master->modify ( "$dn",
 220                                                                                 changes => [
 221                                                                                                         replace => [sambaAcctFlags => '[W          ]']
 222                                                                                                    ]
 223                                                                           );
 224         $modify->code && warn "failed to modify entry: ", $modify->error ;
 225   }
 226
 227   exit 0;
 228 }
 229
 230 # USER ACCOUNT
 231 # add posix account first
 232
 233 my $add = $ldap_master->add ("uid=$userName,$usersdn",
 234                                                          attr => [
 235                                                                           'objectclass' => ['top','inetOrgPerson', 'posixAccount'],
 236                                                                           'cn'   => "$userCN",
 237                                                                           'sn'   => "$userSN",
 238                                                                           'uid'   => "$userName",
 239                                                                           'uidNumber'   => "$userUidNumber",
 240                                                                           'gidNumber'   => "$userGidNumber",
 241                                                                           'homeDirectory'   => "$userHomeDirectory",
 242                                                                           'loginShell'   => "$_userLoginShell",
 243                                                                           'gecos'   => "$_userGecos",
 244                                                                           'description'   => "$_userGecos",
 245                                                                           'userPassword'   => "{crypt}x"
 246                                                                          ]
 247                                                         );
 248
 249 $add->code && warn "failed to add entry: ", $add->error ;
 250
 251
 252 #if ($createGroup) {
 253 #    group_add($userName, $userGidNumber);
 254 #}
 255
 256 group_add_user($userGidNumber, $userName);
 257
 258 my $grouplist;
 259 # adds to supplementary groups
 260 if (defined($grouplist = $Options{'G'})) {
 261   add_grouplist_user($grouplist, $userName);
 262 }
 263
 264 # If user was created successfully then we should create his/her home dir
 265 if (defined($tmp = $Options{'m'})) {
 266   unless ( $userName =~ /\$$/ ) {
 267     if ( !(-e $userHomeDirectory) ) {
 268           system "mkdir $userHomeDirectory 2>/dev/null";
 269           system "cp -a $_skeletonDir/.[a-z,A-Z]* $_skeletonDir/* $userHomeDirectory 2>/dev/null";
 270           system "chown -R $userUidNumber:$userGidNumber $userHomeDirectory 2>/dev/null";
 271           system "chmod 700 $userHomeDirectory 2>/dev/null";
 272     }
 273   }
 274 }
 275
 276
 277 # Add Samba user infos
 278 if (defined($Options{'a'})) {
 279   if (!$with_smbpasswd) {
 280
 281         my $winmagic = 2147483647;
 282         my $valpwdcanchange = 0;
 283         my $valpwdmustchange = $winmagic;
 284         my $valpwdlastset = 0;
 285         my $valacctflags = "[UX]";
 286
 287         if (defined($tmp = $Options{'A'})) {
 288           if ($tmp != 0) {
 289                 $valpwdcanchange = "0";
 290           } else {
 291                 $valpwdcanchange = "$winmagic";
 292           }
 293         }
 294
 295         if (defined($tmp = $Options{'B'})) {
 296           if ($tmp != 0) {
 297                 $valpwdmustchange = "0";
 298                 # To force a user to change his password:
 299                 # . the attribut sambaPwdLastSet must be != 0
 300                 # . the attribut sambaAcctFlags must not match the 'X' flag
 301                 $valpwdlastset=$winmagic;
 302                 $valacctflags = "[U]";
 303           } else {
 304                 $valpwdmustchange = "$winmagic";
 305           }
 306         }
 307
 308         if (defined($tmp = $Options{'H'})) {
 309           $valacctflags = "$tmp";
 310         }
 311
 312
 313         my $modify = $ldap_master->modify ( "uid=$userName,$usersdn",
 314                                                                                 changes => [
 315                                                                                                         add => [objectClass => 'sambaSamAccount'],
 316                                                                                                         add => [sambaPwdLastSet => "$valpwdlastset"],
 317                                                                                                         add => [sambaLogonTime => '0'],
 318                                                                                                         add => [sambaLogoffTime => '2147483647'],
 319                                                                                                         add => [sambaKickoffTime => '2147483647'],
 320                                                                                                         add => [sambaPwdCanChange => "$valpwdcanchange"],
 321                                                                                                         add => [sambaPwdMustChange => "$valpwdmustchange"],
 322                                                                                                         add => [displayName => "$_userGecos"],
 323                                                                                                         add => [sambaAcctFlags => "$valacctflags"],
 324                                                                                                         add => [sambaSID => "$SID-$userRid"]
 325                                                                                                    ]
 326                                                                           );
 327
 328         $modify->code && die "failed to add entry: ", $modify->error ;
 329
 330   } else {
 331         my $FILE="|smbpasswd -s -a $userName >/dev/null" ;
 332         open (FILE, $FILE) || die "$!\n";
 333         print FILE <<EOF;
 334 x
 335 x
 336 EOF
 337     ;
 338         close FILE;
 339         if ($?) {
 340           print "$0: error adding samba account\n";
 341           exit (10);
 342         }
 343   }                                                             # with_smbpasswd
 344
 345   my @mods;
 346   my $valscriptpath;
 347   if (defined $_userScript) {
 348         $valscriptpath="$_userScript";
 349   } else {
 350         $valscriptpath = "$userName.cmd";
 351   }
 352   if (defined($tmp = $Options{'E'})) {
 353     $valscriptpath = "$tmp";
 354   }
 355
 356   my $valsmbhome;
 357   if (defined $_userSmbHome) {
 358        $valsmbhome = "$_userSmbHome";
 359   }
 360   if (defined($tmp = $Options{'C'})) {
 361     $valsmbhome = "$tmp";
 362   }
 363   if (defined $valsmbhome) {
 364        push(@mods, 'sambaHomePath', $valsmbhome);
 365   }
 366
 367   my $valhomedrive = "$_userHomeDrive";
 368   if (defined($tmp = $Options{'D'})) {
 369     $tmp = $tmp.":" unless ($tmp =~ /:/);
 370     $valhomedrive = "$tmp";
 371   }
 372
 373   my $valprofilepath;
 374   if (defined $_userProfile) {
 375        $valprofilepath = "$_userProfile$userName";
 376   }
 377
 378   if (defined($tmp = $Options{'F'})) {
 379     $valprofilepath = "$tmp";
 380   }
 381   if (defined $valprofilepath) {
 382        push(@mods, 'sambaProfilePath', $valprofilepath);
 383   }
 384
 385   my $modify = $ldap_master->modify ( "uid=$userName,$usersdn",
 386                                                                           changes => [
 387                                                                                                   add => [sambaPrimaryGroupSID => "$userGroupSID"],
 388                                                                                                   add => [sambaHomeDrive => "$valhomedrive"],
 389                                                                                                   add => [sambaLogonScript => "$valscriptpath"],
 390                                                                                                   add => [sambaLMPassword => 'XXX'],
 391                                                                                                   add => [sambaNTPassword => 'XXX']
 392                                                                                                  ]
 393                                                                         );
 394   $modify = $ldap_master->modify ( "uid=$userName,$usersdn",
 395                                                                        'replace' => { @mods }
 396                                                                        );
 397
 398
 399   $modify->code && die "failed to add entry: ", $modify->error ;
 400
 401 }
 402 $ldap_master->unbind;                   # take down session
 403
 404
 405 if (defined($Options{'P'})) {
 406   exec "/usr/local/sbin/smbldap-passwd.pl $userName"
 407 }
 408
 409 exit 0;
 410
 411 ########################################
 412
 413 =head1 NAME
 414
 415 smbldap-useradd.pl - Create a new user or update default new
 416   user information
 417
 418 =head1 SYNOPSIS
 419
 420 smbldap-useradd.pl [-c comment] [-d home_dir]
 421   [-g initial_group] [-G group[,...]]
 422   [-m [-k skeleton_dir]]
 423   [-s shell] [-u uid [ -o]] [-P]
 424   [-A canchange] [-B mustchange] [-C smbhome]
 425   [-D homedrive] [-E scriptpath] [-F profilepath]
 426   [-H acctflags] login
 427
 428 =head1 DESCRIPTION
 429
 430 Creating New Users
 431   The smbldap-useradd.pl command creates a new user account using
 432   the values specified on the  command  line  and  the default
 433   values from the system.
 434   The new user account will be entered into the system
 435   files as needed, the home directory  will  be  created, and
 436   initial  files copied, depending on the command line options.
 437
 438   You have to use smbldap-passwd to set the user password.
 439   For Samba users, rid is 2*uidNumber+1000, and primaryGroupID
 440   is 2*gidNumber+1001. Thus you may want to use
 441   smbldap-useradd.pl -a -g "Domain Admins" -u 500 Administrator
 442   to create a sambaDomainName administrator (admin rid is 0x1F4 = 500 and
 443                                                                                          grouprid is 0x200 = 512)
 444
 445   Without any option, the account created will be an Unix (Posix)
 446   account. The following options may be used to add information:
 447
 448 -a     The user will have a Samba account (and Unix).
 449
 450   -w     Creates an account for a Samba machine (Workstation), so that
 451   it can join a sambaDomainName.
 452
 453   -x     Creates rid and primaryGroupID in hex (for Samba 2.2.2 bug). Else
 454   decimal (2.2.2 patched from cvs or 2.2.x, x > 2)
 455
 456   -c comment
 457   The new user's comment field (gecos).
 458
 459        -d home_dir
 460               The new user will be created using home_dir as the value for the
 461               user's login directory.  The default is to append the login name
 462   to default_home and use that as the login directory name.
 463
 464   -g initial_group
 465   The group name or number of the user's initial login group.  The
 466               group  name must exist.  A group number must refer to an already
 467               existing group.  The default group number is 1.
 468
 469        -G group,[...]
 470               A list of supplementary groups which the user is also  a  member
 471               of.   Each  group is separated from the next by a comma, with no
 472               intervening whitespace.  The groups  are  subject  to  the  same
 473               restrictions as the group given with the -g option.  The default
 474               is for the user to belong only to the initial group.
 475
 476        -m     The user's home directory will be created if it does not  exist.
 477   The  files  contained in skeleton_dir will be copied to the home
 478   directory if the -k option is used,  otherwise  the  files  con
 479   tained  in /etc/skel will be used instead.  Any directories con
 480   tained in skeleton_dir or  /etc/skel  will  be  created  in  the
 481   user's  home  directory as well.  The -k option is only valid in
 482               conjunction with the -m option.  The default is  to  not  create
 483               the directory and to not copy any files.
 484
 485        -s shell
 486               The name of the user's login shell.  The  default  is  to  leave
 487   this  field blank, which causes the system to select the default
 488   login shell.
 489
 490   -u uid The numerical value of  the  user's  ID.   This  value  must  be
 491               unique,  unless  the  -o option is used.  The value must be non-
 492               negative.  The default is to use the smallest ID  value  greater
 493               than 1000 and greater than every other user.
 494
 495        -P     ends by invoking smbldap-passwd.pl
 496
 497        -A     can change password ? 0 if no, 1 if yes
 498
 499        -B     must change password ? 0 if no, 1 if yes
 500
 501        -C     sambaHomePath (SMB home share, like '\\\\PDC-SRV\\homes')
 502
 503        -D     sambaHomeDrive (letter associated with home share, like 'H:')
 504
 505        -E     sambaLogonScript, relative to the [netlogon] share (DOS script to execute on login, like 'foo.bat')
 506
 507        -F     sambaProfilePath (profile directory, like '\\\\PDC-SRV\\profiles\\foo')
 508
 509        -H     sambaAcctFlags, spaces and trailing bracket are ignored (samba account control bits like '[NDHTUMWSLKI]')
 510
 511        -N     canonical name (defaults to gecos or username, if gecos not set)
 512
 513        -S     surname (defaults to username)
 514
 515
 516 =head1 SEE ALSO
 517
 518        useradd(1)
 519
 520 =cut
 521
 522 #'