Hey Guys,
I Sys. Admin a small office of about 50 users and we have 6 linux boxes and 2 openBSD boxes. I am currently using NIS for management. Am in the process of looking at moving from NIS to LDAP and after some 'googling' it seems that Fedora DS would cover all of my requirements.
I have installed the fedora DS and have manually (via the ds gui) added a few users. I would prefer however to get away from the GUI and perform everything from the command line. Thus far I have not found any command line admin stuff.
Can you guys give me a hand with this stuff - or give me a pointer or 2. I am looking how to do the following: * create groups * add users * add users with posix attributes, * disable accounts. * change passwords
you know the basic sort of stuff. I have taken a look on amazon and oreilly but cannot see any Fedora DS specific books.
Thanks in advance for your help.
Dan
dandantheitman wrote:
Hey Guys,
I Sys. Admin a small office of about 50 users and we have 6 linux boxes and 2 openBSD boxes. I am currently using NIS for management. Am in the process of looking at moving from NIS to LDAP and after some 'googling' it seems that Fedora DS would cover all of my requirements.
I have installed the fedora DS and have manually (via the ds gui) added a few users. I would prefer however to get away from the GUI and perform everything from the command line. Thus far I have not found any command line admin stuff.
Can you guys give me a hand with this stuff - or give me a pointer or 2. I am looking how to do the following:
- create groups
- add users
- add users with posix attributes,
In general, for tasks like these, any LDAP client will work. There is nothing specific to Fedora DS. Most every document that describes how to add/modify users witih ldapmodify and how to search for them with ldapsearch, and how to create custom LDIF files, will apply to Fedora DS.
I strongly encourage you to use scripts to do this - my preference is python and python-ldap but it is fairly low level. If you are a perl or ruby or java hacker, there are Java APIs for those languages.
If you prefer just plain old shell commands, then you can do just about everything using good ol' grep/sed/awk with LDIF files and ldapmodify/ldapsearch.
- disable accounts.
Use the ns-inactivate.pl/ns-activate.pl scripts provided with Fedora DS. NOTE: This is specific to Fedora DS.
- change passwords
ldappasswd
you know the basic sort of stuff. I have taken a look on amazon and oreilly but cannot see any Fedora DS specific books.
Except where noted above, just about any book on LDAP that covers ldapmodify and LDIF will be useful.
Thanks in advance for your help.
Dan
Hi Dan, For adding users (with Posix Attributes), changing the userpassword, we are using these scripts : _For creating users with Posix Attribute :_ create a file for example with the content :
dn: uid=user1, ou=People, dc=example,dc=com changetype: add givenName: Sample User sn: Sample loginShell: /bin/bash gidNumber: 500 uidNumber: 10059 mail: user1@example.com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetorgperson objectClass: posixAccount uid: user1 cn: Sample User homeDirectory: /home/user1 userPassword: {CLEAR}pass123
Then issue the command '/opt/fedora-ds/shared/bin/ldapmodify -a -p 389 -h hostname -D "cn=Directory Manager" -w - -f add.ldif.
[-a refers the action add, -p refers port number (defaults to 389), After -w you can give the password there itself or if you don't want to give there give '-' there (the password will be asked), and -f refers the file which will be followed by the value (add.ldif)].
_Password Modifying script (modi.ldif) :_
dn: uid=genuser3,ou=People, dc=example,dc=com changetype: modify replace: userPassword userPassword: NewRealPassword
./ldapmodify -a -p 389 -D "cn=Directory Manager" -w - -f modi.ldif
dandantheitman wrote:
Hey Guys,
I Sys. Admin a small office of about 50 users and we have 6 linux boxes and 2 openBSD boxes. I am currently using NIS for management. Am in the process of looking at moving from NIS to LDAP and after some 'googling' it seems that Fedora DS would cover all of my requirements.
I have installed the fedora DS and have manually (via the ds gui) added a few users. I would prefer however to get away from the GUI and perform everything from the command line. Thus far I have not found any command line admin stuff.
Can you guys give me a hand with this stuff - or give me a pointer or 2. I am looking how to do the following:
- create groups
- add users
- add users with posix attributes,
- disable accounts.
- change passwords
you know the basic sort of stuff. I have taken a look on amazon and oreilly but cannot see any Fedora DS specific books.
Thanks in advance for your help.
Dan
On 18/12/2007, Namachivayam npurusothaman@perisoftware.com wrote:
Hi Dan, For adding users (with Posix Attributes), changing the userpassword, we are using these scripts : _For creating users with Posix Attribute :_ create a file for example with the content :
<snip>
Hi Namachivayan, Thanks for your help. What I need to do is figure out a way to use ldapadd rather than using the ldif file as I would like automate the UID generation.
Dan
dandantheitman wrote:
On 18/12/2007, Namachivayam npurusothaman@perisoftware.com wrote:
Hi Dan, For adding users (with Posix Attributes), changing the userpassword, we are using these scripts : _For creating users with Posix Attribute :_ create a file for example with the content :
<snip>
Hi Namachivayan, Thanks for your help. What I need to do is figure out a way to use ldapadd rather than using the ldif file as I would like automate the UID generation.
Fedora DS 1.1 supports auto UID and GID generation - see http://directory.fedoraproject.org/wiki/Release_Notes
Dan
On Tuesday 18 December 2007 10:38 pm, dandantheitman wrote:
On 18/12/2007, Namachivayam npurusothaman@perisoftware.com wrote:
Hi Dan, For adding users (with Posix Attributes), changing the userpassword, we are using these scripts : _For creating users with Posix Attribute :_ create a file for example with the content :
<snip>
Hi Namachivayan, Thanks for your help. What I need to do is figure out a way to use ldapadd rather than using the ldif file as I would like automate the UID generation.
I found this objectClass in samba somewhere, it's basically just an object that holds a gidNumber and a uidNumber value. When my add_user script runs, it will first find this object, grab the values, create the user, then increment them as needed.
objectClasses: ( UnixIdPool-oid NAME 'UnixIdPool' SUP top STRUCTURAL MUST ( cn $ gidNumber $ uidNumber ) X-ORIGIN 'user defined' )
Ryan
Ryan Braun wrote:
On Tuesday 18 December 2007 10:38 pm, dandantheitman wrote:
On 18/12/2007, Namachivayam npurusothaman@perisoftware.com wrote:
Hi Dan, For adding users (with Posix Attributes), changing the userpassword, we are using these scripts : _For creating users with Posix Attribute :_ create a file for example with the content :
<snip>
Hi Namachivayan, Thanks for your help. What I need to do is figure out a way to use ldapadd rather than using the ldif file as I would like automate the UID generation.
I found this objectClass in samba somewhere, it's basically just an object that holds a gidNumber and a uidNumber value. When my add_user script runs, it will first find this object, grab the values, create the user, then increment them as needed.
objectClasses: ( UnixIdPool-oid NAME 'UnixIdPool' SUP top STRUCTURAL MUST ( cn $ gidNumber $ uidNumber ) X-ORIGIN 'user defined' )
Ryan
Hi,
I would like to share with regard to this, in samba.schema, Below is the objectclass I found
objectclass ( 1.3.6.1.4.1.7165.2.2.7 NAME 'sambaUnixIdPool' SUP top AUXILIARY DESC 'Pool for allocating UNIX uids/gids' MUST ( uidNumber $ gidNumber ) )
And from idealx scripts which you can download from samba.org You will see that it uses a piece of perl code to get the next uid. May be this can help,.
the logic is same as what Ryan described
<snip> sub get_next_id($$) { my $ldap_base_dn = shift; my $attribute = shift; my $tries = 0; my $found=0; my $next_uid_mesg; my $nextuid; if ($ldap_base_dn =~ m/$config{usersdn}/i) { # when adding a new user, we'll check if the uidNumber available is not # already used for a computer's account $ldap_base_dn=$config{suffix} } do { $next_uid_mesg = $ldap->search(
base => $config{sambaUnixIdPooldn},
filter => "(objectClass=sambaUnixIdPool)",
scope => "base"
); $next_uid_mesg->code && die "Error looking for next uid"; if ($next_uid_mesg->count != 1) { die "Could not find base dn, to get next $attribute"; } my $entry = $next_uid_mesg->entry(0);
$nextuid = $entry->get_value($attribute); my $modify=$ldap->modify( "$config{sambaUnixIdPooldn}",
changes => [
replace => [ $attribute => $nextuid + 1 ]
] ); $modify->code && die "Error: ", $modify->error; # let's check if the id found is really free (in ou=Groups or ou=Users)... my $check_uid_mesg = $ldap->search( base => $ldap_base_dn,
filter => "($attribute=$nextuid)",
); $check_uid_mesg->code && die "Cannot confirm $attribute $nextuid is free"; if ($check_uid_mesg->count == 0) { $found=1; return $nextuid; } $tries++; print "Cannot confirm $attribute $nextuid is free: checking for the next one\n" } while ($found != 1); die "Could not allocate $attribute!"; }
Regards Niranjan
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
389-users@lists.fedoraproject.org
-
dandantheitman -
mallapadi niranjan -
Namachivayam -
Rich Megginson -
Ryan Braun