[clinton/scripts.git] / create-user

#!/bin/bash -ex

# MUST be executed:
#  - on deleuze
#  - as a user with an /etc/sudoers line
#  - member of "wheel" unix group on deleuze
#  - while holding tickets for a user who can 'ssh -K' to mire
#     - and is a member of "wheel" on mire
#  - while holding tokens for a user who is:
#     - a member of system:administrator
#     - listed in 'bos listusers deleuze'

USER=$1

export PATH=$PATH:/afs/hcoop.net/common/bin/

if test -z "$USER"; then
	echo "Invoke as create-user <USERNAME>"
	exit 1
fi

#
# Helper functions
#

# Run a command on both mire and deleuze; assumes that no escaping is
# needed.
function mire_and_deleuze() {
    $*
    ssh mire.hcoop.net $*
}

#
# Kerberos principals
# (creat kerberos principals: fred, fred/cgi, fred/mailfilter)
#

# We use -randkey for user's main principal as well, to make sure that
# the creation process does not continue without having a main 
# principal. (But you who want to set password for a user, don't 
# worry - we'll invoke cpw later, so that it has the same effect
# as setting password right now - while it is more error tolerant).

sudo kadmin.local -p root/admin -q "ank -policy user -randkey +requires_preauth $USER@HCOOP.NET"
sudo kadmin.local -p root/admin -q "modprinc -maxlife 1day $USER@HCOOP.NET"
sudo kadmin.local -p root/admin -q "ank -policy daemon -randkey +requires_preauth $USER/daemon@HCOOP.NET"

#
# Create AFS users corresponding to krb5 principals.
# (fred/cgi principal == fred.cgi AFS user)
#

pts cu $USER || true
ID=`pts examine $USER | head -n1 | sed 's_.*, id: *__' | sed 's_,.*__'`
pts cu $USER.daemon || true
ID_DAEMON=`pts examine $USER.daemon | head -n1 | sed 's_.*, id: *__' | sed 's_,.*__'`


#
# Construct various paths for later perusal.
#

# (If it's not clear, for user fred, PATHBITS = f/fr/fred)
PATHBITS=`echo $USER | head -c 1`/`echo $USER | head -c 2`/$USER
HOMEPATH=/afs/hcoop.net/user/$PATHBITS
MAILPATH=/afs/hcoop.net/common/email/$PATHBITS
DBPATH=/afs/hcoop.net/common/.databases/$PATHBITS
PGDIR=$DBPATH/postgres
MYSQLDIR=$DBPATH/mysql


#
# Create LDAP entries. (With the whole libnss-ptdb, I kind of
# lost the idea of what I want to do with LDAP, but we'll 
# see with time how well it integrates...)
# The ID returned from AFS is important here, we want to make
# sure those IDs match.
#

# USER entry
echo "
dn: uid=$USER,ou=People,dc=hcoop,dc=net
objectClass: top
objectClass: person
objectClass: posixAccount
cn: $USER
uid: $USER
gidNumber: $ID
sn: $USER
host: abulafia
host: mire

dn: cn=$USER,ou=Group,dc=hcoop,dc=net
objectClass: top
objectClass: posixGroup
cn: $USER
gidNumber: $ID
memberUid: $USER
" | sudo ldapadd -x -D cn=admin,dc=hcoop,dc=net -y /etc/ldap.secret || true

# USER.daemon entry
echo "
dn: uid=$USER.daemon,ou=People,dc=hcoop,dc=net
objectClass: top
objectClass: person
objectClass: posixAccount
cn: $USER.daemon
uid: $USER.daemon
gidNumber: $ID_DAEMON
sn: $USER.daemon

dn: cn=$USER.daemon,ou=Group,dc=hcoop,dc=net
objectClass: top
objectClass: posixGroup
cn: $USER.daemon
gidNumber: $ID_DAEMON
memberUid: $USER.daemon
" | sudo ldapadd -x -D cn=admin,dc=hcoop,dc=net -y /etc/ldap.secret || true


#
# Export .mailfilter and .cgi keys to a keytab file
#

# create a daemon keytab (used by /etc/exim4/get-token)
# *only* if it does not exist!
test -e /etc/keytabs/user.daemon/$USER || \
  sudo kadmin.local -p root/admin -q "ktadd -k /etc/keytabs/user.daemon/$USER $USER/daemon@HCOOP.NET"

# Properly chown/mod keytab files (must be $USER:www-data)
sudo chown $USER:www-data /etc/keytabs/user.daemon/$USER
sudo chmod 440            /etc/keytabs/user.daemon/$USER

# rsync keytabs to mire
(cd /etc/keytabs
   sudo tar clpf - user.daemon/$USER | \
     ssh mire.hcoop.net cd /etc/keytabs\; sudo tar xlpf -)

#
# Create/mount/set-perms on user's volumes (home, mail, databases, logs)
#

# HOME VOLUME
vos examine user.$USER 2>/dev/null || \
  vos create deleuze.hcoop.net /vicepa user.$USER -maxquota 400000
mkdir -p `dirname $HOMEPATH`
fs ls $HOMEPATH || test -L $HOMEPATH || fs mkm $HOMEPATH user.$USER
chown $USER:nogroup $HOMEPATH
fs sa $HOMEPATH $USER            all
fs sa $HOMEPATH system:anyuser   l

# Apache logs
mkdir -p $HOMEPATH/.logs
chown $USER:nogroup $HOMEPATH/.logs
mkdir -p $HOMEPATH/.logs/apache
chown $USER:nogroup $HOMEPATH/.logs/apache
fs sa $HOMEPATH/.logs/apache $USER.daemon rlwidk
mkdir -p $HOMEPATH/.logs/mail
fs sa $HOMEPATH/.logs/mail $USER.daemon rlwidk
chown $USER:nogroup $HOMEPATH/.logs/mail

# public_html
mkdir -p $HOMEPATH/public_html
chown $USER:nogroup $HOMEPATH/public_html
fs sa $HOMEPATH/public_html system:anyuser rl

# .procmail.d
mkdir -p $HOMEPATH/.procmail.d
chown $USER:nogroup $HOMEPATH/.procmail.d
fs sa $HOMEPATH/.procmail.d system:anyuser rl

# .public
mkdir -p $HOMEPATH/.public/
chown $USER:nogroup $HOMEPATH/.public
fs sa $HOMEPATH/.public system:anyuser rl

# .domtool
mkdir -p $HOMEPATH/.public/.domtool
chown $USER:nogroup $HOMEPATH/.public/.domtool
test -e $HOMEPATH/.domtool || \
    test -L $HOMEPATH/.domtool || \
        ln -s $HOMEPATH/.public/.domtool $HOMEPATH/.domtool

# MAIL VOLUME
vos examine mail.$USER 2>/dev/null || \
  vos create deleuze.hcoop.net /vicepa mail.$USER -maxquota 400000
mkdir -p `dirname $MAILPATH`
fs ls $MAILPATH || fs mkm $MAILPATH         mail.$USER
fs ls $HOMEPATH/Maildir || fs mkm $HOMEPATH/Maildir mail.$USER
chown $USER:nogroup $MAILPATH
chown $USER:nogroup $HOMEPATH/Maildir
fs sa $MAILPATH $USER        all
fs sa $MAILPATH $USER.daemon all

# Set up shared SpamAssassin folder
if test -f $HOMEPATH/Maildir/shared-maildirs; then
    # Deal with case where user rsync'd their Maildir from fyodor
    pattern='^SpamAssassin	/home/spamd'
    file=$HOMEPATH/Maildir/shared-maildirs
    if grep $pattern $file; then
        sed -i -r -e \
            's!^(SpamAssassin	)/home/spamd!\1/var/local/lib/spamd!1' \
            $file
    fi
    NOTIFY=no
    for dir in $HOMEPATH/Maildir/shared-folders/SpamAssassin/*; do
        if ! test -d $dir; then
            NOTIFY=yes
        else
            dest=/var/local/lib/spamd/Maildir/.$(basename $dir)
            if test "$(readlink $dir/shared)" != "$dest"; then
                ln -sf $dest $dir/shared
            fi
        fi
    done
    if test $NOTIFY = yes; then
        # This is probably going overboard, but oh well
        echo "$USER needs assistance on their shared spam dir" | \
            mail -s "[create-user] $USER needs assistance" \
              -e -a "From: admins@deleuze.hcoop.net" mwolson_admin
    fi
else
    maildirmake --add SpamAssassin=/var/local/lib/spamd/Maildir \
        $HOMEPATH/Maildir
fi

# DATABASE VOLUME
if ! vos examine db.$USER >/dev/null 2>/dev/null; then
  mkdir -p `dirname /afs/.hcoop.net/common/.databases/$PATHBITS`
  vos create -server afs -partition a -name db.$USER -maxquota 400000
  fs mkmount -dir /afs/.hcoop.net/common/.databases/$PATHBITS -vol db.$USER -rw
  vos release common.databases
  fs sa -dir $DBPATH -acl system:postgres l
  fs sa -dir $DBPATH -acl system:mysql    l
  fs sa -dir $DBPATH -acl system:backup   rl
fi

# Create postgres user and tablespace placeholder within volume
if ! test -d $PGDIR; then
  mkdir -p $PGDIR
  chown postgres:postgres $PGDIR
  fs sa -dir $PGDIR -acl system:postgres write

 sudo -u postgres psql -c "CREATE TABLESPACE user_$USER OWNER postgres LOCATION '$PGDIR'" template1
fi

# Create mysql user and databases placeholder within volume
mkdir -p $MYSQLDIR
chown mysql:mysql $MYSQLDIR
fs sa -dir $MYSQLDIR -acl system:mysql  write


#
# Mount points for backup volumes
#

mkdir -p `dirname /afs/hcoop.net/.old/user/$PATHBITS`
mkdir -p `dirname /afs/hcoop.net/.old/mail/$PATHBITS`
fs ls /afs/hcoop.net/.old/user/$PATHBITS || \
  fs mkm /afs/hcoop.net/.old/user/$PATHBITS user.$USER.backup
fs ls /afs/hcoop.net/.old/mail/$PATHBITS || \
  fs mkm /afs/hcoop.net/.old/mail/$PATHBITS mail.$USER.backup
vos release old

# technically this might not be necessary, but for good measure...
vos syncserv deleuze
vos syncvldb deleuze

# refresh volume location cache (takes ~2hrs otherwise)
mire_and_deleuze fs checkvolumes

#
# Non-AFS files and directories
#

# Make per-user apache DAV lock directory -- the directory must be
# both user and group-writable, which is silly.
mire_and_deleuze sudo mkdir -p /var/lock/apache2/dav/$USER
mire_and_deleuze sudo chown $USER:www-data /var/lock/apache2/dav/$USER
mire_and_deleuze sudo chmod ug=rwx,o= /var/lock/apache2/dav/$USER

#
# Domtool integration
#

domtool-adduser $USER
Commit	Line	Data
d2462e94	1	#!/bin/bash -ex
	2
	3	# MUST be executed:
	4	# - on deleuze
	5	# - as a user with an /etc/sudoers line
64f69c08	6	# - member of "wheel" unix group on deleuze
78725790	7	# - while holding tickets for a user who can 'ssh -K' to mire
64f69c08	8	# - and is a member of "wheel" on mire
d2462e94	9	# - while holding tokens for a user who is:
	10	# - a member of system:administrator
	11	# - listed in 'bos listusers deleuze'
	12
	13	USER=$1
	14
cd0db70e	15	export PATH=$PATH:/afs/hcoop.net/common/bin/
cd0db70e	16
d2462e94	17	if test -z "$USER"; then
	18	echo "Invoke as create-user <USERNAME>"
	19	exit 1
	20	fi
	21
7e1859cd	22	#
	23	# Helper functions
	24	#
	25
	26	# Run a command on both mire and deleuze; assumes that no escaping is
	27	# needed.
	28	function mire_and_deleuze() {
	29	$*
	30	ssh mire.hcoop.net $*
	31	}
d2462e94	32
	33	#
	34	# Kerberos principals
	35	# (creat kerberos principals: fred, fred/cgi, fred/mailfilter)
	36	#
	37
	38	# We use -randkey for user's main principal as well, to make sure that
	39	# the creation process does not continue without having a main
	40	# principal. (But you who want to set password for a user, don't
	41	# worry - we'll invoke cpw later, so that it has the same effect
	42	# as setting password right now - while it is more error tolerant).
	43
52e2a5b3	44	sudo kadmin.local -p root/admin -q "ank -policy user -randkey +requires_preauth $USER@HCOOP.NET"
cd0db70e	45	sudo kadmin.local -p root/admin -q "modprinc -maxlife 1day $USER@HCOOP.NET"
cd0db70e	46	sudo kadmin.local -p root/admin -q "ank -policy daemon -randkey +requires_preauth $USER/daemon@HCOOP.NET"
d2462e94	47
	48	#
	49	# Create AFS users corresponding to krb5 principals.
	50	# (fred/cgi principal == fred.cgi AFS user)
	51	#
	52
	53	pts cu $USER \|\| true
	54	ID=`pts examine $USER \| head -n1 \| sed 's_., id: __' \| sed 's_,.*__'`
cd0db70e	55	pts cu $USER.daemon \|\| true
cd0db70e	56	ID_DAEMON=`pts examine $USER.daemon \| head -n1 \| sed 's_., id: __' \| sed 's_,.*__'`
d2462e94	57
	58
	59	#
	60	# Construct various paths for later perusal.
	61	#
	62
	63	# (If it's not clear, for user fred, PATHBITS = f/fr/fred)
	64	PATHBITS=`echo $USER \| head -c 1`/`echo $USER \| head -c 2`/$USER
	65	HOMEPATH=/afs/hcoop.net/user/$PATHBITS
	66	MAILPATH=/afs/hcoop.net/common/email/$PATHBITS
64f69c08	67	DBPATH=/afs/hcoop.net/common/.databases/$PATHBITS
d2462e94	68	PGDIR=$DBPATH/postgres
	69	MYSQLDIR=$DBPATH/mysql
	70
	71
	72	#
	73	# Create LDAP entries. (With the whole libnss-ptdb, I kind of
	74	# lost the idea of what I want to do with LDAP, but we'll
	75	# see with time how well it integrates...)
	76	# The ID returned from AFS is important here, we want to make
	77	# sure those IDs match.
	78	#
	79
	80	# USER entry
	81	echo "
	82	dn: uid=$USER,ou=People,dc=hcoop,dc=net
	83	objectClass: top
	84	objectClass: person
	85	objectClass: posixAccount
	86	cn: $USER
	87	uid: $USER
	88	gidNumber: $ID
d2462e94	89	sn: $USER
	90	host: abulafia
	91	host: mire
	92
	93	dn: cn=$USER,ou=Group,dc=hcoop,dc=net
	94	objectClass: top
	95	objectClass: posixGroup
	96	cn: $USER
	97	gidNumber: $ID
	98	memberUid: $USER
0963ebc5	99	" \| sudo ldapadd -x -D cn=admin,dc=hcoop,dc=net -y /etc/ldap.secret \|\| true
d2462e94	100
cd0db70e	101	# USER.daemon entry
d2462e94	102	echo "
cd0db70e	103	dn: uid=$USER.daemon,ou=People,dc=hcoop,dc=net
d2462e94	104	objectClass: top
	105	objectClass: person
	106	objectClass: posixAccount
cd0db70e	107	cn: $USER.daemon
	108	uid: $USER.daemon
	109	gidNumber: $ID_DAEMON
	110	sn: $USER.daemon
d2462e94	111
cd0db70e	112	dn: cn=$USER.daemon,ou=Group,dc=hcoop,dc=net
d2462e94	113	objectClass: top
d2462e94	114	objectClass: posixGroup
cd0db70e	115	cn: $USER.daemon
	116	gidNumber: $ID_DAEMON
	117	memberUid: $USER.daemon
0963ebc5	118	" \| sudo ldapadd -x -D cn=admin,dc=hcoop,dc=net -y /etc/ldap.secret \|\| true
d2462e94	119
	120
	121	#
	122	# Export .mailfilter and .cgi keys to a keytab file
	123	#
	124
cd0db70e	125	# create a daemon keytab (used by /etc/exim4/get-token)
	126	# only if it does not exist!
	127	test -e /etc/keytabs/user.daemon/$USER \|\| \
	128	sudo kadmin.local -p root/admin -q "ktadd -k /etc/keytabs/user.daemon/$USER $USER/daemon@HCOOP.NET"
d2462e94	129
cd0db70e	130	# Properly chown/mod keytab files (must be $USER:www-data)
	131	sudo chown $USER:www-data /etc/keytabs/user.daemon/$USER
	132	sudo chmod 440 /etc/keytabs/user.daemon/$USER
d2462e94	133
7a7e31c9	134	# rsync keytabs to mire
cd0db70e	135	(cd /etc/keytabs
	136	sudo tar clpf - user.daemon/$USER \| \
	137	ssh mire.hcoop.net cd /etc/keytabs\; sudo tar xlpf -)
d2462e94	138
	139	#
	140	# Create/mount/set-perms on user's volumes (home, mail, databases, logs)
	141	#
	142
	143	# HOME VOLUME
0963ebc5	144	vos examine user.$USER 2>/dev/null \|\| \
0963ebc5	145	vos create deleuze.hcoop.net /vicepa user.$USER -maxquota 400000
d2462e94	146	mkdir -p `dirname $HOMEPATH`
3304c1fa	147	fs ls $HOMEPATH \|\| test -L $HOMEPATH \|\| fs mkm $HOMEPATH user.$USER
b7b1cdff	148	chown $USER:nogroup $HOMEPATH
d2462e94	149	fs sa $HOMEPATH $USER all
cd0db70e	150	fs sa $HOMEPATH system:anyuser l
d2462e94	151
d2462e94	152	# Apache logs
655b4c82	153	mkdir -p $HOMEPATH/.logs
	154	chown $USER:nogroup $HOMEPATH/.logs
	155	mkdir -p $HOMEPATH/.logs/apache
	156	chown $USER:nogroup $HOMEPATH/.logs/apache
	157	fs sa $HOMEPATH/.logs/apache $USER.daemon rlwidk
	158	mkdir -p $HOMEPATH/.logs/mail
	159	fs sa $HOMEPATH/.logs/mail $USER.daemon rlwidk
	160	chown $USER:nogroup $HOMEPATH/.logs/mail
d2462e94	161
7a7e31c9	162	# public_html
b7b1cdff	163	mkdir -p $HOMEPATH/public_html
b7b1cdff	164	chown $USER:nogroup $HOMEPATH/public_html
7a7e31c9	165	fs sa $HOMEPATH/public_html system:anyuser rl
b7b1cdff	166
	167	# .procmail.d
	168	mkdir -p $HOMEPATH/.procmail.d
	169	chown $USER:nogroup $HOMEPATH/.procmail.d
	170	fs sa $HOMEPATH/.procmail.d system:anyuser rl
	171
	172	# .public
cd0db70e	173	mkdir -p $HOMEPATH/.public/
b7b1cdff	174	chown $USER:nogroup $HOMEPATH/.public
	175	fs sa $HOMEPATH/.public system:anyuser rl
	176
	177	# .domtool
	178	mkdir -p $HOMEPATH/.public/.domtool
	179	chown $USER:nogroup $HOMEPATH/.public/.domtool
cd0db70e	180	test -e $HOMEPATH/.domtool \|\| \
	181	test -L $HOMEPATH/.domtool \|\| \
	182	ln -s $HOMEPATH/.public/.domtool $HOMEPATH/.domtool
7a7e31c9	183
d2462e94	184	# MAIL VOLUME
0963ebc5	185	vos examine mail.$USER 2>/dev/null \|\| \
0963ebc5	186	vos create deleuze.hcoop.net /vicepa mail.$USER -maxquota 400000
d2462e94	187	mkdir -p `dirname $MAILPATH`
ef64fd5f	188	fs ls $MAILPATH \|\| fs mkm $MAILPATH mail.$USER
ef64fd5f	189	fs ls $HOMEPATH/Maildir \|\| fs mkm $HOMEPATH/Maildir mail.$USER
894794d2	190	chown $USER:nogroup $MAILPATH
894794d2	191	chown $USER:nogroup $HOMEPATH/Maildir
cd0db70e	192	fs sa $MAILPATH $USER all
ea773cea	193	fs sa $MAILPATH $USER.daemon all
d2462e94	194
64a96d98	195	# Set up shared SpamAssassin folder
	196	if test -f $HOMEPATH/Maildir/shared-maildirs; then
	197	# Deal with case where user rsync'd their Maildir from fyodor
	198	pattern='^SpamAssassin /home/spamd'
	199	file=$HOMEPATH/Maildir/shared-maildirs
	200	if grep $pattern $file; then
	201	sed -i -r -e \
	202	's!^(SpamAssassin )/home/spamd!\1/var/local/lib/spamd!1' \
	203	$file
	204	fi
e576ecef	205	NOTIFY=no
64a96d98	206	for dir in $HOMEPATH/Maildir/shared-folders/SpamAssassin/*; do
e576ecef	207	if ! test -d $dir; then
	208	NOTIFY=yes
	209	else
	210	dest=/var/local/lib/spamd/Maildir/.$(basename $dir)
	211	if test "$(readlink $dir/shared)" != "$dest"; then
	212	ln -sf $dest $dir/shared
	213	fi
64a96d98	214	fi
64a96d98	215	done
e576ecef	216	if test $NOTIFY = yes; then
	217	# This is probably going overboard, but oh well
	218	echo "$USER needs assistance on their shared spam dir" \| \
	219	mail -s "[create-user] $USER needs assistance" \
	220	-e -a "From: admins@deleuze.hcoop.net" mwolson_admin
	221	fi
64a96d98	222	else
	223	maildirmake --add SpamAssassin=/var/local/lib/spamd/Maildir \
	224	$HOMEPATH/Maildir
	225	fi
	226
d2462e94	227	# DATABASE VOLUME
	228	if ! vos examine db.$USER >/dev/null 2>/dev/null; then
	229	mkdir -p `dirname /afs/.hcoop.net/common/.databases/$PATHBITS`
	230	vos create -server afs -partition a -name db.$USER -maxquota 400000
	231	fs mkmount -dir /afs/.hcoop.net/common/.databases/$PATHBITS -vol db.$USER -rw
	232	vos release common.databases
	233	fs sa -dir $DBPATH -acl system:postgres l
	234	fs sa -dir $DBPATH -acl system:mysql l
	235	fs sa -dir $DBPATH -acl system:backup rl
	236	fi
	237
	238	# Create postgres user and tablespace placeholder within volume
e576ecef	239	if ! test -d $PGDIR; then
d2462e94	240	mkdir -p $PGDIR
	241	chown postgres:postgres $PGDIR
	242	fs sa -dir $PGDIR -acl system:postgres write
	243
	244	sudo -u postgres psql -c "CREATE TABLESPACE user_$USER OWNER postgres LOCATION '$PGDIR'" template1
	245	fi
	246
	247	# Create mysql user and databases placeholder within volume
	248	mkdir -p $MYSQLDIR
	249	chown mysql:mysql $MYSQLDIR
	250	fs sa -dir $MYSQLDIR -acl system:mysql write
	251
	252
	253	#
	254	# Mount points for backup volumes
	255	#
	256
cd0db70e	257	mkdir -p `dirname /afs/hcoop.net/.old/user/$PATHBITS`
	258	mkdir -p `dirname /afs/hcoop.net/.old/mail/$PATHBITS`
	259	fs ls /afs/hcoop.net/.old/user/$PATHBITS \|\| \
	260	fs mkm /afs/hcoop.net/.old/user/$PATHBITS user.$USER.backup
	261	fs ls /afs/hcoop.net/.old/mail/$PATHBITS \|\| \
	262	fs mkm /afs/hcoop.net/.old/mail/$PATHBITS mail.$USER.backup
	263	vos release old
d2462e94	264
7fe272af	265	# technically this might not be necessary, but for good measure...
d2462e94	266	vos syncserv deleuze
d2462e94	267	vos syncvldb deleuze
7fe272af	268
7fe272af	269	# refresh volume location cache (takes ~2hrs otherwise)
7e1859cd	270	mire_and_deleuze fs checkvolumes
2c556c0c	271
2c556c0c	272	#
7e1859cd	273	# Non-AFS files and directories
2c556c0c	274	#
2c556c0c	275
da0bc057	276	# Make per-user apache DAV lock directory -- the directory must be
da0bc057	277	# both user and group-writable, which is silly.
7e1859cd	278	mire_and_deleuze sudo mkdir -p /var/lock/apache2/dav/$USER
	279	mire_and_deleuze sudo chown $USER:www-data /var/lock/apache2/dav/$USER
	280	mire_and_deleuze sudo chmod ug=rwx,o= /var/lock/apache2/dav/$USER
db51e5b7	281
	282	#
	283	# Domtool integration
	284	#
	285
	286	domtool-adduser $USER