# MUST be executed:
# - on deleuze
# - as a user with an /etc/sudoers line
-# - member of wheel unix group
+# - member of "wheel" unix group on deleuze
# - while holding tickets for a user who can 'ssh -K' to mire
+# - and is a member of "wheel" on mire
# - while holding tokens for a user who is:
# - a member of system:administrator
# - listed in 'bos listusers deleuze'
# worry - we'll invoke cpw later, so that it has the same effect
# as setting password right now - while it is more error tolerant).
-sudo kadmin.local -p root/admin -q "ank -policy user -randkey $USER@HCOOP.NET"
-sudo kadmin.local -p root/admin -q "ank -policy mailfilter -randkey $USER/mailfilter@HCOOP.NET"
-sudo kadmin.local -p root/admin -q "ank -policy cgi -randkey $USER/cgi@HCOOP.NET"
-
+sudo kadmin.local -p root/admin -q "ank -policy user -randkey +requires_preauth $USER@HCOOP.NET"
+sudo kadmin.local -p root/admin -q "ank -policy mailfilter -randkey +requires_preauth $USER/mailfilter@HCOOP.NET"
+sudo kadmin.local -p root/admin -q "ank -policy cgi -randkey +requires_preauth $USER/cgi@HCOOP.NET"
#
# Create AFS users corresponding to krb5 principals.
PATHBITS=`echo $USER | head -c 1`/`echo $USER | head -c 2`/$USER
HOMEPATH=/afs/hcoop.net/user/$PATHBITS
MAILPATH=/afs/hcoop.net/common/email/$PATHBITS
-DBPATH=/afs/hcoop.net/common/databases/$PATHBITS
+DBPATH=/afs/hcoop.net/common/.databases/$PATHBITS
PGDIR=$DBPATH/postgres
MYSQLDIR=$DBPATH/mysql
objectClass: posixAccount
cn: $USER
uid: $USER
-uidNumber: $ID
gidNumber: $ID
-homeDirectory: $HOMEPATH
sn: $USER
host: abulafia
host: mire
objectClass: posixAccount
cn: $USER.mailfilter
uid: $USER.mailfilter
-uidNumber: $ID_MF
gidNumber: $ID_MF
-homeDirectory: $HOMEPATH
sn: $USER.mailfilter
dn: cn=$USER.mailfilter,ou=Group,dc=hcoop,dc=net
objectClass: posixAccount
cn: $USER.cgi
uid: $USER.cgi
-uidNumber: $ID_CGI
gidNumber: $ID_CGI
-homeDirectory: $HOMEPATH
sn: $USER.cgi
dn: cn=$USER.cgi,ou=Group,dc=hcoop,dc=net
fs ls $MAILPATH || fs mkm $MAILPATH mail.$USER
fs ls $HOMEPATH/Maildir || fs mkm $HOMEPATH/Maildir mail.$USER
fs sa $MAILPATH $USER all
+fs sa $MAILPATH system:anyuser l
fs sa $MAILPATH $USER.mailfilter all
# DATABASE VOLUME