From cd0db70e40cfbff23c4ae33aad88979b5c9a3763 Mon Sep 17 00:00:00 2001 From: bigmike160 Date: Sun, 23 Sep 2007 02:58:00 +0000 Subject: [PATCH] Check in create-user changes from megacz --- create-user | 101 ++++++++++++++++++++++++---------------------------- 1 file changed, 46 insertions(+), 55 deletions(-) diff --git a/create-user b/create-user index 7cc369b..a1c1788 100755 --- a/create-user +++ b/create-user @@ -12,6 +12,8 @@ USER=$1 +export PATH=$PATH:/afs/hcoop.net/common/bin/ + if test -z "$USER"; then echo "Invoke as create-user " exit 1 @@ -30,8 +32,8 @@ fi # as setting password right now - while it is more error tolerant). sudo kadmin.local -p root/admin -q "ank -policy user -randkey +requires_preauth $USER@HCOOP.NET" -sudo kadmin.local -p root/admin -q "ank -policy mailfilter -randkey +requires_preauth $USER/mailfilter@HCOOP.NET" -sudo kadmin.local -p root/admin -q "ank -policy cgi -randkey +requires_preauth $USER/cgi@HCOOP.NET" +sudo kadmin.local -p root/admin -q "modprinc -maxlife 1day $USER@HCOOP.NET" +sudo kadmin.local -p root/admin -q "ank -policy daemon -randkey +requires_preauth $USER/daemon@HCOOP.NET" # # Create AFS users corresponding to krb5 principals. @@ -40,10 +42,8 @@ sudo kadmin.local -p root/admin -q "ank -policy cgi -randkey +requires_preauth $ pts cu $USER || true ID=`pts examine $USER | head -n1 | sed 's_.*, id: *__' | sed 's_,.*__'` -pts cu $USER.mailfilter $ID_MF || true -ID_MF=`pts examine $USER.mailfilter | head -n1 | sed 's_.*, id: *__' | sed 's_,.*__'` -pts cu $USER.cgi || true -ID_CGI=`pts examine $USER.cgi | head -n1 | sed 's_.*, id: *__' | sed 's_,.*__'` +pts cu $USER.daemon || true +ID_DAEMON=`pts examine $USER.daemon | head -n1 | sed 's_.*, id: *__' | sed 's_,.*__'` # @@ -88,42 +88,23 @@ gidNumber: $ID memberUid: $USER " | sudo ldapadd -x -D cn=admin,dc=hcoop,dc=net -y /etc/ldap.secret || true -# USER.mailfilter entry +# USER.daemon entry echo " -dn: uid=$USER.mailfilter,ou=People,dc=hcoop,dc=net +dn: uid=$USER.daemon,ou=People,dc=hcoop,dc=net objectClass: top objectClass: person objectClass: posixAccount -cn: $USER.mailfilter -uid: $USER.mailfilter -gidNumber: $ID_MF -sn: $USER.mailfilter +cn: $USER.daemon +uid: $USER.daemon +gidNumber: $ID_DAEMON +sn: $USER.daemon -dn: cn=$USER.mailfilter,ou=Group,dc=hcoop,dc=net +dn: cn=$USER.daemon,ou=Group,dc=hcoop,dc=net objectClass: top objectClass: posixGroup -cn: $USER.mailfilter -gidNumber: $ID_MF -memberUid: $USER.mailfilter -" | sudo ldapadd -x -D cn=admin,dc=hcoop,dc=net -y /etc/ldap.secret || true - -# USER.cgi entry -echo " -dn: uid=$USER.cgi,ou=People,dc=hcoop,dc=net -objectClass: top -objectClass: person -objectClass: posixAccount -cn: $USER.cgi -uid: $USER.cgi -gidNumber: $ID_CGI -sn: $USER.cgi - -dn: cn=$USER.cgi,ou=Group,dc=hcoop,dc=net -objectClass: top -objectClass: posixGroup -cn: $USER.cgi -gidNumber: $ID_CGI -memberUid: $USER.cgi +cn: $USER.daemon +gidNumber: $ID_DAEMON +memberUid: $USER.daemon " | sudo ldapadd -x -D cn=admin,dc=hcoop,dc=net -y /etc/ldap.secret || true @@ -131,19 +112,19 @@ memberUid: $USER.cgi # Export .mailfilter and .cgi keys to a keytab file # -# create a mailfilter keytab (used by /etc/exim4/get-token) -sudo kadmin.local -p root/admin -q "ktadd -k /etc/keytabs/mailfilter/$USER $USER/mailfilter@HCOOP.NET" - -# create a cgi keytab -sudo kadmin.local -p root/admin -q "ktadd -k /etc/keytabs/cgi/$USER $USER/cgi@HCOOP.NET" +# create a daemon keytab (used by /etc/exim4/get-token) +# *only* if it does not exist! +test -e /etc/keytabs/user.daemon/$USER || \ + sudo kadmin.local -p root/admin -q "ktadd -k /etc/keytabs/user.daemon/$USER $USER/daemon@HCOOP.NET" -# Properly chown/mod keytab files (www-data must own the cgi keytab) -sudo chown www-data:wheel /etc/keytabs/cgi/$USER -sudo chown $USER:wheel /etc/keytabs/mailfilter/$USER -sudo chmod 440 /etc/keytabs/cgi/$USER /etc/keytabs/mailfilter/$USER +# Properly chown/mod keytab files (must be $USER:www-data) +sudo chown $USER:www-data /etc/keytabs/user.daemon/$USER +sudo chmod 440 /etc/keytabs/user.daemon/$USER # rsync keytabs to mire -rsync -e ssh -a /etc/keytabs/cgi/$USER mire.hcoop.net:/etc/keytabs/cgi/$USER +(cd /etc/keytabs + sudo tar clpf - user.daemon/$USER | \ + ssh mire.hcoop.net cd /etc/keytabs\; sudo tar xlpf -) # # Create/mount/set-perms on user's volumes (home, mail, databases, logs) @@ -156,17 +137,26 @@ mkdir -p `dirname $HOMEPATH` fs ls $HOMEPATH || fs mkm $HOMEPATH user.$USER chown $USER $HOMEPATH fs sa $HOMEPATH $USER all -fs sa $HOMEPATH system:anyuser rl +fs sa $HOMEPATH system:anyuser l # Apache logs mkdir -p $HOMEPATH/logs/apache -fs sa $HOMEPATH/logs/apache $USER.cgi rlwidk +fsr sa $HOMEPATH/logs/apache $USER.daemon rlwidk # public_html mkdir -p $HOMEPATH/public_html/ fs sa $HOMEPATH/public_html system:anyuser rl mkdir -p $HOMEPATH/.procmail.d/ fs sa $HOMEPATH/.procmail.d/ system:anyuser rl +mkdir -p $HOMEPATH/.public/ +fs sa $HOMEPATH/.public/ system:anyuser rl +test -e $HOMEPATH/.forward || \ + test -L $HOMEPATH/.forward || \ + ln -s $HOMEPATH/.public/.forward $HOMEPATH/.forward +mkdir -p $HOMEPATH/.public/.domtool/ +test -e $HOMEPATH/.domtool || \ + test -L $HOMEPATH/.domtool || \ + ln -s $HOMEPATH/.public/.domtool $HOMEPATH/.domtool # MAIL VOLUME vos examine mail.$USER 2>/dev/null || \ @@ -174,8 +164,8 @@ vos examine mail.$USER 2>/dev/null || \ mkdir -p `dirname $MAILPATH` fs ls $MAILPATH || fs mkm $MAILPATH mail.$USER fs ls $HOMEPATH/Maildir || fs mkm $HOMEPATH/Maildir mail.$USER -fs sa $MAILPATH $USER all -fs sa $MAILPATH $USER.mailfilter all +fs sa $MAILPATH $USER all +fsr sa $MAILPATH $USER.daemon all # DATABASE VOLUME if ! vos examine db.$USER >/dev/null 2>/dev/null; then @@ -207,12 +197,13 @@ fs sa -dir $MYSQLDIR -acl system:mysql write # Mount points for backup volumes # -mkdir -p `dirname /afs/hcoop.net/old/user/$PATHBITS` -mkdir -p `dirname /afs/hcoop.net/old/mail/$PATHBITS` -fs ls /afs/hcoop.net/old/user/$PATHBITS || \ - fs mkm /afs/hcoop.net/old/user/$PATHBITS user.$USER.backup -fs ls /afs/hcoop.net/old/mail/$PATHBITS || \ - fs mkm /afs/hcoop.net/old/mail/$PATHBITS mail.$USER.backup +mkdir -p `dirname /afs/hcoop.net/.old/user/$PATHBITS` +mkdir -p `dirname /afs/hcoop.net/.old/mail/$PATHBITS` +fs ls /afs/hcoop.net/.old/user/$PATHBITS || \ + fs mkm /afs/hcoop.net/.old/user/$PATHBITS user.$USER.backup +fs ls /afs/hcoop.net/.old/mail/$PATHBITS || \ + fs mkm /afs/hcoop.net/.old/mail/$PATHBITS mail.$USER.backup +vos release old # technically this might not be necessary, but for good measure... vos syncserv deleuze -- 2.20.1