get-token

   1 #!/bin/bash
   2 # Get an AFS token for the given user.
   3 #
   4 # This is used to deliver mail with the appropriate credentials.
   5 #
   6 # Usage:
   7 #
   8 # get-token $USER
   9 # - If user is root, call this script as $USER
  10 #
  11 # get-token $USER norecurse
  12 # - Don't recursively call this script, even if user if root
  13
  14 REALUSER=$(whoami)
  15 USER=$1
  16 LOGFILE=/var/local/mail-tokens/weird-error.log
  17
  18 echo "`date` $REALUSER $USER (`groups`): $@" >> $LOGFILE
  19 #ps -eo euser,ruser,suser,fuser,comm,pid --ppid=$PPID --pid=$PPID --forest >> $LOGFILE
  20
  21 if test "$REALUSER" = "root"; then
  22     if test "$2" = "norecurse"; then
  23         echo "Error: running as root even after trying to change to $USER" \
  24             >> $LOGFILE
  25         exit 1
  26     fi
  27
  28     # Decide whether the user exists: getent returns 0 error code if so
  29     getent passwd "$USER" >/dev/null
  30     if test $? -ne 0; then
  31         echo "$USER is not a local user, so ignoring them" \
  32             >> $LOGFILE
  33         exit 1
  34     else
  35         USER=$(getent passwd "$1" | cut -d':' -f 1)
  36         exec sudo -u $USER -- $0 $1 norecurse
  37     fi
  38 fi
  39
  40 # Make sure USER exists, and resolve UIDs to a login name
  41 USER=$(getent passwd "$USER" | cut -d':' -f 1)
  42 LOGFILE=/var/local/mail-tokens/get-token-log.$USER
  43
  44 if test -z "$USER"; then
  45     echo "$USER is not a local user, so ignoring them" \
  46         >> /var/local/mail-tokens/weird-error.log
  47     exit 1
  48 fi
  49
  50 # fuse stdin and stderr
  51 exec 2>&1
  52
  53 # all future output goes to this file
  54 exec >& $LOGFILE
  55
  56 # print name of user
  57 echo "Running as user $REALUSER"
  58
  59 # debugging output
  60 if test "$2" = "debug"; then
  61     shift; shift
  62     echo "Debugging output: $*"
  63 fi
  64
  65 date
  66 groups
  67
  68 # set the credentials cache
  69 export KRB5CCNAME=FILE:/var/local/mail-tokens/krb5cc_$USER.email
  70
  71 # eliminate any previous tokens
  72 #kdestroy
  73 #unlog
  74 KEYTAB=/etc/keytabs/user.daemon/$USER
  75
  76 # display command-to-be-invoked as a sanity check
  77 set -x
  78
  79 (
  80 flock -s 666
  81 krenew -vtH 30 || (kinit -V -kt $KEYTAB $USER/daemon@HCOOP.NET && aklog)
  82
  83 # list tokens, for the sake of debugging
  84 tokens
  85
  86 ) 666>/var/local/mail-tokens/lock.$USER