Grant webalizer read permissions to new user logs

[hcoop/scripts.git] / create-service-user

#!/bin/bash -ex

# create a shared service user, that is not able to use mod_waklog.

# MUST be executed:
#  - on fritz
#  - as a user with an /etc/sudoers line
#  - member of "wheel" unix group on deleuze (FIXME: TRUE?)
#  - while holding tickets for a user who can 'ssh -K' to all nodes
#  - while holding tokens for a user who is:
#     - a member of system:administrator
#     - listed in 'bos listusers fritz'
#  - and who has been set up with Domtool admin privileges by:
#     - running 'domtool-adduser $USER' while holding AFS admin tokens as
#       someone who is already a Domtool admin
#     - running 'domtool-admin grant $USER priv all' as someone who is already a
#       Domtool admin
#       (To bootstrap yourself into admindom:
#         1. Run '/etc/init.d/domtool-server stop' on deleuze.
#         2. Run '/etc/init.d/domtool-slave stop' on all Domtool slave machines
#         3. Edit ~domtool/acl, following the example of adamc_admin to grant
#             yourself 'priv all'.
#         4. Run '/etc/init.d/domtool-server start' on deleuze.
#         5. Run '/etc/init.d/domtool-slave start' on all Domtool slave
#            machines.
#         6. Run 'domtool-adduser' as above.)

NEWUSER=$1

if test -z "$NEWUSER"; then
	echo "Invoke as create-user <USERNAME>"
	exit 1
fi

source /afs/hcoop.net/common/etc/scripts/lib/create-user-lib.sh

create_pts_user

create_home_volume

ensure_afs_servers_synced