Add User Accounts
2015/05/28 |
Add LDAP User accounts to the OpenLDAP Server.
|
|
[1] | Add a User. |
# generate encrypted password [root@dlp ~]# slappasswd New password: Re-enter new password: {SSHA}xxxxxxxxxxxxxxxxx
[root@dlp ~]#
vi ldapuser.ldif
# create new
# replace the section "dc=***,dc=***" to your own suffix dn: uid=fedora,ou=People,dc=srv,dc=world objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount cn: Fedora sn: Linux userPassword: {SSHA}xxxxxxxxxxxxxxxxx loginShell: /bin/bash uidNumber: 1000 gidNumber: 1000 homeDirectory: /home/fedora dn: cn=fedora,ou=Group,dc=srv,dc=world objectClass: posixGroup cn: Fedora gidNumber: 1000 memberUid: fedora ldapadd -x -D cn=Manager,dc=srv,dc=world -W -f ldapuser.ldif Enter LDAP Password: adding new entry "uid=fedora,ou=People,dc=srv,dc=world" adding new entry "cn=fedora,ou=Group,dc=srv,dc=world" |
[2] | Add users and groups in local passwd/group to LDAP directory. |
[root@dlp ~]#
vi ldapuser.sh
# extract local users and groups who have 1000-9999 digit UID
# replace "SUFFIX=***" to your own domain name # this is an example #!/bin/bash SUFFIX='dc=srv,dc=world' LDIF='ldapuser.ldif' echo -n > $LDIF for line in `grep "x:[1-9][0-9][0-9][0-9]:" /etc/passwd | sed -e "s/ /%/g"` do LUID="`echo $line | cut -d: -f1`" NAME="`echo $line | cut -d: -f5 | cut -d, -f1`" if [ ! "$NAME" ] then NAME="$LUID" else NAME=`echo "$NAME" | sed -e 's/%/ /g'` fi SN=`echo "$NAME" | awk '{print $2}'` [ ! "$SN" ] && SN="$NAME" LASTCHANGEFLAG=`grep $LUID: /etc/shadow | cut -d: -f3` [ ! "$LASTCHANGEFLAG" ] && LASTCHANGEFLAG="0" SHADOWFLAG=`grep $LUID: /etc/shadow | cut -d: -f9` [ ! "$SHADOWFLAG" ] && SHADOWFLAG="0" echo "dn: uid=$LUID,ou=People,$SUFFIX" >> $LDIF echo "objectClass: inetOrgPerson" >> $LDIF echo "objectClass: posixAccount" >> $LDIF echo "objectClass: shadowAccount" >> $LDIF echo "sn: $SN" >> $LDIF echo "givenName: `echo $NAME | awk '{print $1}'`" >> $LDIF echo "cn: $NAME" >> $LDIF echo "displayName: $NAME" >> $LDIF echo "uidNumber: `echo $line | cut -d: -f3`" >> $LDIF echo "gidNumber: `echo $line | cut -d: -f4`" >> $LDIF echo "userPassword: {crypt}`grep $LUID: /etc/shadow | cut -d: -f2`" >> $LDIF echo "gecos: $NAME" >> $LDIF echo "loginShell: `echo $line | cut -d: -f7`" >> $LDIF echo "homeDirectory: `echo $line | cut -d: -f6`" >> $LDIF echo "shadowExpire: `passwd -S $LUID | awk '{print $7}'`" >> $LDIF echo "shadowFlag: $SHADOWFLAG" >> $LDIF echo "shadowWarning: `passwd -S $LUID | awk '{print $6}'`" >> $LDIF echo "shadowMin: `passwd -S $LUID | awk '{print $4}'`" >> $LDIF echo "shadowMax: `passwd -S $LUID | awk '{print $5}'`" >> $LDIF echo "shadowLastChange: $LASTCHANGEFLAG" >> $LDIF echo >> $LDIF done for line in `grep "x:[1-9][0-9][0-9][0-9]:" /etc/group` do CN="`echo $line | cut -d: -f1`" LGID="`echo $line | cut -d: -f3`" echo "dn: cn=$CN,ou=Group,$SUFFIX" >> $LDIF echo "objectClass: posixGroup" >> $LDIF echo "cn: $CN" >> $LDIF echo "gidNumber: $LGID" >> $LDIF echo "memberUid: `grep ":$LGID:" /etc/passwd | cut -d: -f1`" >> $LDIF users="`echo $line | cut -d: -f4`" if [ "$users" ] then for user in `echo "$users" | sed 's/,/ /g'` do [ ! "$CN" = "$user" ] && echo "memberUid: $user" >> $LDIF done fi echo >> $LDIF done sh ldapuser.sh [root@dlp ~]# ldapadd -x -D cn=Manager,dc=srv,dc=world -W -f ldapuser.ldif Enter LDAP Password: adding new entry "uid=fedora,ou=People,dc=srv,dc=world" adding new entry "uid=redhat,ou=People,dc=srv,dc=world" adding new entry "uid=ubuntu,ou=People,dc=srv,dc=world" adding new entry "uid=debian,ou=People,dc=srv,dc=world" adding new entry "cn=fedora,ou=Group,dc=srv,dc=world" adding new entry "cn=redhat,ou=Group,dc=srv,dc=world" adding new entry "cn=ubuntu,ou=Group,dc=srv,dc=world" adding new entry "cn=debian,ou=Group,dc=srv,dc=world" |
[3] | If you'd like to delete LDAP User or Group, Do as below. |
[root@dlp ~]# ldapdelete -x -W -D 'cn=Manager,dc=srv,dc=world' "uid=fedora,ou=People,dc=srv,dc=world" Enter LDAP Password: [root@dlp ~]# ldapdelete -x -W -D 'cn=Manager,dc=srv,dc=world' "cn=fedora,ou=Group,dc=srv,dc=world" Enter LDAP Password: |