Add User Accounts
2015/05/25 |
Add LDAP User Accounts in the OpenLDAP Server.
|
|
[1] | Add a user. |
# generate encrypted password root@dlp:~# slappasswd New password: Re-enter new password: {SSHA}xxxxxxxxxxxxxxxxx
root@dlp:~#
vi ldapuser.ldif
# create new
# replace to your own domain name for "dc=***,dc=***" section dn: uid=vervet,ou=people,dc=srv,dc=world objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount cn: vervet sn: ubuntu userPassword: {SSHA}xxxxxxxxxxxxxxxxx loginShell: /bin/bash uidNumber: 1000 gidNumber: 1000 homeDirectory: /home/vervet dn: cn=vervet,ou=groups,dc=srv,dc=world objectClass: posixGroup cn: vervet gidNumber: 1000 memberUid: vervet ldapadd -x -D cn=admin,dc=srv,dc=world -W -f ldapuser.ldif Enter LDAP Password: adding new entry "uid=vervet,ou=people,dc=srv,dc=world" adding new entry "cn=vervet,ou=groups,dc=srv,dc=world" |
[2] | Add users and groups in local passwd/group to LDAP directory. |
root@dlp:~#
vi ldapuser.sh
# extract local users and groups who have 1000-9999 digit UID
# replace "SUFFIX=***" to your own domain name # this is an example #!/bin/bash SUFFIX='dc=srv,dc=world' LDIF='ldapuser.ldif' echo -n > $LDIF for line in `grep "x:[1-9][0-9][0-9][0-9]:" /etc/passwd | sed -e "s/ /%/g"` do LUID="`echo $line | cut -d: -f1`" NAME="`echo $line | cut -d: -f5 | cut -d, -f1`" if [ ! "$NAME" ] then NAME="$LUID" else NAME=`echo "$NAME" | sed -e 's/%/ /g'` fi SN=`echo "$NAME" | awk '{print $2}'` [ ! "$SN" ] && SN="$NAME" SHADOWFLAG=`grep $LUID: /etc/shadow | cut -d: -f9` [ ! "$SHADOWFLAG" ] && SHADOWFLAG="0" echo "dn: uid=$LUID,ou=people,$SUFFIX" >> $LDIF echo "objectClass: inetOrgPerson" >> $LDIF echo "objectClass: posixAccount" >> $LDIF echo "objectClass: shadowAccount" >> $LDIF echo "sn: $SN" >> $LDIF echo "givenName: `echo $NAME | awk '{print $1}'`" >> $LDIF echo "cn: $NAME" >> $LDIF echo "displayName: $NAME" >> $LDIF echo "uidNumber: `echo $line | cut -d: -f3`" >> $LDIF echo "gidNumber: `echo $line | cut -d: -f4`" >> $LDIF echo "userPassword: {crypt}`grep $LUID: /etc/shadow | cut -d: -f2`" >> $LDIF echo "gecos: $NAME" >> $LDIF echo "loginShell: `echo $line | cut -d: -f7`" >> $LDIF echo "homeDirectory: `echo $line | cut -d: -f6`" >> $LDIF echo "shadowExpire: `passwd -S $LUID | awk '{print $7}'`" >> $LDIF echo "shadowFlag: $SHADOWFLAG" >> $LDIF echo "shadowWarning: `passwd -S $LUID | awk '{print $6}'`" >> $LDIF echo "shadowMin: `passwd -S $LUID | awk '{print $4}'`" >> $LDIF echo "shadowMax: `passwd -S $LUID | awk '{print $5}'`" >> $LDIF echo "shadowLastChange: `grep $LUID: /etc/shadow | cut -d: -f3`" >> $LDIF echo >> $LDIF done for line in `grep "x:[1-9][0-9][0-9][0-9]:" /etc/group` do CN="`echo $line | cut -d: -f1`" LGID="`echo $line | cut -d: -f3`" echo "dn: cn=$CN,ou=groups,$SUFFIX" >> $LDIF echo "objectClass: posixGroup" >> $LDIF echo "cn: $CN" >> $LDIF echo "gidNumber: $LGID" >> $LDIF echo "memberUid: `grep ":$LGID:" /etc/passwd | cut -d: -f1`" >> $LDIF users="`echo $line | cut -d: -f4`" if [ "$users" ] then for user in `echo "$users" | sed 's/,/ /g'` do [ ! "$CN" = "$user" ] && echo "memberUid: $user" >> $LDIF done fi echo >> $LDIF done sh ldapuser.sh root@dlp:~# ldapadd -x -D cn=admin,dc=srv,dc=world -W -f ldapuser.ldif Enter LDAP Password: adding new entry "uid=jessie,ou=people,dc=srv,dc=world" adding new entry "uid=ubuntu,ou=people,dc=srv,dc=world" adding new entry "uid=debian,ou=people,dc=srv,dc=world" adding new entry "uid=redhat,ou=people,dc=srv,dc=world" adding new entry "cn=jessie,ou=groups,dc=srv,dc=world" adding new entry "cn=ubuntu,ou=groups,dc=srv,dc=world" adding new entry "cn=debian,ou=groups,dc=srv,dc=world" adding new entry "cn=redhat,ou=groups,dc=srv,dc=world" |
[3] | If you'd like to delete LDAP User or Group, Do as below. |
root@dlp:~# ldapdelete -x -W -D 'cn=admin,dc=srv,dc=world' "uid=ubuntu,ou=people,dc=srv,dc=world" Enter LDAP Password: root@dlp:~# ldapdelete -x -W -D 'cn=admin,dc=srv,dc=world' "cn=ubuntu,ou=groups,dc=srv,dc=world" Enter LDAP Password: |