Table of Contents
Manage Users
User management is done via LDAP on the ldap-01 jail on bane. We use ldapscript_extension, a fork of ldapscripts with additional commands like ldapaddsshkey and ldapsetusermail.
Getting Started
SSH into bane and enter the LDAP jail:
ssh bane jexec ldap-01
All commands below are run from inside the ldap-01 jail.
Adding a New User
First, find the next available ID number — ignore 14999 (a special account):
lsldap -u | grep uidNumber | awk -F: '{print $2}' | tr -d ' ' | grep -v 14999 | sort -n | tail -1 | awk '{print $1+1}'
This prints the next available ID (highest UID + 1). This number will be used for both the UID and GID. Then create the user:
ldapadduser username newId newId
ldapadduser takes <username> <groupname | gid> [uid]. We pass the same number for both GID and UID, since each user gets their own primary group with a matching ID.
Creating Datasets
TO BE WRITTEN
Setting Password
ldapsetpasswd username
This prompts you to enter and confirm the new password.
Changing CN (Common Name / First Name)
ldapsetusercn username "Full Name"
Changing SN (Surname)
ldapsetusersn username "Surname"
Setting User Email
ldapsetusermail username user@example.com
Adding SSH Key
ldapaddsshkey username "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@host"
The public key must be quoted as a single argument.
Removing SSH Key
Removes an SSH public key from a user. If the exact key is not found, nothing is done.
ldapremovesshkey username "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@host"
Removing User Email
Removes a mail address from a user. If the exact mail is not found, nothing is done.
ldapremoveusermail username user@example.com
Adding User to a Group
ldapaddusertogroup username groupname
Getting User Info
ldapfinger username