Table of Contents
Manage Users
User management is done via LDAP on the ldap-01 jail on bane. We use ldapscript_extension, a fork of ldapscripts with additional commands like ldapaddsshkey and ldapsetusermail.
Getting Started
SSH into bane and enter the LDAP jail:
ssh bane jexec ldap-01
All commands below are run from inside the ldap-01 jail.
Adding a New User
First, find the next available ID number — ignore 14999 (a special account):
lsldap -u | grep uidNumber | awk -F: '{print $2}' | tr -d ' ' | grep -v 14999 | sort -n | tail -1 | awk '{print $1+1}'
This prints the next available ID (highest UID + 1). This number will be used for both the UID and GID. Then create the user:
ldapadduser username newId newId
ldapadduser takes <username> <groupname | gid> [uid]. We pass the same number for both GID and UID, since each user gets their own primary group with a matching ID.
Creating Datasets
For each user two datasets shall be created in the storage - 10G home and 100G user - in (/prefix)/home/username and (/prefix)/user/username respectively.
# creation of 10G/10G/12G home
zfs create -o refquota=10G -o refreservation=10G -o reservation=12G znas1/abi/home/${username}
# creation of 100G/100G/120G user
zfs create -o refquota=100G -o refreservation=100G -o reservation=120G znas1/abi/user/${username}
# Granting permissions to both
chown -R ${userid}:${userid} /znas1/abi/home/${username}
chown -R ${userid}:${userid} /znas1/abi/user/${username}
Setting Password
ldapsetpasswd username
This prompts you to enter and confirm the new password.
Changing CN (Common Name / First Name)
ldapsetusercn username "Full Name"
Changing SN (Surname)
ldapsetusersn username "Surname"
Setting User Email
ldapsetusermail username user@example.com
Adding SSH Key
ldapaddsshkey username "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@host"
The public key must be quoted as a single argument.
Removing SSH Key
Removes an SSH public key from a user. If the exact key is not found, nothing is done.
ldapremovesshkey username "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@host"
Removing User Email
Removes a mail address from a user. If the exact mail is not found, nothing is done.
ldapremoveusermail username user@example.com
Adding User to a Group
ldapaddusertogroup username groupname
Getting User Info
ldapfinger username