This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong. ====== Manage Users ====== User management is done via LDAP on the ''ldap-01'' jail on bane. We use [[https://git.abi.am/varinka/ldapscript_extension|ldapscript_extension]], a fork of [[https://github.com/martymac/ldapscripts|ldapscripts]] with additional commands like ''ldapaddsshkey'' and ''ldapsetusermail''. ===== Getting Started ===== SSH into bane and enter the LDAP jail: <code> ssh bane jexec ldap-01 </code> All commands below are run from inside the ''ldap-01'' jail. ===== Adding a New User ===== First, find the next available ID number — ignore ''14999'' (a special account): <code> lsldap -u | grep uidNumber | awk -F: '{print $2}' | tr -d ' ' | grep -v 14999 | sort -n | tail -1 | awk '{print $1+1}' </code> This prints the next available ID (highest UID + 1). This number will be used for both the UID and GID. Then create the group and the user: <code> ldapaddgroup username newId </code> <code> ldapadduser username newId newId </code> ''ldapadduser'' takes ''<username> <groupname | gid> [uid]''. We pass the same number for both GID and UID, since each user gets their own primary group with a matching ID. ===== Setting Password ===== <code> ldapsetpasswd username </code> This prompts you to enter and confirm the new password. ===== Changing CN (Common Name / First Name) ===== <code> ldapsetusercn username "Full Name" </code> ===== Changing SN (Surname) ===== <code> ldapsetusersn username "Surname" </code> ===== Setting User Email ===== <code> ldapsetusermail username user@example.com </code> ===== Adding SSH Key ===== <code> ldapaddsshkey username "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@host" </code> The public key must be quoted as a single argument. ===== Removing SSH Key ===== Removes an SSH public key from a user. If the exact key is not found, nothing is done. <code> ldapremovesshkey username "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@host" </code> ===== Creating Datasets ===== For each user two datasets shall be created in the storage server, ''mustafar'', - 10G home and 100G user - in (/prefix)/home/username and (/prefix)/user/username respectively. <code> # creation of 10G/10G/12G home zfs create -o refquota=10G -o quota=12G -o reservation=12G znas1/abi/home/${username} # creation of 100G/100G/120G user zfs create -o refquota=100G -o quota=120G -o reservation=120G znas1/abi/user/${username} # Granting permissions to both chown -R ${userid}:${userid} /znas1/abi/home/${username} chown -R ${userid}:${userid} /znas1/abi/user/${username} </code> ===== Removing User Email ===== Removes a mail address from a user. If the exact mail is not found, nothing is done. <code> ldapremoveusermail username user@example.com </code> ===== Adding User to a Group ===== <code> ldapaddusertogroup username groupname </code> ===== Getting User Info ===== <code> ldapfinger username </code> ===== See Also ===== * [[infra:ldap|LDAP Configuration]] * [[infra:start|Infrastructure]]
