Add/Configure Users and Groups

For most of the time having local users and groups is not a good idea as it does not scale well. Or you run into collisions concerning the user or group id.

If they reside in the Active Directory, they can be used by multiple devices and allow for kerberized data exchange, e.g. using CIFS or NFSv4.

Order/Manage a Linux Group in AD

A new Linux group can be ordered using a free text request in ServiceNow. There are automated processes to add and remove members from Linux groups.

Order User in AD

Following user types can be ordered:

personal user account
external user account
user account with shared password aka global user account aka GAC account
service user (free text request)
experiment accounts aka eaccounts are managed via DUO

Configure Local Users

The definition of a local user in Hiera is done below the local_accounts::user_defs key:

local_accounts::user_defs:
  'archadm':
    'uid': 503
    'gid': 503
    'home': '/home/archadm'
    'shell': '/bin/bash'
    'password': ENC[...
    'managehome': true
    'comment': 'Archiver Admin'
  'twlhaop':
    'uid': 884
    'gid': 884
    'home': '/home/twlhaop'
    'shell': '/bin/bash'
    'password': ENC[...
    'managehome': true
    'comment': 'TWLHA Operator'

The password is the password hash as in /etc/shadow. It can be generated with openssl passwd -6. Ideally the password hash is stored encrypted with eyaml in Hiera.

To have the user actually configured on a given node, it needs to be added to the local_accounts::users Hiera key:

local_accounts::users:
  - 'archadm'

Note that this configures the user on the system, but login is only possible if there are access permissions in place too.

Configure Local Groups

The configuration of a local group in Hiera consists first of a group definition below the local_accounts::group_defs key:

local_accounts::group_defs:
  'archadm': 503
  'twlhaop': 884

As you see the group name is the key and the according group id the value.

To have the group actually configured on a given node, it needs to be added to the local_accounts::groups Hiera key:

local_accounts::groups:
  - 'twlhaop'

Configure Local Group Members

Below example adds AD users to a local, already predefined group dialout (which is allows to access serial interfaces):

local_accounts::group_defs:
  dialout:
     members:
       - 'lx_test'
       - 'svcusr-lx_test'

local_accounts::groups:
  - 'dialout'

3.2 KiB Raw Permalink Blame History