2.9 KiB
Add/Configure Users and Groups
For most of the time having local users and groups is not a good idea as it does not scale well. Or you run into collisions concerning the user or group id.
If they reside in the Active Directory, they can be used by multiple devices and allow for kerberized data exchange, e.g. using CIFS or NFSv4.
Order/Manage a Linux Group in AD
A new Linux group can be ordered using a free text request in ServiceNow. There are automated processes to add and remove members from Linux groups.
Order User in AD
Following user types can be ordered:
- personal user account
- external user account
- user account with shared password aka global user account aka GAC account
- service user (free text request)
- experiment accounts aka eaccounts are managed via DUO
Configure Local Users
The definition of a local user in Hiera is done below the local_accounts::user_defs key:
local_accounts::user_defs:
'archadm':
'uid': 503
'gid': 503
'home': '/home/archadm'
'shell': '/bin/bash'
'password: ENC[...
'managehome': true
'comment': 'Archiver Admin'
'twlhaop':
'uid': 884
'gid': 884
'home': '/home/twlhaop'
'shell': '/bin/bash'
'password: ENC[...
'managehome': true
'comment': 'TWLHA Operator'
The password is the password has as in /etc/shadow. It can be generated with openssl passwd -6. Ideally the password hash is stored encrypted with eyaml in Hiera.
To have the user actually configured on a given node, it needs to be added to the local_accounts::users Hiera key:
local_accounts::users:
- 'archadm'
Note that this configures the user on the system, but login is only possible if there are access permissions in place too.
Configure Local Groups
The configuration of a local group in Hiera consists first of a group definition below the local_accounts::group_defs key:
local_accounts::group_defs:
'archadm': 503
'twlhaop': 884
As you see the group name is the key and the according group id the value.
To have the group actually configured on a given node, it needs to be added to the local_accounts::groups Hiera key:
local_accounts::groups:
- 'twlhaop'