forked from linux/documentation
71 lines
2.9 KiB
Markdown
71 lines
2.9 KiB
Markdown
# Add/Configure Users and Groups
|
|
For most of the time having local users and groups is not a good idea as it does not scale well. Or you run into collisions concerning the user or group id.
|
|
|
|
If they reside in the Active Directory, they can be used by multiple devices and allow for kerberized data exchange, e.g. using CIFS or NFSv4.
|
|
|
|
## Order/Manage a Linux Group in AD
|
|
|
|
A new Linux group can be ordered using a [free text request in ServiceNow](https://psi.service-now.com/psisp?id=psi_report_new_incident&sys_id=797c79ebdbf20454d648f90532961982).
|
|
There are automated processes to [add](https://psi.service-now.com/psisp?id=psi_new_sc_cat_item&sys_id=84f2c0c81b04f110679febd9bb4bcbb1) and [remove](https://psi.service-now.com/psisp?id=psi_new_sc_cat_item&sys_id=f1a86bb71b094e90d6a82f4aab4bcb87) members from Linux groups.
|
|
|
|
## Order User in AD
|
|
|
|
Following user types can be ordered:
|
|
|
|
- [personal user account](https://psi.service-now.com/psisp?id=psi_new_sc_cat_item&sys_id=c4849b181b27b050679febd9bb4bcb5f)
|
|
- [external user account](https://intranet.psi.ch/en/computing/external-vpnto-psiform)
|
|
- [user account with shared password aka global user account aka GAC account](https://psi.service-now.com/psisp?id=psi_new_sc_cat_item&sys_id=ef349a8adb5c9c50db20890b06961973)
|
|
- [service user (free text request)](https://psi.service-now.com/psisp?id=psi_report_new_incident&sys_id=797c79ebdbf20454d648f90532961982)
|
|
- experiment accounts aka eaccounts are managed via [DUO](https://duo.psi.ch)
|
|
|
|
## Configure Local Users
|
|
|
|
The definition of a local user in Hiera is done below the `local_accounts::user_defs` key:
|
|
|
|
```
|
|
local_accounts::user_defs:
|
|
'archadm':
|
|
'uid': 503
|
|
'gid': 503
|
|
'home': '/home/archadm'
|
|
'shell': '/bin/bash'
|
|
'password: ENC[...
|
|
'managehome': true
|
|
'comment': 'Archiver Admin'
|
|
'twlhaop':
|
|
'uid': 884
|
|
'gid': 884
|
|
'home': '/home/twlhaop'
|
|
'shell': '/bin/bash'
|
|
'password: ENC[...
|
|
'managehome': true
|
|
'comment': 'TWLHA Operator'
|
|
```
|
|
The password is the password has as in `/etc/shadow`. It can be generated with `openssl passwd -6`. Ideally the password hash is stored encrypted with [`eyaml`](../../puppet/eyaml) in Hiera.
|
|
|
|
To have the user actually configured on a given node, it needs to be added to the `local_accounts::users` Hiera key:
|
|
|
|
```
|
|
local_accounts::users:
|
|
- 'archadm'
|
|
```
|
|
|
|
Note that this configures the user on the system, but login is only possible if there are [access permissions](../access/system_access) in place too.
|
|
|
|
## Configure Local Groups
|
|
|
|
The configuration of a local group in Hiera consists first of a group definition below the `local_accounts::group_defs` key:
|
|
```
|
|
local_accounts::group_defs:
|
|
'archadm': 503
|
|
'twlhaop': 884
|
|
```
|
|
As you see the group name is the key and the according group id the value.
|
|
|
|
To have the group actually configured on a given node, it needs to be added to the `local_accounts::groups` Hiera key:
|
|
|
|
```
|
|
local_accounts::groups:
|
|
- 'twlhaop'
|
|
```
|