#!/usr/bin/perl
-# $Id: sync-accounts,v 1.10 1999-01-03 02:16:49 ian Exp $
+# $Id: sync-accounts,v 1.15 1999-01-03 17:45:15 ian Exp $
# usage: sync-accounts [-n] [-C<config-file>] [<host> ...]
# options:
# -n do not really do anything
# -C alternative config file (default is /etc/sync-accounts)
# -q display accounts synched, not synched, etc.
# if no host(s) specified, does all
+# host(s) may not be specified with -q
#
# The config file consists of directives, one per line. Leading and
# trailing whitespace, blank lines and lines starting # are ignored.
#
# Some config file directives apply globally and should appear first:
#
-# lockpasswd <suffix/filename>
-# lockgroup <suffix/filename>
+# lockpasswd <suffix/filename> [mandatory]
+# lockgroup <suffix/filename> [usu. mandatory]
# Specifies the lockfile suffix or pathname to use when editing
# the passwd and group files. The value is a suffix if it does
# not start with `/'. If set to /dev/null no locking is done.
#
-# logfile <filename>
+# logfile <filename> [default=stdout]
# Append log messages to <filename> instead of stdout.
# Errors still go to stderr.
#
# different points in the file. The most-recently-seen value is used
# at each point:
#
-# uidmin <min>
-# uidmax <max>
-# homebase <pathname>
+# uidmin <min> [no default]
+# uidmax <max> [no default]
+# homebase <pathname> [default=/home]
# When an account is to be created, a uid/gid will be chosen
# which is one higher than the highest currently in use (except
# that ids outside the range <min>-<max> are ignored and will
# never be used). The default home directory location is
# <pathname>/<username>.
#
-# sameuid
-# nosameuid
+# sameuid [this or uidmin/max req'd for creation]
+# nosameuid [default]
# Specifies whether uids are supposed to match. The default is
# nosameuid. When sameuid is on, it is an error for the uid or
# gid of a local account not to match the corresponding remote
# account, and new local accounts will get the remote accounts'
# ids.
#
-# usergroups
+# usergroups [default]
# nousergroups
# defaultgid <gid>
# Specifies whether local accounts are supposed to have
# is `usergroups'.
#
# createuser
-# createuser <commandname>
-# nocreateuser
+# createuser <commandname> [=`createuser sync-accounts-createuser']
+# nocreateuser [default]
# Specifies whether accounts found on the remote host should be
# created if necessary, and what command to run to do the
# creation (eg, setup of home directory). The default is
# the account will not be created after all.
#
# group <glob-pattern>
-# nogroup <glob-pattern>
+# nogroup <glob-pattern> [default=`nogroup *']
# Specifies that the membership of the local groups specified
# should be adjusted or not adjusted whenever account data for a
# particular user is copied, so that the account will be a member
# glob-pattern for a particular group takes effect. The default
# is `nogroups *'.
#
+# defaultshell <pathname> [default=/bin/sh]
+# If, when creating an account, the remote account's shell is not
+# available on the local system, this value will be used. The
+# default is /bin/sh.
+#
# Some config file directives are per-host, and should appear before
# any directives which actually modify accounts:
#
-# host <shorthostname>
+# host <shorthostname> [required]
# Starts a host's section. This resets the per-host parameters
# to the defaults. The shorthostname need not be the host's
# official name in any sense. If sync-accounts is invoked with
# host names on the command line they are compared with the
# shorthostnames.
#
-# getpasswd <command>
-# getgroup <command>
+# getpasswd <command> [required]
+# getgroup <command> [required for group sync.]
# Commands to run on the local host to get the passwd, shadow and
# group data for the host in question. getpasswd must be
# specified if user data is to be transferred; getgroup must be
# specified if group data is to be transferred.
#
-# getshadow <command>
+# getshadow <command> [optional]
# Specifies that shadow file data is to be used (by default,
# password information is found from the output of getpasswd).
# The command should emit shadow data in the format specified by
$configfile= '/etc/sync-accounts';
$def_createuser= 'sync-accounts-createuser';
$ch_homebase= '/home';
+$ch_defaultshell= '/bin/sh';
$defaultgid= -1; # -1 => usergroups; -2 => nousergroups
@groupglobs= [ '.*', 0 ];
regroupglobs();
}
}
+die "hosts must not be specified with -q\n" if @ARGV && $display;
+
for $h (@ARGV) { $wanthost{$h}= 1; }
open CF,"< $configfile" or die "$configfile: $!";
my ($lu,$ru) = @_;
#print STDERR "syncuser($lu,$ru)\n";
- next unless $ch_doinghost;
return if $doneuser{$lu}++;
+ next unless $ch_doinghost;
return if !length $ru;
fetchown();
}
@newpwent= ($lu,'x',$useuid,$usegid,$rempasswd{$ru}->[4],
- "$ch_homebase/$lu",$rempasswd{$ru}->[6]);
+ "$ch_homebase/$lu",$ch_defaultshell);
defined($c= open CU,"-|") or die $!;
if (!$c) {
copyfield('passwd',$lu,1, $rempasswd{$ru}->[1]);
}
copyfield('passwd',$lu,4, $rempasswd{$ru}->[4]); # comment
- copyfield('passwd',$lu,6, $rempasswd{$ru}->[6]); # shell
+
+ $newsh= $rempasswd{$ru}->[6];
+ $oksh= $checkedshell{$newsh};
+ if (!length $oksh) { $checkedshell{$newsh}= $oksh= (-x $newsh) ? 1 : 0; }
+ copyfield('passwd',$lu,6, $newsh) if $oksh;
if (!$nogroups) {
for $e (@owngroup) {
die $file unless $fetched;
banner();
$newfile= $no_act ? "$file.new" : "/etc/$file.new";
- open NF,"> $newfile";
+ open NF,"> $newfile" or die "$newfile: $!";
for $e (@$data_ref) {
print NF join(':',@$e),"\n" or die $!;
}
close NF or die $!;
system "diff -U0 /etc/$file $newfile"; $?==256 or die $?;
if (!$no_act) {
- (@stats= stat $file) or die "$file: $!";
+ (@stats= stat "/etc/$file") or die "$file: $!";
chown $stats[4],$stats[5], $newfile or die $!;
chmod $stats[2] & 07777, $newfile or die $!;
rename $newfile, "/etc/$file" or die $!;
eval "\$ch_$1= \$2; 1;" or die $@;
} elsif (m/^(lockpasswd|lockgroup)\s+(\S+)$/) {
eval "\$ch_$1= \$2; 1;" or die $@;
- } elsif (m,^(homebase)\s+(/\S+)$,) {
+ } elsif (m,^(homebase|defaultshell)\s+(/\S+)$,) {
eval "\$ch_$1= \$2; 1;" or die $@;
} elsif (m/^(uidmin|uidmax)\s+(\d+)$/ && $2>0) {
eval "\$ch_$1= \$2; 1;" or die $@;