X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ian/git?p=chiark-utils.git;a=blobdiff_plain;f=sync-accounts%2Fsync-accounts;h=50f7e33e174dd742ccec7e03bf66684542f61508;hp=583731cd39ffcac286b8a7e5d1e84e8581c41b90;hb=db8e92be30a7cee18371b629abbd942ffbf49c95;hpb=ae2071962afb3591c81e10f855fa3549d5d0c5f0

diff --git a/sync-accounts/sync-accounts b/sync-accounts/sync-accounts
index 583731c..50f7e33 100755
--- a/sync-accounts/sync-accounts
+++ b/sync-accounts/sync-accounts
@@ -1,24 +1,25 @@
 #!/usr/bin/perl
-# $Id: sync-accounts,v 1.6 1999-01-03 01:11:08 ian Exp $
+# $Id: sync-accounts,v 1.15 1999-01-03 17:45:15 ian Exp $
 # usage: sync-accounts [-n] [-C<config-file>] [<host> ...]
 # options:
 #   -n     do not really do anything
 #   -C     alternative config file (default is /etc/sync-accounts)
 #   -q     display accounts synched, not synched, etc.
 # if no host(s) specified, does all
+# host(s) may not be specified with -q
 #
 # The config file consists of directives, one per line.  Leading and
 # trailing whitespace, blank lines and lines starting # are ignored.
 #
 # Some config file directives apply globally and should appear first:
 #
-#  lockpasswd <suffix/filename>
-#  lockgroup <suffix/filename>
+#  lockpasswd <suffix/filename>		[mandatory]
+#  lockgroup <suffix/filename>		[usu. mandatory]
 #      Specifies the lockfile suffix or pathname to use when editing
 #      the passwd and group files.  The value is a suffix if it does
 #      not start with `/'.  If set to /dev/null no locking is done.
 #
-#  logfile <filename>
+#  logfile <filename>			[default=stdout]
 #      Append log messages to <filename> instead of stdout.
 #      Errors still go to stderr.
 #
@@ -26,38 +27,44 @@
 # different points in the file.  The most-recently-seen value is used
 # at each point:
 #
-#  uidmin <min>
-#  uidmax <max>
-#  homebase <pathname>
+#  uidmin <min>				[no default]
+#  uidmax <max>				[no default]
+#  homebase <pathname>			[default=/home]
 #      When an account is to be created, a uid/gid will be chosen
 #      which is one higher than the highest currently in use (except
 #      that ids outside the range <min>-<max> are ignored and will
 #      never be used).  The default home directory location is
 #      <pathname>/<username>.
 #
-#  sameuid
-#  nosameuid
+#  sameuid			[this or uidmin/max req'd for creation]
+#  nosameuid				[default]
 #      Specifies whether uids are supposed to match.  The default is
 #      nosameuid.  When sameuid is on, it is an error for the uid or
 #      gid of a local account not to match the corresponding remote
 #      account, and new local accounts will get the remote accounts'
 #      ids.
 #
-#  usergroups
+#  usergroups				[default]
 #  nousergroups
+#  defaultgid <gid>
 #      Specifies whether local accounts are supposed to have
-#      corresponding groups.  If this is set then when a new account
-#      is created, the corresponding per-user group will be created as
-#      well, and per-user groups are created for existing accounts if
-#      necessary (if account creation is enabled).  If the gid or
-#      group name for a per-user group is already taken for a
-#      different group name or gid this will be logged, and processing
-#      of that account will be inhibited, but it is not a fatal
-#      error.  The default is `usergroups'.
+#      corresponding groups, or all be part of a particular group.  If
+#      usergroups is set, when a new account is created, the
+#      corresponding per-user group will be created as well, and
+#      per-user groups are created for existing accounts if necessary
+#      (if account creation is enabled).  If the gid or group name for
+#      a per-user group is already taken for a different group name or
+#      gid this will be logged, and processing of that account will be
+#      inhibited, but it is not a fatal error.  If defaultgid is used,
+#      then newly-created accounts will be made a part of that group,
+#      and the groups of existing accounts will be left alone.  If
+#      nousergroups is specified then no new accounts can be created,
+#      and existing accounts' groups will be left alone.  The default
+#      is `usergroups'.
 #
 #  createuser
-#  createuser <commandname>
-#  nocreateuser
+#  createuser <commandname>	[=`createuser sync-accounts-createuser']
+#  nocreateuser				[default]
 #      Specifies whether accounts found on the remote host should be
 #      created if necessary, and what command to run to do the
 #      creation (eg, setup of home directory).  The default is
@@ -66,8 +73,24 @@
 #      the PATH if necessary.  Either sameuid, or both uidmin and
 #      uidmax, must be specified, if accounts are to be created.
 #
+#      The command (which will be run with sh -c) must at least create
+#      the new account's home directory.  The passwd and group entries
+#      will not have been set up.  The following environment variables
+#      will be set, giving details about the account to be created:
+#        SYNCACCOUNT_CREATE_USER
+#        SYNCACCOUNT_CREATE_UID
+#        SYNCACCOUNT_CREATE_GID
+#        SYNCACCOUNT_CREATE_COMMENT
+#        SYNCACCOUNT_CREATE_HOME
+#        SYNCACCOUNT_CREATE_SHELL
+#      If it chooses, the script may modify the password entry which
+#      will be added to the system, by outputting a replacement
+#      password file entry.  (The password field of that is ignored.)
+#      If the script outputs a line which does not contain a : then
+#      the account will not be created after all.
+#
 #  group <glob-pattern>
-#  nogroup <glob-pattern>
+#  nogroup <glob-pattern>		[default=`nogroup *']
 #      Specifies that the membership of the local groups specified
 #      should be adjusted or not adjusted whenever account data for a
 #      particular user is copied, so that the account will be a member
@@ -76,24 +99,29 @@
 #      glob-pattern for a particular group takes effect.  The default
 #      is `nogroups *'.
 #
+#  defaultshell <pathname>		[default=/bin/sh]
+#      If, when creating an account, the remote account's shell is not
+#      available on the local system, this value will be used.  The
+#      default is /bin/sh.
+#
 # Some config file directives are per-host, and should appear before
 # any directives which actually modify accounts:
 #
-#  host <shorthostname>
+#  host <shorthostname>			[required]
 #      Starts a host's section.  This resets the per-host parameters
 #      to the defaults.  The shorthostname need not be the host's
 #      official name in any sense.  If sync-accounts is invoked with
 #      host names on the command line they are compared with the
 #      shorthostnames.
 #
-#  getpasswd <command>
-#  getgroup <command>
+#  getpasswd <command>			[required]
+#  getgroup <command>			[required for group sync.]
 #      Commands to run on the local host to get the passwd, shadow and
 #      group data for the host in question.  getpasswd must be
 #      specified if user data is to be transferred; getgroup must be
 #      specified if group data is to be transferred.
 #
-#  getshadow <command>
+#  getshadow <command>			[optional]
 #      Specifies that shadow file data is to be used (by default,
 #      password information is found from the output of getpasswd).
 #      The command should emit shadow data in the format specified by
@@ -139,7 +167,8 @@ use POSIX;
 $configfile= '/etc/sync-accounts';
 $def_createuser= 'sync-accounts-createuser';
 $ch_homebase= '/home';
-$opt_usergroups= 1;
+$ch_defaultshell= '/bin/sh';
+$defaultgid= -1; # -1 => usergroups; -2 => nousergroups
 @groupglobs= [ '.*', 0 ];
 regroupglobs();
 
@@ -170,6 +199,8 @@ while ($ARGV[0] =~ m/^-/) {
     }
 }
 
+die "hosts must not be specified with -q\n" if @ARGV && $display;
+
 for $h (@ARGV) { $wanthost{$h}= 1; }    
 
 open CF,"< $configfile" or die "$configfile: $!";
@@ -292,7 +323,7 @@ sub fetchgroup () {
 sub syncusergroup ($$) {
     my ($lu,$luid) = @_;
 
-    return 1 if !$opt_usergroups;
+    return 1 if $defaultgid != -1;
 #print STDERR "syncusergroup($lu,$luid)\n";
     $ugfound=0;
     
@@ -334,8 +365,8 @@ sub syncuser ($$) {
     my ($lu,$ru) = @_;
 
 #print STDERR "syncuser($lu,$ru)\n";
-    next unless $ch_doinghost;
     return if $doneuser{$lu}++;
+    next unless $ch_doinghost;
     return if !length $ru;
 
     fetchown();
@@ -367,24 +398,27 @@ sub syncuser ($$) {
 
 	if ($opt_sameuid) {
 	    $useuid= $rempasswd{$ru}->[2];
+	    $usegid= $rempasswd{$ru}->[3];
 	} else {
-	    length $ch_uidmin or die "no uidmin specified, cannot create users";
-	    length $ch_uidmax or die "no uidmax specified, cannot create users";
-	    $ch_uidmin<$ch_uidmax or die "uidmin>=uidmax specified, cannot create users";
+	    die "nousergroups specified, cannot create users\n" if $defaultgid==-2;
+	    length $ch_uidmin or die "no uidmin specified, cannot create users\n";
+	    length $ch_uidmax or die "no uidmax specified, cannot create users\n";
+	    $ch_uidmin<$ch_uidmax or die "uidmin>=uidmax, cannot create users\n";
 	
 	    $useuid= $ch_uidmin;
-	    for $e (@ownpasswd, @owngroup) {
+	    for $e ($defaultgid==-1 ? (@ownpasswd, @owngroup) : (@ownpasswd)) {
 		$tuid= $e->[2]; next if $tuid<$useuid || $tuid>$ch_uidmax;
 		if ($tuid==$ch_uidmax) {
-		    diag("uid/gid $ch_uidmax used, cannot create users");
+		    diag("uid (or gid?) $ch_uidmax used, cannot create users");
 		    return;
 		}
 		$useuid= $tuid+1;
 	    }
+	    $usegid= $defaultgid==-1 ? $useuid : $defaultgid;
 	}
 	
-	@newpwent= ($lu,'x',$useuid,$useuid,$rempasswd{$ru}->[4],
-		    "$ch_homebase/$lu",$rempasswd{$ru}->[6]);
+	@newpwent= ($lu,'x',$useuid,$usegid,$rempasswd{$ru}->[4],
+		    "$ch_homebase/$lu",$ch_defaultshell);
 	
 	defined($c= open CU,"-|") or die $!;
 	if (!$c) {
@@ -444,7 +478,11 @@ sub syncuser ($$) {
 	copyfield('passwd',$lu,1, $rempasswd{$ru}->[1]);
     }
     copyfield('passwd',$lu,4, $rempasswd{$ru}->[4]); # comment
-    copyfield('passwd',$lu,6, $rempasswd{$ru}->[6]); # shell
+
+    $newsh= $rempasswd{$ru}->[6];
+    $oksh= $checkedshell{$newsh};
+    if (!length $oksh) { $checkedshell{$newsh}= $oksh= (-x $newsh) ? 1 : 0; }
+    copyfield('passwd',$lu,6, $newsh) if $oksh;
 
     if (!$nogroups) {
 	for $e (@owngroup) {
@@ -515,20 +553,16 @@ sub finish () {
 	die $file unless $fetched;
 	banner();
 	$newfile= $no_act ? "$file.new" : "/etc/$file.new";
-	open NF,"> $newfile";
+	open NF,"> $newfile" or die "$newfile: $!";
 	for $e (@$data_ref) {
 	    print NF join(':',@$e),"\n" or die $!;
 	}
 	close NF or die $!;
 	system "diff -U0 /etc/$file $newfile"; $?==256 or die $?;
 	if (!$no_act) {
-	    if ($file eq 'shadow') {
-		system "chown root.shadow $newfile"; $? and die $?;
-		chmod 0640, $newfile or die $!;
-	    } else {
-		chown 0,0, $newfile or die $!;
-		chmod 0644, $newfile or die $!;
-	    }
+	    (@stats= stat "/etc/$file") or die "$file: $!";
+	    chown $stats[4],$stats[5], $newfile or die $!;
+	    chmod $stats[2] & 07777, $newfile or die $!;
 	    rename $newfile, "/etc/$file" or die $!;
 	}
     }
@@ -556,7 +590,7 @@ while (<CF>) {
 	eval "\$ch_$1= \$2; 1;" or die $@;
     } elsif (m/^(lockpasswd|lockgroup)\s+(\S+)$/) {
 	eval "\$ch_$1= \$2; 1;" or die $@;
-    } elsif (m,^(homebase)\s+(/\S+)$,) {
+    } elsif (m,^(homebase|defaultshell)\s+(/\S+)$,) {
 	eval "\$ch_$1= \$2; 1;" or die $@;
     } elsif (m/^(uidmin|uidmax)\s+(\d+)$/ && $2>0) {
 	eval "\$ch_$1= \$2; 1;" or die $@;
@@ -572,8 +606,14 @@ while (<CF>) {
 	} elsif (!$display) {
 	    print "would log to $1\n" or die $!;
 	}
-    } elsif (m/^(no|)(sameuid|usergroups)$/) {
+    } elsif (m/^(no|)(sameuid)$/) {
 	eval "\$opt_$2= ".($1 eq 'no' ? 0 : 1)."; 1;" or die $@;
+    } elsif (m/^usergroups$/) {
+	$defaultgid= -1;
+    } elsif (m/^nousergroups$/) {
+	$defaultgid= -2;
+    } elsif (m/^defaultgid\s+(\d+)$/) {
+	$defaultgid= $1;
     } elsif (m/^(no|)group\s+([-+.0-9a-zA-Z*?]+)$/) {
 	$yes= $1 eq 'no' ? 0 : 1;
 	$_= $2;