The script from HELL.

Felicia1326 · 09-09-2010, 11:22 AM

I honestly don't have a lot of scripting knowledge, but would really like some at this moment in my career.

So there are several parts
1) look at the /etc/passwd file for users, excluding the default system users. I know how to do this the long hard irritating way (cat /etc/passwd | grep -v for 30 different strings) looking for a shorter more friendly method using an exclude list.

2) Perform an ldap query that cross references with AD to see if the users are currently employed. No clue where to even start on this one.

3) lock the users that do not match accross...I can handle the locking out of the returned users.

Uh help?

Sunshine...

anomie · 09-09-2010, 01:06 PM

#s 1 and 3 are trivial:

$ grep 'bash' /etc/passwd (<-- this assumes no system accounts have a bash shell)

# passwd -l <some_user> (<-- see the passwd(1) manpages)

#2: Dunno. Who configured authentication on the system you're managing? Did s/he provide any documentation?

Eduardo Nunes · 09-09-2010, 05:51 PM

Hi Felicia,

I don't know how to perform the ldap lookup neither what does it return.. but I hope this script block can give you a direction..

Code:

#!/bin/bash
# Picks up users that have an encrypted password, and for each do a ldap query.
for user in `egrep -e ".*:..+:.*:.*:.*:.*:.*:.*:$" /etc/shadow | awk -F: '{ print $1 }'`; do
  if [ ldapquery if $user is not employed ]; then
    # Lazy or Unemployed! Lock the user!
    passwd -l $user
  else
    # I can see clearly now the rain is gone... ;)
    passwd -u $user
  fi
done

Do you have a command which produces output only when a user is employed? As my imagination would name "ldapquery $user --check-employed" would return "employed" or nothing if its not employed anymore. Then the If [ -n "`ldapquery $user`" ]; would be the key you are looking for..

On the other side "ldapquery $user --show-unemployed" would turn the if to use -z instead of -n; -n proceed if the string is not empty; and -z proceeds when the string is empty;

You could supress the else to enable user access.. however I think keeping it makes the script synchronize shell logons with ldap correctly all the time it runs (if someone was re-employed, or by a mistake was marked as unemployed).

Regards!

ghostdog74 · 09-09-2010, 06:48 PM

Quote:

Originally Posted by Felicia1326

I honestly don't have a lot of scripting knowledge, but would really like some at this moment in my career.

So there are several parts
1) look at the /etc/passwd file for users, excluding the default system users. I know how to do this the long hard irritating way (cat /etc/passwd | grep -v for 30 different strings) looking for a shorter more friendly method using an exclude list.

2) Perform an ldap query that cross references with AD to see if the users are currently employed. No clue where to even start on this one.

3) lock the users that do not match accross...I can handle the locking out of the returned users.

if you have Python

Code:

import commands
exclude=['root','bin'] #add more here
users=[]
# store all users required
for line in open("/etc/passwd"):
    s=line.split()
    if not s[0] in users:
        users.append([s[0])

# do ldap query here
....

# do locking here
commands.getstatusoutput('passwd -l %s' %( user_to_lock ) )

For ldap, you can download Python wrapper here. Then read this document to see how its used.

ComputerErik · 09-10-2010, 07:23 PM

It sounds like your ultimate goal is to lock any local account in /etc/passwd (on some Linux machine(s)) if the user doesn't have an active account in AD. Why not just authenticate the users in both environments directly against Active Directory (LDAP) instead? This would greatly simplify management.

All of the included LDAP connection mechanisms included with Linux will work against AD, but can be a pain to setup. However there are some third party solutions (Likewise and Centrify) which make the task a breeze.

Felicia1326 · 09-15-2010, 12:05 PM

Thank you all for your input, I am currently working on the ldap query to check the users on our Solaris, Linux and HP-UX boxes against our users in AD. Once I've finished the script I will post it here.

ALthought the grep bash command worked and I only had to add a grep -v root, in order to lock the account I only need the username and '{print $1}' against /etc/passwd returns the user name the uid gid and the First name, guess that's all in column 1

Anyway I decided to just perform an ls on the /home directory and pull in my users this way using -v greps for oracle and a few other system users that would not need to be referenced. This gives me the username only so I can do the passwd -l <username here>

Felicia1326 · 09-21-2010, 12:01 PM

Here's what I'm testing and modifying currently. In case anyone has any suggestions...

#!/bin/bash

for i in `awk -F: '$7 ~ /\/bin\/bash/ || $7 ~ /\/bin\/sh/ {print $1}'
/etc/passwd`
do
echo "checking account: $i"
# Does account ($i) exist? set DNE (Does not exist) to 1 if
nothing is found.
DNE= `ldapsearch -LLL -x -H ldap://okcldap1.global.tronox.com:389 -b 'ou=Users,ou=Tronox,dc=Global,dc=Tronox,dc=com' -D 'Domain\username' -w 'pA$$w0rd' (sAMAccountName=$i)' | grep "No such object" | wc -l | awk '{print $1}'`
if [ $DNE = 1]
then
echo "$i should be locked"
fi
done