topic Re: useradd script for support in Operating System - HP-UX

useradd script for support

Stephanie L Davenport — Thu, 25 Sep 2008 16:19:25 GMT

Can someone please help me out with a script?

The support people where I work need to have root access to create/modify/disable users but, we don't want to give them shell access.

So, I have the menu set up but, I am having issues with the script that the menu would call.

Does anyone have something similar to what I am looking for so I don't have to "reinvent the wheel"? I just need something that will ask for the user information (login, name, group) and create the user (home dir, passwd entry, etc...) while checking to make sure that the login does not already exist.

Thanks for your help!

p.s. the menu is a shell script. I would like the useradd script to also be in shell.

Re: useradd script for support

Robert-Jan Goossens_1 — Thu, 25 Sep 2008 16:28:21 GMT

Hi Stephanie,

You could create a restricted shh session for the support desk, like the old sam -r (restricted) version.

From docs.hp.com

If you need to give limited superuser access to a nonsuperuser, you can activate the Restricted SMH Builder. Using the Restricted SMH Builder, you can enable or disable selected SMH areas for the user. To activate the Restricted SMH Builder, enter:

# smh -r

When users with restricted access execute SMH, they will have superuser status in the defined areas and will only see those SMH areas in the menu. All other areas of SMH will be hidden from the user. When users without access permissions execute SMH, they will receive an error message stating they must be superuser.

You can also add more applications to SMH and set them up for restricted access.

http://docs.hp.com/en/5992-3387/ch02s11.html

Regards,
Robert-Jan

Re: useradd script for support

Robert-Jan Goossens_1 — Thu, 25 Sep 2008 16:34:30 GMT

Add on.

another option is the RBAC HP-UX Role-Based Access Control. Have a look at the info in below link. Software is available for 11i v2 + v3.

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=AccessControl

Regards,
Robert-Jan

Re: useradd script for support

Stephanie L Davenport — Thu, 25 Sep 2008 16:41:58 GMT

we don't have smh loaded on the system and it is 11iv1. :(

Any other ideas?

Re: useradd script for support

Ivan Krastev — Thu, 25 Sep 2008 16:47:50 GMT

Use webmin with restricted user. I have setup similar for adding/deleting users and mail aliases.

regards,
ivan

Re: useradd script for support

Tim Nelson — Thu, 25 Sep 2008 17:02:16 GMT

In the past we configured restricted SAM to run a password reset script as root.

Simple to do.

The script is the part need to concentrate on.

1) restrict the username that the helpdesk can change passwords for. e.g. root, admin people, and application accounts.

2) every activity should create an audit log, not just for the auditors but to audit who did what and when just in case an issue comes up.

Here is the logic.

Enter username:
if $username = root ||admins ||applications then exit

Can also use a resticted list, e.g. if attempting to change password for username in list then exit.

Pretty simple.

Re: useradd script for support

Stephanie L Davenport — Thu, 25 Sep 2008 17:07:21 GMT

The issue is that we are trying to make this as easy as possible for the support staff instead of myself. :)

I just need a script that reads in the login, name and group and runs either useradd, userdel or usermod depending on which menu item they picked.

They already have access to sam (restricted) and don't like this option.

Re: useradd script for support

James R. Ferguson — Thu, 25 Sep 2008 17:35:47 GMT

Hi Stephanie:

If 'sudo', restricted SAM/SMH or RBAC aren't viable options for you, then your choice may be (forbid I mention this!) a 'setuid' C-wrapper for your shell script.

Regards!

...JRF...

Re: useradd script for support

VK2COT — Fri, 26 Sep 2008 03:37:43 GMT

Hello,

Take a look at my Perl script:

http://www.circlingcycle.com.au/Unix-sources/add-batch-Unix-accounts.pl.txt

Add options for userdel or usermod and
you can do it easily.

Cheers,

VK2COT

Re: useradd script for support

Stephanie L Davenport — Mon, 13 Oct 2008 12:39:10 GMT

I will continue to look for a shell script that will do a useradd. Thanks for your help!