Differences

This shows you the differences between two versions of the page.

--- account [2011/10/04 15:10] – alex
+++ account [2016/10/30 09:01] (current) – [Creating an Account] alex
@@ Line 1: / Line 1: @@
 ====== User Account Handling ======
-As there is more than one server that will make up the Wormnet universe, in addition to a few xDSL joined NASes and systems, we need to roll out some kind of central user management database.  Naturally we opted for LDAP.
-The packages required to be installed to do this are:
+===== Creating an Account =====
-  * [[http://packages.debian.org/slapd|slapd]]
-  * [[http://packages.debian.org/nslcd|nslcd]]
-    * [[http://packages.debian.org/libnss-ldapd|libnss-ldapd]]
-    * [[http://packages.debian.org/libpam-ldapd|libpam-ldapd]]
-  * [[http://packages.debian.org/unscd|unscd]]
-===== User Management =====
+  root@marmot:~# lvcreate -L 256M -n home-$NEW_USER lvm-marmot
-==== Creating an Account ====
+  root@marmot:~# mkfs.ext4 -L home-$NEW_USER /dev/lvm-marmot/home-$NEW_USER
-  root@marmot:~# ldapaddgroup alex
+  root@marmot:~# mkdir /home/$NEW_USER
-  root@marmot:~# ldapadduser alex alex
+  root@marmot:~# [edit /etc/fstab to mount new user space]
-  Successfully added user alex to LDAP
+  root@marmot:~# mount /home/$NEW_USER
-  Successfully set password for user alex
+  root@marmot:~# useradd -G users,wormnet-shell -s /bin/bash $NEW_USER
+  root@marmot:~# passwd $NEW_USER
-  root@marmot:~# ldapvi --discover -D cn=admin,dc=wormnet,dc=eu -h ldapi:/// uid=alex
+  root@marmot:~# mkdir /home/$NEW_USER/.ssh
-  objectClass: ldapPublicKey
+  root@marmot:~# echo "ssh-rsa AAAB3...KD0pw== fred@foobar" > /home/$NEW_USER/.ssh/authorized_keys
-  sshPublicKey: ssh-rsa AAAB3...aLOOw== mb511
+  root@marmot:~# tar cC /etc/skel . | tar xC /home/$NEW_USER
-  sshPublicKey: ssh-rsa AAAB3...KD0pw== alex@chipmunk
+  root@marmot:~# chown -R $NEW_USER:$NEW_USER /home/$NEW_USER
+  root@marmot:~# chmod -R og-r-w-x /home/$NEW_USER
-  root@marmot:~# ldapvi --discover -D cn=admin,dc=wormnet,dc=eu -h ldapi:/// cn=shell
+==== Restricting to Just sftp/scp ====
-  memberUid: alex
+If you make the users account use the shell ''/usr/bin/rssh'' and edit ''/etc/rssh.conf'' then you can create accounts that can only upload/download files rather than have a full shell - although you will still need to add them to the 'wormnet-shell' group.
-  root@marmot:~# passwd alex
-  LDAP administrator password:
-  New password:
-  Retype new password:
-  passwd: password updated successfully
-  root@marmot:~# lvcreate -L 256M -n home-alex lvm-marmot
-  root@marmot:~# mkfs.ext4 -L home-alex /dev/lvm-marmot/home-alex
-  root@marmot:~# vi /etc/fstab
-  LABEL=home-alex         /home/alex      auto    relatime,nodev,nosuid,noexec             0  2
-  root@marmot:~# mkdir /home/alex
-  root@marmot:~# mount /home/alex
-  root@marmot:~# tar cC /etc/skel --owner=alex --group=alex . | tar xC /home/alex
-  root@marmot:~# chmod -R og-r-w-x /home/alex