Search for a command to run...
Software Engineer | Technical Writer
Bread and butter from React and Rails, but currently exploring Linux System Administration and Cloud Solutions/DevOps.
Learning everyday. Follow along with my series on creating Chrome Extensions, Desktop Apps (soon), and PWAs.
No comments yet. Be the first to comment.
I learned today that my main blog posts should be called "Today I Learned"s. I'm surprised my last post was over two months ago. I've been working on my new Chrome extension project, Chorus, making features, fixing problems, and getting it ready for ...
TLDR: Fix a bug, package and upload to Developer Dashboard, fill forms, submit for review, and look at analytics after going live. In this post, we want to create and submit an initial release for the Chrome Web Store and upload it to Github. Before ...
Here's a recap of what we want to accomplish for the first feature: Either disable or remove all the Add to queue UI (on hover and via the dropdown: Enable or disable the first feature by clicking on the extension in the toolbar, which controls t...
Building a Youtube Add-on to Regain Control of Queue Playlist
TLDR: This article demonstrates how to use AppleScript to control Spotify and display song information in a tmux status bar. Tmux is a terminal multiplexer: it enables several terminals to be created, accessed, and controlled from a single screen. T...
In this project, we want to onboard 20 new Linux users onto a server. Create a shell script that reads a CSV file of a list of users to be onboarded. Each user requires the following:
Must have a default /home directory, ie /home/cdrani/ for user cdrani
Each user must be added to a developers group
An .ssh folder with an authorized_keys file that includes the rsa.pub key of the current user ($USER)
Generating ssh private (id_rsa) and public key (id_rsa.pb) for $USER. The public key will be copied over to each onboarded user's .ssh/authorized_keys file. We will make use of ssh-keygen and just press Enter/Return key to accept the default file names and placement. In the end, we should have both id_rsa and id_rsa.pub keys in ~/.ssh folder.
sudo ssh-keygen
Now for the script itself. It's heavily documented with comments, but some additional criteria I included are to verify that the script is run by a root user, a .csv file is passed as an argument and a default password of password is set for each onboarded user with an expiration date of 7 days.
#!/bin/bash
# Exit if script is not run as root
if [ "$(id -u)" != "0" ]; then
echo "This script must be run as root."
exit 1
fi
# Exit if file is not provided
if [ $# -eq 0 ]; then
echo "Please provide the name of the CSV file."
exit 1
fi
# Exit if file provided is not a .csv file
file="$1"
if [ "${file##*.}" != "csv" ]; then
echo "The file must be a CSV file."
exit 1
fi
# Create developers group if it doesn't exist
if ! getent group developers > /dev/null 2>&1; then
groupadd developers
fi
# Read the CSV file
while IFS=',' read -r name
do
username=$name
# Check if user exists
if id "$username" >/dev/null 2>&1; then
echo "User $username already exists."
continue
fi
# Create user
useradd "$username" -g developers -m
echo "$username:default_password" | chpasswd
# Set password expiration to 7 days
# After expiration user needs to set/change password
chage -m 7 "$username"
# Ensure .ssh folder exists for user, otherwise create one
home_dir=$(eval echo "~$username")
ssh_dir="$home_dir/.ssh"
if [ ! -d "$ssh_dir" ]; then
mkdir "$ssh_dir"
chmod 700 "$ssh_dir" $username
fi
# Add public key to users' ~/.ssh/authorized_keys
auth_keys="$ssh_dir/authorized_keys"
touch "$auth_keys"
chmod 600 "$auth_keys" $username
# Need to give ownership to user else cannot login as them!!!
chown $username:developers "$auth_keys"
echo $(cat ~/.ssh/id_rsa.pub) >> "$auth_key"
done < "$file"
To run the script we need a *.csv file with a list of names:
# names.csv
beth
mark,
lucy,
fred,
liza
Then we need our script to be executable before we run it:
sudo chmod +x onboard_users.sh
sudo ./onboard_users.sh names.csv
Let's test out some of the conditionals we have in place:
We now should have /home/$user (for ex. /home/beth/) directories for each user in the names.csv file:
Finally, we should be able to log in as any of the newly onboarded users, however, our new users don't use the same private key that we set up when launching our ec2 instance - we must use the one we generated above (id_rsa).
First, we need to ensure our key is not publicly viewable, i.e it is not writable:
sudo chmod -w id_rsa
After the above, we can then copy the private key from our remote server (ec2) to our local environment using scp:
# scp -i <key> <remote_username>@<Host>:<PathToFile> <LocalFileLocation>
scp -i ~/Desktop/webserver-ec2.pem ubuntu@35.85.56.192:~/.ssh/id_rsa ~/.ssh/aux_id_rsa
With that complete, from our local computer, we can log in as an onboarded user:
ssh -i ~/.ssh/aux_id_rsa fred@38.85.56.192
Only users with the auth key can log in:
Note: One can log in using the *.pem key for the ec2 instance as well.
Testing the script several times to address issues necessitated removing users as well. This quickly turned into a pain point that required a deboard.sh script. It has the same checks as the onboard.sh one which could be refactored out into a separate script that runs before both of them, but it's good enough.
#!/bin/bash
if [ "$(id -u)" != "0" ]; then
echo "This script must be run as root."
exit 1
fi
# Check if argument is provided
if [ $# -eq 0 ]; then
echo "Please provide the name of the CSV file."
exit 1
fi
# Check if argument is a .csv file
file="$1"
if [ "${file##*.}" != "csv" ]; then
echo "The file must be a CSV file."
exit 1
fi
# Read the CSV file
while IFS=',' read -r fname lname
do
username=$fname
# Check if user exists
if ! id "$username" >/dev/null 2>&1; then
echo "User $username does not exist."
continue
fi
# Remove user
sudo userdel -r "$username"
done < "$file"