Add User Accounts2015/05/25

	Add LDAP User Accounts in the OpenLDAP Server.
[1]	Add a user.

# generate encrypted password

root@dlp:~#

slappasswd

New password:
Re-enter new password:
{SSHA}xxxxxxxxxxxxxxxxx

root@dlp:~#

vi ldapuser.ldif

# create new
# replace to your own domain name for "dc=***,dc=***" section

dn: uid=vervet,ou=people,dc=srv,dc=world
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: vervet
sn: ubuntu
userPassword: {SSHA}xxxxxxxxxxxxxxxxx
loginShell: /bin/bash
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/vervet

dn: cn=vervet,ou=groups,dc=srv,dc=world
objectClass: posixGroup
cn: vervet
gidNumber: 1000
memberUid: vervet

root@dlp:~#

ldapadd -x -D cn=admin,dc=srv,dc=world -W -f ldapuser.ldif

Enter LDAP Password:

adding new entry "uid=vervet,ou=people,dc=srv,dc=world"

adding new entry "cn=vervet,ou=groups,dc=srv,dc=world"

[2]	Add users and groups in local passwd/group to LDAP directory.

root@dlp:~#

vi ldapuser.sh

# extract local users and groups who have 1000-9999 digit UID
# replace "SUFFIX=***" to your own domain name
# this is an example

#!/bin/bash

SUFFIX='dc=srv,dc=world'
LDIF='ldapuser.ldif'

echo -n > $LDIF
for line in `grep "x:[1-9][0-9][0-9][0-9]:" /etc/passwd | sed -e "s/ /%/g"`
do
    LUID="`echo $line | cut -d: -f1`"
    NAME="`echo $line | cut -d: -f5 | cut -d, -f1`"

    if [ ! "$NAME" ]
    then
        NAME="$LUID"
    else
        NAME=`echo "$NAME" | sed -e 's/%/ /g'`
    fi

    SN=`echo "$NAME" | awk '{print $2}'`
    [ ! "$SN" ] && SN="$NAME"

    SHADOWFLAG=`grep $LUID: /etc/shadow | cut -d: -f9`
    [ ! "$SHADOWFLAG" ] && SHADOWFLAG="0"

    echo "dn: uid=$LUID,ou=people,$SUFFIX" >> $LDIF
    echo "objectClass: inetOrgPerson" >> $LDIF
    echo "objectClass: posixAccount" >> $LDIF
    echo "objectClass: shadowAccount" >> $LDIF
    echo "sn: $SN" >> $LDIF
    echo "givenName: `echo $NAME | awk '{print $1}'`" >> $LDIF
    echo "cn: $NAME" >> $LDIF
    echo "displayName: $NAME" >> $LDIF
    echo "uidNumber: `echo $line | cut -d: -f3`" >> $LDIF
    echo "gidNumber: `echo $line | cut -d: -f4`" >> $LDIF
    echo "userPassword: {crypt}`grep $LUID: /etc/shadow | cut -d: -f2`" >> $LDIF
    echo "gecos: $NAME" >> $LDIF
    echo "loginShell: `echo $line | cut -d: -f7`" >> $LDIF
    echo "homeDirectory: `echo $line | cut -d: -f6`" >> $LDIF
    echo "shadowExpire: `passwd -S $LUID | awk '{print $7}'`" >> $LDIF
    echo "shadowFlag: $SHADOWFLAG" >> $LDIF
    echo "shadowWarning: `passwd -S $LUID | awk '{print $6}'`" >> $LDIF
    echo "shadowMin: `passwd -S $LUID | awk '{print $4}'`" >> $LDIF
    echo "shadowMax: `passwd -S $LUID | awk '{print $5}'`" >> $LDIF
    echo "shadowLastChange: `grep $LUID: /etc/shadow | cut -d: -f3`" >> $LDIF
    echo >> $LDIF
done

for line in `grep "x:[1-9][0-9][0-9][0-9]:" /etc/group`
do
    CN="`echo $line | cut -d: -f1`"
    LGID="`echo $line | cut -d: -f3`"
    
    echo "dn: cn=$CN,ou=groups,$SUFFIX" >> $LDIF
    echo "objectClass: posixGroup" >> $LDIF
    echo "cn: $CN" >> $LDIF
    echo "gidNumber: $LGID" >> $LDIF
    echo "memberUid: `grep ":$LGID:" /etc/passwd | cut -d: -f1`" >> $LDIF

    users="`echo $line | cut -d: -f4`"
    if [ "$users" ]
    then
        for user in `echo "$users" | sed 's/,/ /g'`
        do
            [ ! "$CN" = "$user" ] && echo "memberUid: $user" >> $LDIF
        done
    fi
    echo >> $LDIF
done

root@dlp:~#

sh ldapuser.sh

root@dlp:~#

ldapadd -x -D cn=admin,dc=srv,dc=world -W -f ldapuser.ldif

Enter LDAP Password:

adding new entry "uid=jessie,ou=people,dc=srv,dc=world"
adding new entry "uid=ubuntu,ou=people,dc=srv,dc=world"
adding new entry "uid=debian,ou=people,dc=srv,dc=world"
adding new entry "uid=redhat,ou=people,dc=srv,dc=world"
adding new entry "cn=jessie,ou=groups,dc=srv,dc=world"
adding new entry "cn=ubuntu,ou=groups,dc=srv,dc=world"
adding new entry "cn=debian,ou=groups,dc=srv,dc=world"
adding new entry "cn=redhat,ou=groups,dc=srv,dc=world"

[3]	If you'd like to delete LDAP User or Group, Do as below.

root@dlp:~#

ldapdelete -x -W -D 'cn=admin,dc=srv,dc=world' "uid=ubuntu,ou=people,dc=srv,dc=world"

Enter LDAP Password:
root@dlp:~#

ldapdelete -x -W -D 'cn=admin,dc=srv,dc=world' "cn=ubuntu,ou=groups,dc=srv,dc=world"

Enter LDAP Password:

Matched Content