| 1 | #!/usr/bin/perl -w
|
|---|
| 2 |
|
|---|
| 3 | # $Id: smbldap-groupmod,v 1.12 2006/01/02 17:01:19 jtournier Exp $
|
|---|
| 4 | #
|
|---|
| 5 | # This code was developped by IDEALX (http://IDEALX.org/) and
|
|---|
| 6 | # contributors (their names can be found in the CONTRIBUTORS file).
|
|---|
| 7 | #
|
|---|
| 8 | # Copyright (C) 2001-2002 IDEALX
|
|---|
| 9 | #
|
|---|
| 10 | # This program is free software; you can redistribute it and/or
|
|---|
| 11 | # modify it under the terms of the GNU General Public License
|
|---|
| 12 | # as published by the Free Software Foundation; either version 2
|
|---|
| 13 | # of the License, or (at your option) any later version.
|
|---|
| 14 | #
|
|---|
| 15 | # This program is distributed in the hope that it will be useful,
|
|---|
| 16 | # but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|---|
| 17 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|---|
| 18 | # GNU General Public License for more details.
|
|---|
| 19 | #
|
|---|
| 20 | # You should have received a copy of the GNU General Public License
|
|---|
| 21 | # along with this program; if not, write to the Free Software
|
|---|
| 22 | # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
|
|---|
| 23 | # USA.
|
|---|
| 24 |
|
|---|
| 25 | # Purpose of smbldap-groupmod : group (posix) modification
|
|---|
| 26 |
|
|---|
| 27 |
|
|---|
| 28 | use strict;
|
|---|
| 29 | use FindBin;
|
|---|
| 30 | use FindBin qw($RealBin);
|
|---|
| 31 | use lib "$RealBin/";
|
|---|
| 32 | use smbldap_tools;
|
|---|
| 33 |
|
|---|
| 34 | #####################
|
|---|
| 35 |
|
|---|
| 36 | use Getopt::Std;
|
|---|
| 37 | my %Options;
|
|---|
| 38 |
|
|---|
| 39 | my $ok = getopts('ag:n:m:or:s:t:x:?', \%Options);
|
|---|
| 40 | if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) ) {
|
|---|
| 41 | print_banner;
|
|---|
| 42 | print "Usage: $0 [-a] [-g gid [-o]] [-n name] [-m members(,)] [-x members (,)] [-r rid] [-s sid] [-t type] groupname\n";
|
|---|
| 43 | print " -a add automatic group mapping entry\n";
|
|---|
| 44 | print " -g new gid\n";
|
|---|
| 45 | print " -o gid is not unique\n";
|
|---|
| 46 | print " -n new group name\n";
|
|---|
| 47 | print " -m add members (comma delimited)\n";
|
|---|
| 48 | print " -r group-rid\n";
|
|---|
| 49 | print " -s group-sid\n";
|
|---|
| 50 | print " -t group-type\n";
|
|---|
| 51 | print " -x delete members (comma delimted)\n";
|
|---|
| 52 | print " -? show this help message\n";
|
|---|
| 53 | exit (1);
|
|---|
| 54 | }
|
|---|
| 55 |
|
|---|
| 56 | my $groupName = $ARGV[0];
|
|---|
| 57 | my $group_entry;
|
|---|
| 58 |
|
|---|
| 59 | my $ldap_master=connect_ldap_master();
|
|---|
| 60 |
|
|---|
| 61 | if (! ($group_entry = read_group_entry($groupName))) {
|
|---|
| 62 | print "$0: group $groupName doesn't exist\n";
|
|---|
| 63 | exit (6);
|
|---|
| 64 | }
|
|---|
| 65 |
|
|---|
| 66 | my $newname = $Options{'n'};
|
|---|
| 67 |
|
|---|
| 68 | my $nscd_status = system "/etc/init.d/nscd status >/dev/null 2>&1";
|
|---|
| 69 |
|
|---|
| 70 | if ($nscd_status == 0) {
|
|---|
| 71 | system "/etc/init.d/nscd restart > /dev/null 2>&1";
|
|---|
| 72 | }
|
|---|
| 73 |
|
|---|
| 74 | my $gid = getgrnam($groupName);
|
|---|
| 75 | unless (defined ($gid)) {
|
|---|
| 76 | print "$0: group $groupName not found!\n";
|
|---|
| 77 | exit(6);
|
|---|
| 78 | }
|
|---|
| 79 |
|
|---|
| 80 | my $tmp;
|
|---|
| 81 | if (defined($tmp = $Options{'g'}) and $tmp =~ /\d+/) {
|
|---|
| 82 | if (!defined($Options{'o'})) {
|
|---|
| 83 | if (defined(getgrgid($tmp))) {
|
|---|
| 84 | print "$0: gid $tmp exists\n";
|
|---|
| 85 | exit (6);
|
|---|
| 86 | }
|
|---|
| 87 | }
|
|---|
| 88 | if (!($gid == $tmp)) {
|
|---|
| 89 | my $modify = $ldap_master->modify ( "cn=$groupName,$config{groupsdn}",
|
|---|
| 90 | changes => [
|
|---|
| 91 | replace => [gidNumber => $tmp]
|
|---|
| 92 | ]
|
|---|
| 93 | );
|
|---|
| 94 | $modify->code && die "failed to modify entry: ", $modify->error ;
|
|---|
| 95 | }
|
|---|
| 96 | }
|
|---|
| 97 |
|
|---|
| 98 |
|
|---|
| 99 | if (defined($newname)) {
|
|---|
| 100 | my $modify = $ldap_master->moddn (
|
|---|
| 101 | "cn=$groupName,$config{groupsdn}",
|
|---|
| 102 | newrdn => "cn=$newname",
|
|---|
| 103 | deleteoldrdn => "1",
|
|---|
| 104 | newsuperior => "$config{groupsdn}"
|
|---|
| 105 | );
|
|---|
| 106 | $modify->code && die "failed to modify entry: ", $modify->error ;
|
|---|
| 107 | # take down session
|
|---|
| 108 | }
|
|---|
| 109 |
|
|---|
| 110 | # Add members
|
|---|
| 111 | if (defined($Options{'m'})) {
|
|---|
| 112 | my $members = $Options{'m'};
|
|---|
| 113 | my @members = split( /,/, $members );
|
|---|
| 114 | my $member;
|
|---|
| 115 | foreach $member ( @members ) {
|
|---|
| 116 | my $group_entry=read_group_entry($groupName);
|
|---|
| 117 | $config{groupsdn}=$group_entry->dn;
|
|---|
| 118 | if (is_unix_user($member) || is_nonldap_unix_user($member)) {
|
|---|
| 119 | if (is_group_member($config{groupsdn},$member)) {
|
|---|
| 120 | print "User $member already in the group\n";
|
|---|
| 121 | } else {
|
|---|
| 122 | print "adding user $member to group $groupName\n";
|
|---|
| 123 | my $modify = $ldap_master->modify ($config{groupsdn},
|
|---|
| 124 | changes => [
|
|---|
| 125 | add => [memberUid => $member]
|
|---|
| 126 | ]
|
|---|
| 127 | );
|
|---|
| 128 | $modify->code && warn "failed to add entry: ", $modify->error ;
|
|---|
| 129 | }
|
|---|
| 130 | } else {
|
|---|
| 131 | print "User $member does not exist: create it first !\n";
|
|---|
| 132 | }
|
|---|
| 133 | }
|
|---|
| 134 | }
|
|---|
| 135 |
|
|---|
| 136 | # Delete members
|
|---|
| 137 | if (defined($Options{'x'})) {
|
|---|
| 138 | my $members = $Options{'x'};
|
|---|
| 139 | my @members = split( /,/, $members );
|
|---|
| 140 | my $member;
|
|---|
| 141 | foreach $member ( @members ) {
|
|---|
| 142 | my $user_entry=read_user_entry($member);
|
|---|
| 143 | my $group_entry=read_group_entry($groupName);
|
|---|
| 144 | $config{groupsdn}=$group_entry->dn;
|
|---|
| 145 | if (is_group_member("$config{groupsdn}",$member)) {
|
|---|
| 146 | my $delete=1;
|
|---|
| 147 | if (defined $group_entry->get_value('sambaSID')) {
|
|---|
| 148 | if ($group_entry->get_value('sambaSID') eq $user_entry->get_value('sambaPrimaryGroupSID')) {
|
|---|
| 149 | $delete=0;
|
|---|
| 150 | print "Cannot delete user ($member) from his primary group ($groupName)\n";
|
|---|
| 151 | }
|
|---|
| 152 | }
|
|---|
| 153 | if ($delete eq 1) {
|
|---|
| 154 | print "deleting user $member from group $groupName\n";
|
|---|
| 155 | my $modify = $ldap_master->modify ($config{groupsdn},
|
|---|
| 156 | changes => [
|
|---|
| 157 | delete => [memberUid => $member]
|
|---|
| 158 | ]
|
|---|
| 159 | );
|
|---|
| 160 | $modify->code && warn "failed to delete entry: ", $modify->error ;
|
|---|
| 161 | }
|
|---|
| 162 | } else {
|
|---|
| 163 | print "User $member is not in the group $groupName!\n";
|
|---|
| 164 | }
|
|---|
| 165 | }
|
|---|
| 166 | }
|
|---|
| 167 |
|
|---|
| 168 | my $group_sid;
|
|---|
| 169 | if ($tmp= $Options{'s'}) {
|
|---|
| 170 | if ($tmp =~ /^S-(?:\d+-)+\d+$/) {
|
|---|
| 171 | $group_sid = $tmp;
|
|---|
| 172 | } else {
|
|---|
| 173 | print "$0: illegal group-rid $tmp\n";
|
|---|
| 174 | exit(7);
|
|---|
| 175 | }
|
|---|
| 176 | } elsif ($Options{'r'} || $Options{'a'}) {
|
|---|
| 177 | my $group_rid;
|
|---|
| 178 | if ($tmp= $Options{'r'}) {
|
|---|
| 179 | if ($tmp =~ /^\d+$/) {
|
|---|
| 180 | $group_rid = $tmp;
|
|---|
| 181 | } else {
|
|---|
| 182 | print "$0: illegal group-rid $tmp\n";
|
|---|
| 183 | exit(7);
|
|---|
| 184 | }
|
|---|
| 185 | } else {
|
|---|
| 186 | # algorithmic mapping
|
|---|
| 187 | $group_rid = 2*$gid+1001;
|
|---|
| 188 | }
|
|---|
| 189 | $group_sid = $config{SID}.'-'.$group_rid;
|
|---|
| 190 | }
|
|---|
| 191 |
|
|---|
| 192 | if ($group_sid) {
|
|---|
| 193 | my @adds;
|
|---|
| 194 | my @mods;
|
|---|
| 195 | push(@mods, 'sambaSID' => $group_sid);
|
|---|
| 196 |
|
|---|
| 197 | if ($tmp= $Options{'t'}) {
|
|---|
| 198 | my $group_type;
|
|---|
| 199 | if (defined($group_type = &group_type_by_name($tmp))) {
|
|---|
| 200 | push(@mods, 'sambaGroupType' => $group_type);
|
|---|
| 201 | } else {
|
|---|
| 202 | print "$0: unknown group type $tmp\n";
|
|---|
| 203 | exit(8);
|
|---|
| 204 | }
|
|---|
| 205 | } else {
|
|---|
| 206 | if (! defined($group_entry->get_value('sambaGroupType'))) {
|
|---|
| 207 | push(@mods, 'sambaGroupType' => group_type_by_name('domain'));
|
|---|
| 208 | }
|
|---|
| 209 | }
|
|---|
| 210 |
|
|---|
| 211 | my @oc = $group_entry->get_value('objectClass');
|
|---|
| 212 | unless (grep($_ =~ /^sambaGroupMapping$/i, @oc)) {
|
|---|
| 213 | push (@adds, 'objectClass' => 'sambaGroupMapping');
|
|---|
| 214 | }
|
|---|
| 215 |
|
|---|
| 216 | my $modify = $ldap_master->modify ( "cn=$groupName,$config{groupsdn}",
|
|---|
| 217 | changes => [
|
|---|
| 218 | 'add' => [ @adds ],
|
|---|
| 219 | 'replace' => [ @mods ]
|
|---|
| 220 | ]
|
|---|
| 221 | );
|
|---|
| 222 | $modify->code && warn "failed to delete entry: ", $modify->error ;
|
|---|
| 223 | }
|
|---|
| 224 |
|
|---|
| 225 | $nscd_status = system "/etc/init.d/nscd status >/dev/null 2>&1";
|
|---|
| 226 |
|
|---|
| 227 | if ($nscd_status == 0) {
|
|---|
| 228 | system "/etc/init.d/nscd restart > /dev/null 2>&1";
|
|---|
| 229 | }
|
|---|
| 230 |
|
|---|
| 231 | # take down session
|
|---|
| 232 | $ldap_master->unbind;
|
|---|
| 233 |
|
|---|
| 234 | exit (0);
|
|---|
| 235 |
|
|---|
| 236 | ############################################################
|
|---|
| 237 |
|
|---|
| 238 | =head1 NAME
|
|---|
| 239 |
|
|---|
| 240 | smbldap-groupmod - Modify a group
|
|---|
| 241 |
|
|---|
| 242 | =head1 SYNOPSIS
|
|---|
| 243 |
|
|---|
| 244 | smbldap-groupmod [-g gid [-o]] [-a] [-r rid] [-s sid] [-t group type]
|
|---|
| 245 | [-n group_name ] [-m members(,)] [-x members (,)] group
|
|---|
| 246 |
|
|---|
| 247 | =head1 DESCRIPTION
|
|---|
| 248 |
|
|---|
| 249 | The smbldap-groupmod command modifies the system account files to
|
|---|
| 250 | reflect the changes that are specified on the command line.
|
|---|
| 251 | The options which apply to the smbldap-groupmod command are
|
|---|
| 252 |
|
|---|
| 253 | -g gid The numerical value of the group's ID. This value must be
|
|---|
| 254 | unique, unless the -o option is used. The value must be non-
|
|---|
| 255 | negative. Any files which the old group ID is the file
|
|---|
| 256 | group ID must have the file group ID changed manually.
|
|---|
| 257 |
|
|---|
| 258 | -n group_name
|
|---|
| 259 | The name of the group will be changed from group to group_name.
|
|---|
| 260 |
|
|---|
| 261 | -m members
|
|---|
| 262 | The members to be added to the group in comma-delimeted form.
|
|---|
| 263 |
|
|---|
| 264 | -x members
|
|---|
| 265 | The members to be removed from the group in comma-delimted form.
|
|---|
| 266 |
|
|---|
| 267 | -a
|
|---|
| 268 | add an automatic Security ID for the group (SID).
|
|---|
| 269 | The rid of the group is calculated from the gidNumber of the
|
|---|
| 270 | group as rid=2*gidNumber+1001. Thus the resulted SID of the
|
|---|
| 271 | group is $SID-$rid where $SID and $rid are the domain SID and
|
|---|
| 272 | the group rid
|
|---|
| 273 |
|
|---|
| 274 | -s sid
|
|---|
| 275 | set the group SID.
|
|---|
| 276 | The SID must be unique and defined with the domain Security ID
|
|---|
| 277 | ($SID) like sid=$SID-rid where rid is the group rid.
|
|---|
| 278 |
|
|---|
| 279 | -r rid
|
|---|
| 280 | set the group rid.
|
|---|
| 281 | The SID is then calculated as sid=$SID-rid where $SID is the
|
|---|
| 282 | domain Security ID.
|
|---|
| 283 |
|
|---|
| 284 | -t group type
|
|---|
| 285 | set the NT Group type for the new group. Available values are
|
|---|
| 286 | 2 (domain group), 4 (local group) and 5 (builtin group).
|
|---|
| 287 | The default group type is 2.
|
|---|
| 288 |
|
|---|
| 289 | =head1 EXAMPLES
|
|---|
| 290 |
|
|---|
| 291 | smbldap-groupmod -g 253 development
|
|---|
| 292 | This will change the GID of the 'development' group to '253'.
|
|---|
| 293 |
|
|---|
| 294 | smbldap-groupmod -n Idiots Managers
|
|---|
| 295 | This will change the name of the 'Managers' group to 'Idiots'.
|
|---|
| 296 |
|
|---|
| 297 | smbldap-groupmod -m "jdoe,jsmith" "Domain Admins"
|
|---|
| 298 | This will add 'jdoe' and 'jsmith' to the 'Domain Admins' group.
|
|---|
| 299 |
|
|---|
| 300 | smbldap-groupmod -x "jdoe,jsmith" "Domain Admins"
|
|---|
| 301 | This will remove 'jdoe' and 'jsmith' from the 'Domain Admins' group.
|
|---|
| 302 |
|
|---|
| 303 | =head1 SEE ALSO
|
|---|
| 304 |
|
|---|
| 305 | groupmod(1)
|
|---|
| 306 |
|
|---|
| 307 | =cut
|
|---|
| 308 |
|
|---|
| 309 | #'
|
|---|
