ScriptsCollections/ServerUserCreate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update AWS user create

Browse Source 
Has now -t option to turn test on off via command line.
If test is on no user or groups are created, only SSH keys and the zip
file.

Standard ssh key type is now ed25519 and the password gets set with -a
100 flag.

After creation all data is ziped into the zip/ folder for download and
all PEM/PUB/password files are deleted from the folder.

The old user_zip.sh file has been removed because of this.

The script now checks for zip program and zip/ folder existing.
Also base folder must be 600 and root set

The user list file has an update for host name override after the
password file.
If this is set then the server hostname will not be used for file names.
The file name is also back to include the host name but the type changed
to have "#" as separator (can be changed in file) and also ads the ssh
key type to the file
This commit is contained in:
Clemens Schwaighofer
2022-03-09 14:44:49 +09:00
parent 1475bd0438
commit 6ce9b40565
8 changed files with 253 additions and 201 deletions
Download Patch File Download Diff File Expand all files Collapse all files

87
Readme.md
View File

@@ -6,29 +6,35 @@ Two files to create new user entries with an SSH key and zip all the data for do
The application **pwgen** and **zip** must be installed.
Copy the two files '*user_create.sh*', '*user_zip.sh*' to any target folder on the target aws server.
For exmaple `/root/bin`
Checkout the scripts from git into the `/root/` folder or any other folder.
The folder holding the script must be owned by *root* and have *600* permissions
`$> mkdir /root/bin`
```sh
cd /root/
git clone http://git.tequila.jp/ScriptsCollections/AwsUserCreate.git users
chown root. users
chgrp 600 users
```
Create a base folder where all the user lists and keys are stored.
For example `/root/users`
## Folders
`$> mkdir /root/users`
The script will automatically create `/ssh-keygen` as as sub folder to above set `/root/users`
Inside the base folder there are
* ssh-keygen for temporary holding the PEM/PUB files
* zip file which holds the created user list, password and PEM/PUB files
## User list creation
In the `/root/users` folder there needs to be a file called '*user_list.txt*'
In the `/root/users/` folder there needs to be a file called '*user_list.txt*'
This is a CSV type file with the following layout
ID | Username | Group | Optional Password
-|-|-|-
ID | Username | Group | Optional Password | Override host name
-|-|-|-|-
The ID, Username and Group column must be filled.
For sub groups add them with a *,* The first group is the master group
If the password column is filled, the string from here will be used as the PEM Key password.
If a override hostname is set it will be used instead of `hostname`
The ID can be any string in any form.
It can also be left empty. It is not used at the moment
@@ -37,10 +43,10 @@ The file can hold comments. The first character in the line must be a *#*
Example file
```
user1;some.name;group-a
user2;othername;group-a
user1;some.name;group-a;;hostname
user2;othername;group-a;;
# I am a comment
;username;groupC;setpassword
;username;groupC;setpassword;
...
```
@@ -48,29 +54,25 @@ user2;othername;group-a
If we want to create a user that already has a PEM key or we want to have the user use the same PEM key for login we can copy the existing pub key into the ssh key folder
If the folder `ssh-keygen` does not exist, create it as as sub folder to the folder where the '*user_list.txt*' is located
In our example
`$> mkdir /root/users/ssh-keygen`
If the folder `ssh-keygen` does not exist, the folder is automatically created as a sub folder to the folder where the '*user_list.txt*' is located. An additional `zip` folder is created that will hold the current run created user data.
The public PEM key file format is as followed
**group name**-**user name**.pem.pub
**hostname**#**main group name**#**user name**#**ssh key type**.pem.pub
In the example above for *user1* the file name would be for **some.name** and **group-a**
`group-a-some.name.pem.pub`
`hostname#group-a#some.name#ssh-keytype.pem.pub`
Copy this file into the ssh-keygen folder and add the user to the '*user_list.txt*' file.
This must be with the same name and group as set in the PEM public key.
Example:
PEM public key file is `Bgroup-foobar.pem.pub`
PEM public key file is `hostname#Bgroup#foobar#ed25519.pem.pub`
Then the line for the '*user_list.txt*' must be
`[some user id];foobar;Bgroup`
`[some user id];foobar;Bgroup;;`
Note that *[some user id]* can be any string or left empty
@@ -87,10 +89,10 @@ Then run the script without any options
Sample output for above example file
```
++ Create 'some.name:group-a'
> Create ssh key-pair '/root/users/ssh-keygen/group-a-some.name.pem'
> Create ssh key-pair '/root/users/ssh-keygen/hostname#group-a#some.name#ed25519.pem'
Generating public/private rsa key pair.
Your identification has been saved in /root/users/ssh-keygen/group-a-some.name.pem.
Your public key has been saved in /root/users/ssh-keygen/group-a-some.name.pem.pub.
Your identification has been saved in /root/users/ssh-keygen/hostname#group-a#some.name#ed25519.pem.
Your public key has been saved in /root/users/ssh-keygen/hostname#group-a#some.name#ed25519.pem.pub.
The key fingerprint is:
SHA256:Ufalh41IRLJTHZlsaEJVK5N7cOYhxRdqf3fCDxhHdCA egrp10070.globalad.org: some.name@group-a
The key's randomart image is:
@@ -113,7 +115,7 @@ The key's randomart image is:
If the public pem file is already provided the output will be a bit different
```
++ Create 'some.name:group-a'
< Use existing public ssh key '/root/users/ssh-keygen/group-a-some.name.pem.pub'
< Use existing public ssh key '/root/users/ssh-keygen/hostname#group-a#some.name#ed25519.pem.pub'
> Create .ssh folder
> Add public into authorized_keys
> Secure folder .ssh and authorized_keys file
@@ -132,16 +134,17 @@ The generated users and the passwords are stored in the '*user_password.txt*' fi
For above the output will be
```
2020-11-27 13:51:01;sever.hostname.org;some.name;Aeh9uph8Oo
2020-11-27 13:51:02;sever.hostname.org;othername;AePejoo9ch
2020-11-27 13:51:02;sever.hostname.org;username;setpassword
2020-11-27 13:51:01;sever.hostname.org;hostname;some.name;Aeh9uph8Oo
2020-11-27 13:51:02;sever.hostname.org;;othername;AePejoo9ch
2020-11-27 13:51:02;sever.hostname.org;;username;setpassword
```
Note that the *sever.hostname.org* is set from the hostname of the server where the script is unr
Note that the *sever.hostname.org* is set from the hostname of the server where the script is run
The name *hostname* is set if the hostname field in hser `user_list.txt` file is set
If a existing pem public key is used, the entry for a new user will be
```
2020-11-27 13:53:18;sever.hostname.org;some.name;[ALREADY SET]
2020-11-27 13:53:18;sever.hostname.org;;some.name;[ALREADY SET]
```
Not that the password field has now *[ALREADY SET]*
@@ -169,21 +172,5 @@ The public key part can be extracted from the SSH PEM key with
## Get the user data
To copy the user data with the SSH PEM file and password list the following command can be used.
Like the create user command it **MUST** be run in the folder where the '*user_list.txt*'
`$> cd /root/users`
The script needs to be run with one parameter that is the folder where the output file '*users.zip*' is stored.
`$> /root/bin/user_zip.sh [target folder]`
In the *[target folder]* a file name '*users.zip*' will be created.
This file has the following data data inside
- user_list.txt
- user_password.txt
- ssh-keygen/*.pem
- ssh-keygen/*.pem.pub
When extracted this will **NOT** create a sub folder.
Create a folder where to store this data on the local side is highly recommended
In the `zip/` folder there is a file named `users.YYYYMMDD-hhmmss.zip`;
This file should be copied localy and then removed from the server