Add central logging for all actions done
log file "user_management.log" Each line is [YYYY-MM-DD HH:mm:ss] [script name] [TEST] ... [TEST] is only set if we are in a test run for create user, if info flag is set, we do not write a log
This commit is contained in:
Clemens Schwaighofer
@@ -176,6 +176,12 @@ if [ "$(whoami)" != "root" ]; then
|
||||
fi;
|
||||
fi;
|
||||
|
||||
# do not allow test and info at the same
|
||||
if [ ${TEST} -eq 1 ] && [ ${INFO} -eq 1 ]; then
|
||||
echo "Cannot have --test and --info option at the same time";
|
||||
error=1;
|
||||
fi;
|
||||
|
||||
# exit if not -g parameter set
|
||||
if [ $GO -eq 0 ]; then
|
||||
echo "Script has to be run with -g option for actual user creation.";
|
||||
@@ -187,20 +193,51 @@ if [ $error -eq 1 ]; then
|
||||
exit;
|
||||
fi;
|
||||
|
||||
LOG="${BASE_FOLDER}/../log/user_management.log";
|
||||
function write_log()
|
||||
{
|
||||
text="${1}";
|
||||
do_echo="${2}";
|
||||
log_prefix="";
|
||||
# log prefix for testing
|
||||
if [ ${TEST} -eq 1 ]; then
|
||||
log_prefix="[TEST] ";
|
||||
fi;
|
||||
# write log not in info run
|
||||
if [ ${INFO} -eq 0 ]; then
|
||||
echo "[$(date +"%F %T")] [$0] ${log_prefix}${text}" >> "${LOG}";
|
||||
fi;
|
||||
if [ "${do_echo}" = "1" ]; then
|
||||
echo "${text}";
|
||||
fi;
|
||||
}
|
||||
write_log "START SCRIPT RUN";
|
||||
|
||||
# used for test run only
|
||||
overall_run_error=0;
|
||||
|
||||
# MARK: LOOP START
|
||||
# create users
|
||||
while read -r i; do
|
||||
# run error for one row
|
||||
run_error=0;
|
||||
# skip rows start with # (comment)
|
||||
if [[ "${i}" =~ ^\# ]]; then
|
||||
continue;
|
||||
fi;
|
||||
|
||||
# log create inly on not info
|
||||
if [ ${INFO} -eq 0 ]; then
|
||||
write_log "[CREATE] ROW: $i";
|
||||
fi;
|
||||
|
||||
# MARK: VALUES CHECK
|
||||
# POS 2: make lower case, remove spaces
|
||||
username=$(echo "${i}" | cut -d ";" -f 2 | tr "[:upper:]" "[:lower:]" | tr -d ' ');
|
||||
# check username is alphanumeric with .
|
||||
if ! [[ "${username}" =~ ^[a-z0-9]+([.a-z0-9_-]+[a-z0-9])?$ ]]; then
|
||||
echo "User name can only be a-z 0-9 - _ . and cannot start or end with - . or _: ${username}";
|
||||
if [ ${TEST} -eq 0 ]; then
|
||||
break;
|
||||
fi;
|
||||
run_error=1;
|
||||
write_log "[ERROR] User name can only be a-z 0-9 - _ . and cannot start or end with - . or _: ${username}" "1";
|
||||
fi;
|
||||
# POS 3: groups
|
||||
_group=$(echo "${i}" | cut -d ";" -f 3 | tr "[:upper:]" "[:lower:]" | tr -d ' ');
|
||||
@@ -223,14 +260,12 @@ while read -r i; do
|
||||
ssh_access_type=$(echo "${i}" | cut -d ";" -f 4 | cut -d "|" -f 1 | tr "[:upper:]" "[:lower:]" | tr -d ' ');
|
||||
# if not allow or forward, set to access
|
||||
if [ "${ssh_access_type}" != "allow" ] && [ "${ssh_access_type}" != "forward" ]; then
|
||||
echo "[!!] Not valid ssh access type ${ssh_access_type}, set to allow";
|
||||
ssh_access_type="allow";
|
||||
run_error=1;
|
||||
write_log "[ERROR] Not valid ssh access type ${ssh_access_type}" "1";
|
||||
fi;
|
||||
if [ $ssh_forward_ok -eq 0 ] && [ "${ssh_access_type}" = "forward" ]; then
|
||||
echo "[!!!] sshforward group does not exsts, cannot set user ${username}";
|
||||
if [ ${TEST} -eq 0 ]; then
|
||||
break;
|
||||
fi;
|
||||
write_log "[ERROR] sshforward group does not exsts, cannot set user ${username}" "1";
|
||||
run_error=1;
|
||||
fi;
|
||||
ssh_group="ssh${ssh_access_type}";
|
||||
# sshallow group is always added
|
||||
@@ -259,24 +294,35 @@ while read -r i; do
|
||||
fi;
|
||||
# user & group not set
|
||||
if [ -z "${username}" ] || [ -z "${_group}" ]; then
|
||||
echo "[!!!!!] Missing user or group entry for ${username}/${_group}";
|
||||
echo "[*** ABORT RUN ***]"
|
||||
if [ ${TEST} -eq 0 ]; then
|
||||
break;
|
||||
fi;
|
||||
run_error=1;
|
||||
write_log "[ERROR] Missing user or group entry for ${username}/${_group}" "1";
|
||||
else
|
||||
group_error=0;
|
||||
# check group names valid
|
||||
for create_group in ${_group//,/ }; do
|
||||
if ! [[ "${create_group}" =~ ^[a-z0-9]+([a-z0-9_-]+[a-z0-9])?$ ]]; then
|
||||
echo "Group name can only be a-z 0-9 - _ and cannot start or end with - or _: ${create_group}";
|
||||
write_log "[ERROR] Group name can only be a-z 0-9 - _ and cannot start or end with - or _: ${create_group}" "1";
|
||||
group_error=1;
|
||||
fi;
|
||||
done;
|
||||
if [ $group_error -eq 1 ] && [ ${TEST} -eq 0 ]; then
|
||||
break;
|
||||
if [ $group_error -eq 1 ]; then
|
||||
run_error=1;
|
||||
fi;
|
||||
fi;
|
||||
|
||||
# error & test -> break
|
||||
if [ ${run_error} -eq 1 ]; then
|
||||
overall_run_error=1;
|
||||
write_log "[*** ABORT RUN ***]" "1";
|
||||
# end if not test and not info
|
||||
if [ ${TEST} -eq 0 ] && [ ${INFO} -eq 0 ]; then
|
||||
break;
|
||||
else
|
||||
continue;
|
||||
fi;
|
||||
fi;
|
||||
|
||||
# MARK: SSH NAMES SET
|
||||
# SSH file name part without folder
|
||||
ssh_keygen_id="${hostname}${separator}${group}${separator}${username}${separator}${ssh_keytype}.pem";
|
||||
# the full file including folder name
|
||||
@@ -286,20 +332,21 @@ while read -r i; do
|
||||
# check existing pub file
|
||||
ssh_keyfile_check_pub="${ROOT_FOLDER}${SSH_KEYGEN_FOLDER_CREATED_PUB}${ssh_keygen_id}.pub";
|
||||
|
||||
# MARK: INFO
|
||||
if [ ${INFO} -eq 1 ]; then
|
||||
info_string="User: '${username}:${group}(${sub_group});${ssh_group}', SSH: ${ssh_keygen_id}";
|
||||
# test if pub file exists or not, test if user exists
|
||||
echo -n "User: '${username}:${group}(${sub_group});${ssh_group}', SSH: ${ssh_keygen_id}";
|
||||
if getent passwd "${username}" > /dev/null 2>&1; then
|
||||
echo -n ", User exists";
|
||||
info_string="${info_string}, User exists";
|
||||
fi;
|
||||
if [ -f "${ssh_keyfile_check_pub}" ]; then
|
||||
echo -n ", SSH Pub key OK";
|
||||
info_string="${info_string}, SSH Pub key OK";
|
||||
fi;
|
||||
# line break
|
||||
echo "";
|
||||
echo "${info_string}";
|
||||
continue;
|
||||
fi;
|
||||
|
||||
# MARK: CREATE
|
||||
# add group for each entry in _group
|
||||
for create_group in ${_group//,/ }; do
|
||||
if [ ${TEST} -eq 0 ]; then
|
||||
@@ -311,9 +358,9 @@ while read -r i; do
|
||||
# check if user is not already created
|
||||
# if getent passwd ${username} > /dev/null 2>&1; then
|
||||
if id "${username}" &>/dev/null; then
|
||||
echo "-- Skip '${username}:${group}(${sub_group})'";
|
||||
write_log "-- Skip '${username}:${group}(${sub_group})'" "1";
|
||||
else
|
||||
echo "++ Create '${username}:${group}(${sub_group})'";
|
||||
write_log "++ Create '${username}:${group}(${sub_group})'" "1";
|
||||
params=(
|
||||
"-c" "$(date +"%F")" "-s" "${user_login_shell}"
|
||||
"-g" "${group}" "-G" "$(IFS=, ; echo "${sub_group_opt[*]}")"
|
||||
@@ -349,7 +396,7 @@ while read -r i; do
|
||||
password=${_password};
|
||||
fi;
|
||||
# create SSH key
|
||||
echo " > Create ssh key-pair '${ssh_keyfile}'";
|
||||
write_log " > Create ssh key-pair: ${ssh_keyfile}" "1";
|
||||
if [ ${TEST} -eq 0 ]; then
|
||||
ssh-keygen \
|
||||
-t "${ssh_keytype}" \
|
||||
@@ -366,16 +413,17 @@ while read -r i; do
|
||||
fi;
|
||||
if [ -n "${found}" ]; then
|
||||
skip_ssh=1;
|
||||
echo "-- Skip SSH Key creation: ${ssh_keygen_id}.pub";
|
||||
write_log "-- Skip SSH Key creation: ${ssh_keygen_id}.pub" "1";
|
||||
else
|
||||
# override previously set with stored one
|
||||
ssh_keyfile_pub=${ssh_keyfile_check_pub};
|
||||
echo " < Use existing public ssh key '${ssh_keygen_id}.pub'";
|
||||
write_log " < Use existing public ssh key: ${ssh_keygen_id}.pub" "1";
|
||||
# Password already set notification
|
||||
fi;
|
||||
password="[ALREADY SET]";
|
||||
fi;
|
||||
if [ ${skip_ssh} -eq 0 ]; then
|
||||
# MARK: SSH CREATE
|
||||
# write login info to output file
|
||||
if [ ${TEST} -eq 0 ]; then
|
||||
create_output_file="${ROOT_FOLDER}${output_file}";
|
||||
@@ -444,6 +492,8 @@ done <<< "$(cat "${ROOT_FOLDER}${input_file}")";
|
||||
if [ ${INFO} -eq 1 ]; then
|
||||
exit;
|
||||
fi;
|
||||
|
||||
# MARK: ZIP FILE CREATE
|
||||
# check if there are any files in the SSH_KEYGEN_FOLDER, else skip zip file creation and file move
|
||||
has_pem_files=0;
|
||||
if (shopt -s nullglob dotglob; f=("${SSH_KEYGEN_FOLDER}"*".pem"*); ((${#f[@]}))); then
|
||||
@@ -488,4 +538,9 @@ else
|
||||
echo "$> rm ${ROOT_FOLDER}${SSH_KEYGEN_FOLDER}*";
|
||||
fi;
|
||||
|
||||
# MARK: TEST ERROR INFO
|
||||
if [ ${TEST} -eq 1 ] && [ ${overall_run_error} -eq 1 ]; then
|
||||
echo "[ERROR] Some errors occoured during the run, they will prohibit the live run of this script";
|
||||
fi;
|
||||
|
||||
# __END__
|
||||
|
||||
Reference in New Issue
Block a user