ScriptsCollections/ServerUserCreate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
107 Commits 2 Branches 51 Tags
master
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Clemens Schwaighofer c801ef40b4 Switch from lastlogin to lsogins 
Debian 13 dropped lastlogin, replaced with lastlogin2 which is an extra install.
Switch to lslogins, which also makes parsing much easier
 2025-09-12 10:16:05 +09:00
Clemens Schwaighofer 125cb27de8 Remove URLs from ReadMe 2025-03-14 22:28:19 +09:00
Clemens Schwaighofer e45b89c582 AWS Delete user, remove all secondary groups first. 
To make sure tha on delete the user is removed from all secondary groups
unset them first before running the userdel command.

-r might not be enought to do that in some situations
 2025-01-06 13:45:51 +09:00
Clemens Schwaighofer 4a8dab7b01 Add base folder for lock user aws script 2024-12-16 15:44:09 +09:00
Clemens Schwaighofer fa47178ed1 Add central logging for all actions done 
log file "user_management.log"

Each line is
[YYYY-MM-DD HH:mm:ss] [script name] [TEST] ...

[TEST] is only set if we are in a test run

for create user, if info flag is set, we do not write a log
 2024-12-09 11:37:37 +09:00
Clemens Schwaighofer 4629b58a7e Skip empty group on login check 2024-11-11 17:06:24 +09:00
Clemens Schwaighofer d8cd628ddd Fix for check last login script 
the data reading was split with " " (space) which in the while read kept
it as one row, changed the split character to "\n"
 2024-10-24 13:57:04 +09:00
Clemens Schwaighofer 76f9056069 Fix user create with groups 
Move the params into array that we add as dynamic parameters to call
 2024-10-11 14:39:56 +09:00
Clemens Schwaighofer 74e7e9823f Bug fix for user create group part 2024-10-11 09:25:41 +09:00
Clemens Schwaighofer 7ce8330aa6 shellcheck fixup 2024-09-27 18:49:36 +09:00
Clemens Schwaighofer d8f9710593 Merge branch 'development' into shellecheck-cleanup 2024-09-24 11:40:13 +09:00
Clemens Schwaighofer c37d17fe9f ReadMe file update 2024-09-24 11:38:45 +09:00
Clemens Schwaighofer 307433e0a7 Merge branch 'development' into shellecheck-cleanup 2024-09-20 09:22:20 +09:00
Clemens Schwaighofer f9cd0806f1 Fix in Readme file for exmaple user_list.txt 2024-09-20 09:22:02 +09:00
Clemens Schwaighofer d9b3fd97fb Merge branch 'development' into shellecheck-cleanup 2024-09-20 09:20:36 +09:00
Clemens Schwaighofer 21177e1762 Updates for ReadMe file for no login shell settings 2024-09-20 09:20:01 +09:00
Clemens Schwaighofer 3aa6de7e23 check last login shellcheck fixes 2024-09-06 14:44:34 +09:00
Clemens Schwaighofer 3c160a62e7 Merge branch 'development' into shellecheck-cleanup 2024-09-06 14:37:37 +09:00
Clemens Schwaighofer ca4616c5ee Text fix for error strings in last login check 2024-09-06 14:36:09 +09:00
Clemens Schwaighofer 251b0bf981 SSH login last date check was wrong 2024-09-06 14:34:38 +09:00
Clemens Schwaighofer 6daccfe57c Check last login update with more days info 
if WARN then write WARN instead of OK.
Add day numbers if OK

Some minor shellscript updates
 2024-09-06 14:25:28 +09:00
Clemens Schwaighofer 91f096ab0c Merge branch 'master' into shellecheck-cleanup 2024-09-06 10:58:13 +09:00
Clemens Schwaighofer 935d6a84c9 Add login shell type select (bash login or no login), fix ssh base groups 
no ssh allow/forward/reject base group was set if an optional sub group was set

Add possibility to chose no login when setting the ssh access type to "...|no_login"
 2024-09-06 10:44:31 +09:00
Clemens Schwaighofer ee7cc8555e Merge branch 'development' into shellecheck-cleanup 2024-09-04 14:05:51 +09:00
Clemens Schwaighofer 83f84abd46 Fix skip naming for zip/move creation 2024-09-04 14:04:25 +09:00
Clemens Schwaighofer 090d6f9cec Download zip file message only if there is a file to download 2024-09-04 13:44:47 +09:00
Clemens Schwaighofer 5659cc010f Update zip file/clean up skip with skip information 2024-09-04 13:43:24 +09:00
Clemens Schwaighofer 0bd40cdd73 Create user: skip zip creation run if there are no PEM files 
Avoid "file not found" zip file creation and remove if there are no
PEM files created, eg if we have a pre defined pub file
 2024-09-04 13:21:36 +09:00
Clemens Schwaighofer e4ed6fed8d shellcheck based code cleanup 2024-09-04 11:16:05 +09:00
Clemens Schwaighofer 5bf30a8b2f Add shellcheckrc 2024-09-03 12:47:52 +09:00
Clemens Schwaighofer 26c007dba6 Remove error=1 debug set 2024-02-15 18:10:53 +09:00
Clemens Schwaighofer 785e3c116d Fix password set length check 2024-02-15 18:07:53 +09:00
Clemens Schwaighofer adbfeb0074 Password length set, auto set if not set, and set for pwgen actually 2024-02-15 18:05:03 +09:00
Clemens Schwaighofer 8c7ef32894 Create user script update: allow no password, allow different password length 2024-02-15 18:03:16 +09:00
Clemens Schwaighofer 70ef7a3fc5 Check last login mandatory settings now has combined abort 
set an error flag and check all settings before exit program
 2024-02-14 14:46:17 +09:00
Clemens Schwaighofer 89252af50b Bug fix for json export with double quotes 2023-12-22 13:39:18 +09:00
Clemens Schwaighofer 8fb833d3c4 Fix the call for getting instance data 
Do not use name alias, use the IP address for this
 2023-12-22 13:31:33 +09:00
Clemens Schwaighofer 694f04313c Add Account, Region and Instance info for each report 
So we can easy match up user reports to other information we collect
 2023-12-22 11:54:34 +09:00
Clemens Schwaighofer 50e28c7cfd Check that fallback last access file exists 2023-12-21 16:43:57 +09:00
Clemens Schwaighofer 65b7a6ad43 Fix date check for account created date 
Use regex to check instead of empty string.
A comment could be set instead of a date
 2023-12-21 16:39:05 +09:00
Clemens Schwaighofer 244461d466 sshforward group typo in lock and unlock users 2023-12-21 16:11:31 +09:00
Clemens Schwaighofer 66213dfd65 Text fixes for check last login 2023-12-21 16:06:53 +09:00
Clemens Schwaighofer 39da44b546 Wrong unlock account var used for unlock users 2023-12-21 16:01:35 +09:00
Clemens Schwaighofer d4bb06e3e1 Fix lock user flow to only lock if the user is not in the reject group 2023-12-21 15:58:28 +09:00
Clemens Schwaighofer cc647de495 Readme update 2023-12-21 15:14:57 +09:00
Clemens Schwaighofer 68b450baaf Add warning message for logins 2023-12-21 13:46:58 +09:00
Clemens Schwaighofer 8452a1b8c0 Fix pre check for ssh login checks 2023-12-21 13:35:50 +09:00
Clemens Schwaighofer 3fcb74ac47 Update check last login script with better reporting and csv/json output 
Now for each ssh group we report last login/account create stats.
Add the main user group to output
Add unlock user commands for locked users

Add CSV and JSON formatted output
 2023-12-21 13:23:35 +09:00
Clemens Schwaighofer 70212da3cb systemd logs end with dot and we split, so we missed user names with . inside 2023-12-20 17:51:35 +09:00
Clemens Schwaighofer 168cf9db15 Create user output was using wrong var for SSH access type 2023-08-21 09:41:23 +09:00
Clemens Schwaighofer 92ef3f0f2e The GO flag for create_user was default 1 instead of 0 
Script must be run with -g flag but for that the GO flag must be default
0.
 2023-08-21 09:38:00 +09:00
Clemens Schwaighofer f181ee74e3 Bug fix: missing ;; in case in create_user script 2023-08-21 09:36:42 +09:00
Clemens Schwaighofer 93224e3768 Update create/delete scripts, add rename script 
rename user script added: renames user, home dir and connected files.

delete script fix with remove of not needed options (-g)

Update all scripts to exit only after all errors are shown, unless it
is a critical run error.
 2023-08-08 10:50:08 +09:00
Clemens Schwaighofer 571ddcc717 AWS user account management scripts updates 
- start option for create users (-g)
- delete user script
- update documentation
- user lock user script in check user flow output
- create user has check for valid username/group name
 2023-08-07 07:29:24 +09:00
Clemens Schwaighofer eb194c2f1c The check last login loop for listing ssh reject users was wrong 
The inside variable user "username" instead of "user"
 2023-08-02 09:51:10 +09:00
Clemens Schwaighofer a1af63de39 Add ignore from file for authorized keys move 2023-06-01 17:33:22 +09:00
Clemens Schwaighofer b5854f93c4 Text typo fix 2023-06-01 16:12:25 +09:00
Clemens Schwaighofer 5735cf2ffb bug fixes in ls for ssh key move 2023-06-01 15:41:26 +09:00
Clemens Schwaighofer 081bb1cc4c ssh key change file name had .sh.sh extension 2023-06-01 15:35:12 +09:00
Clemens Schwaighofer e02822f06d wrong order for not moved ssh key check with master users 2023-06-01 15:30:19 +09:00
Clemens Schwaighofer 2956998762 used print instead of echo for info message in ssh key move 2023-06-01 15:28:56 +09:00
Clemens Schwaighofer 46dc2be34d Update ssh key move script 
admin/ubuntu/ec2-user keys must move too, but the folders don't get
auto removed
 2023-06-01 14:46:46 +09:00
Clemens Schwaighofer 43ef147de6 Fixes in create user script with central SSH location and dynamic home 
Missing username in create folder path for adding new user

check if pub key exists in central location ran even if central file
was missing.

Fixed check for .ssh or central place to use.

File check before trying to remove chattr "i" flag, can't do that if the
file does not exists.
 2023-05-23 09:08:14 +09:00
Clemens Schwaighofer fa7e7fbe86 Script to move authorized_keys to central location 
If there is a ssh setting that we have a central location for SSH keys
move all users ssh keys there.
Currently skipped are core admin users, they will move later once all
tests are done
 2023-05-16 08:58:53 +09:00
Clemens Schwaighofer fa3c4e0c6e Bug in user create test output 
Missing ! for central ssh authorized_file check in pub key update flow
 2023-04-05 13:27:05 +09:00
Clemens Schwaighofer ebf0eaf412 Bug fixes in user create for new ssh key central location 
* Bug with existing ssh key but not in ssh authorized_file
The correct public key location was not set for the existing file

* Bug with attr set on authorzied_file update if central location
If a central location the +i attrib must be removed first
It will set always in the folder rights change

* Change the authorized file group to root for central file location
 2023-04-05 13:24:15 +09:00
Clemens Schwaighofer 190b12b288 add missing check central ssh auth file folder exists 2023-04-05 11:29:46 +09:00
Clemens Schwaighofer 3a42c521f6 Add central ssh authorized_keys file detect, fixes for home folder create 
* new detect for central authorized keys folder
1) must have %u set in the AuthorizedKeysFile list
2) folder must exists (will not be created, if not exists abort)

If above is set, it will create a username file with the ssh key in there
and lock it down as r--/user and +i attrib

else uses old .ssh folder form

* fix for user add with different home base folder
add this as option for the useradd command
 2023-04-05 11:24:37 +09:00
Clemens Schwaighofer 61a8bca3d7 Allow /home to have a different base location 
If /home is eg located in /storge then we can now set a prefix for this.

Option -h or via config setting in "user_create.cfg" named
HOME_LOCATION="/path"

Note: Path has to be prefix with /. Any sub folders in home will be
ignored and the user is always created in /home/user.name
Group names as sub folders in /home are not supported
 2023-03-29 10:57:48 +09:00
Clemens Schwaighofer a0e7347033 Do not run zip command when test flag is set 2023-03-23 13:52:32 +09:00
Clemens Schwaighofer c58b0ea7a4 Add wildcard to user list txt file to also ignore TEST created files 2023-02-17 16:57:10 +09:00
Clemens Schwaighofer fb00036ab9 Abort on invalid option, always set ssh keytype so it doesn't stay on last selected 2023-01-31 13:29:00 +09:00
Clemens Schwaighofer 8808b94413 Add user create flow document 2022-12-02 10:05:40 +09:00
Clemens Schwaighofer 1fbc6c8125 Update password key length to 14 characters 2022-12-02 10:02:40 +09:00
Clemens Schwaighofer 87d53cdb13 Create user bug with positions in list file 2022-12-02 09:59:39 +09:00
Clemens Schwaighofer 716a0c2bfb Fix root/base folder problem 2022-12-02 09:41:25 +09:00
Clemens Schwaighofer 365b52efe5 Bug fix with user_list.txt variable in wrong script. Must be in unlock script not check script 2022-12-02 09:32:27 +09:00
Clemens Schwaighofer b10cb62612 Fix unlock script with debug comment out code 2022-12-02 09:28:09 +09:00
Clemens Schwaighofer 1f4e295e9f Update lock script, add unlock script, minor updates in other scripts 
Make sure that lock script reejcts core users
(root/ec2-user/admin/ubuntu)

Unlock script works reverse with also optional check in user_list.txt
for ssh allow/foward group type

Internal:
rename all $user to $username
 2022-12-02 09:26:51 +09:00
Clemens Schwaighofer ebddac7f67 Rename script names, add lock script 
Add a user lock script to move users from ssh allow/foward group to ssh
reject group.

Rename user_create.sh script to create_user.sh script and add new ssh
allow/foward flag in user_list.txt file after group block and before
password name block

Update check last login script with better add/remove from groups
 2022-12-01 18:22:46 +09:00
Clemens Schwaighofer fe08fa10c2 Add multiple groups to check last login script 
Currently fixed group names sshallow, sshforward and reject sshreject
 2022-12-01 06:43:43 +09:00
Clemens Schwaighofer 6e53d1bdec Update collector script with debug output, list rejected ssh users 
In the check script print out current rejected (not allowed) ssh users

Collect log info script has now debug output and proper options flags
 2022-11-22 09:33:52 +09:00
Clemens Schwaighofer cae5c8a19a Fix systemd read for dates with short-iso to get proper year date 2022-11-21 18:37:34 +09:00
Clemens Schwaighofer aa0594e17f Fix for different log output and missing different cut flow in function 2022-11-21 18:29:47 +09:00
Clemens Schwaighofer 16e6b98399 Start year fix for log file parsing 2022-11-21 18:19:03 +09:00
Clemens Schwaighofer 424277ff2e Move log parsing to function because it is the same for all check types 2022-11-21 17:58:31 +09:00
Clemens Schwaighofer ede5f1a2b8 Add full log scan for old non systemd auth checks 2022-11-21 17:41:27 +09:00
Clemens Schwaighofer 27516a6474 Add auth data collector and update check last login script 
Auth collector from either systemd logger or fallback /var/log/secure
(old Amazon V1).

Use this as primary last login source in check last login script
 2022-11-21 16:38:54 +09:00
Clemens Schwaighofer 9f61b3c523 Switch to different zip/pwgen exists bash check 2022-11-04 10:43:47 +09:00
Clemens Schwaighofer 54f4d69da6 Remove wrong exit in user create script 2022-11-04 10:35:58 +09:00
Clemens Schwaighofer 5db69276db Add Hostname to the check user data script 2022-11-03 14:02:47 +09:00
Clemens Schwaighofer 74bfded26f Add logging to check last login script 
Logging of all output to log/ folder for check last login script user.
Also for delete, user script now outputs move from ssh allow to ssh
reject group.
 2022-11-02 16:04:26 +09:00
Clemens Schwaighofer 37f9f4429d check users do not show delete from group if nothing has to be done 2022-11-02 15:16:22 +09:00
Clemens Schwaighofer 94a970d54b Update check user script output on problems 2022-11-02 15:11:26 +09:00
Clemens Schwaighofer c09e8cf799 AWS accunt scripts, deploy akamai scripts 
A new last logged in, last created script has been added to check which
users we have to disable.
- checks in group sshallow
- if last login older than 60days, remove account from ssh group
- if we have account create date, check if never logged in and older
  than 30 days, remove account from ssh group
Both dates can be set separate

Update create script to add create date in Y-m-d (%F) format as
comment to the passwd file
Also add user to sshallow group (group always exists, is created on
server creation)
 2022-11-02 15:02:17 +09:00
Clemens Schwaighofer a15541c86b Fix pub key check for info display 2022-03-28 15:01:46 +09:00
Clemens Schwaighofer 12d8d57bd2 Moved script into wrong folder 2022-03-28 14:58:42 +09:00
Clemens Schwaighofer 18b544a1a4 More info on -i flag 2022-03-28 14:56:16 +09:00
Clemens Schwaighofer 4914e3f367 Update documentation in user create script 
Still used old key value separator and was missing new added
user_list.txt file blocks
 2022-03-15 14:18:04 +09:00
Clemens Schwaighofer 12ef307bdb Remove alert text if RSA type was selected 2022-03-10 11:14:53 +09:00