ServerUserCreate/bin/rename_user.sh

#!/usr/bin/env bash

# Rename user
# - rename user name
# - rename home folder + owner
# - rename public key file in /etc/ssh/
# - rename in user_list.txt
# - rename created public key file

TEST=0; # do not run any actions
OLD_USERNAME="";
NEW_USERNAME="";
while getopts ":to:n:" opt; do
	case "${opt}" in
		t|test)
			TEST=1;
			;;
		o|old-user)
			if [ -z "${OLD_USERNAME}" ]; then
				OLD_USERNAME="${OPTARG}";
			fi;
			;;
		n|new-user)
			if [ -z "${NEW_USERNAME}" ]; then
				NEW_USERNAME="${OPTARG}";
			fi;
			;;
		\?)
			echo -e "\n Option does not exist: ${OPTARG}\n";
			echo "Use -t for test";
			echo "-o: Current user";
			echo "-n: New username";
			exit 1;
			;;
	esac;
done;
shift "$((OPTIND-1))"

if [ $(whoami) != "root" ]; then
	if [ ${TEST} -eq 0 ]; then
		echo "Script must be run as root user";
		exit;
	else
		echo "!!!! Script must be run as root user !!!!";
	fi;
fi;

error=0;
host=$(hostname);
timestamp=$(date +%Y%m%d-%H%M%S);
# character to set getween info blocks
separator="#";
# base folder for all data
BASE_FOLDER=$(dirname $(readlink -f $0))"/";
root_folder="${BASE_FOLDER}../";
SSH_KEYGEN_FOLDER_CREATED_PUB='ssh-keygen-created-pub/';
input_file='user_list.txt';
user_list_file="${root_folder}${input_file}";
default_ssh_keytype='ed25519';
ssh_keytype='';
# log file
LOG="${BASE_FOLDER}/../log/rename_user."$(date +"%F_%H%m%S");
if [ ${TEST} -eq 0 ]; then
	LOG="${LOG}.log";
else
	LOG="${LOG}.test.log";
fi;
# ignore users (root and admin users)
ignore_users=('root' 'ec2-user' 'ubuntu' 'admin');
# detect ssh authorized_keys setting
SSH_CENTRAL_AUTHORIZED_FILE_FOLDER='';
SSH_AUTHORIZED_FILE='';
for cf in $(grep "^AuthorizedKeysFile" /etc/ssh/sshd_config | grep "%u"); do
	if [ ! -z $(echo "${cf}" | grep "%u") ]; then
		SSH_CENTRAL_AUTHORIZED_FILE_FOLDER=$(echo "${cf}" | sed -e 's/%u//');
		if [ ! -d "${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}" ]; then
			echo "ssh central authorized_file folder could not be found: ${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}";
			error=1;
		fi;
	fi;
done;
if [ ! -f "${user_list_file}" ]; then
	echo "${input_file} is missing";
	error=1;
fi;

if [ -z "${OLD_USERNAME}" ] || [ -z "${NEW_USERNAME}" ]; then
	echo "[!!!] Current and new username must be provided";
	error=1;
fi;

if [ "${OLD_USERNAME}" = "${NEW_USERNAME}" ]; then
	echo "[!!!] Current and new username cannot be the same";
	error=1;
fi;

if ! [[ "${NEW_USERNAME}" =~ ^[a-z0-9]+([.a-z0-9_-]+[a-z0-9])?$ ]]; then
	echo "User name can only be a-z 0-9 - _ . and cannot start or end with - . or _: ${NEW_USERNAME}";
	error=1;
fi;

# skip ignore users, note that if a user is not in the sshallow list anyway
# we skip them too, this is just in case check
if [[ " ${ignore_users[*]} " =~ " ${OLD_USERNAME} " ]]; then
	echo "[!] User ${OLD_USERNAME} is in the ignore user list";
	error=1;
fi;
if [[ " ${ignore_users[*]} " =~ " ${NEW_USERNAME} " ]]; then
	echo "[!] User ${NEW_USERNAME} is in the ignore user list";
	error=1;
fi;
# user must exist in user_list.txt and /etc/passwd
# if missing in or another do not continue
if ! id "${OLD_USERNAME}" &>/dev/null; then
	# not in passwd
	echo "[!!!] User ${OLD_USERNAME} does not exist in /etc/passwd";
	error=1;
fi;
if id "${NEW_USERNAME}" &>/dev/null; then
	# not in passwd
	echo "[!!!] User ${NEW_USERNAME} exists in /etc/passwd";
	error=1;
fi;
if [ -f "${user_list_file}" ]; then
	user_list_entry=$(grep "${OLD_USERNAME}" "${user_list_file}");
	if [ -z "${user_list_entry}" ]; then
		echo "[!!!] User ${OLD_USERNAME} does not exist in user_list.txt file";
		error=1;
	fi;
	# if the old user exists but as DELETED -> no go
	if [ ! -z $(echo "${user_list_entry}" | grep "#DELETED-") ]; then
		echo "[!!!] User ${OLD_USERNAME} has been flagged as deleted";
		error=1;
	fi;
	# if new user name already exists in user list file for whatever reason
	if [ $(grep "${NEW_USERNAME}" "${user_list_file}") ]; then
		echo "[!!!] User ${NEW_USERNAME} exists in user_list.txt file";
		error=1;
	fi;
fi;
# exit on any error
if [ $error -eq 1 ]; then
	exit;
fi;

# parse user list entry for group/hostname/ssh type key to build ssh key list

# POS 3: groups
_group=$(echo "${user_list_entry}" | cut -d ";" -f 3 | tr A-Z a-z | tr -d ' ');
group=$(echo "${_group}" | cut -d "," -f 1);
# POS 6: override host name, lowercase and spaces removed
_hostname=$(echo "${user_list_entry}" | cut -d ";" -f 6 | tr A-Z a-z | tr -d ' ');
if [ -z "${_hostname}" ]; then
	hostname=${host};
else
	hostname=${_hostname};
fi;
# POS 7: ssh keytype override
_ssh_keytype=$(echo "${user_list_entry}" | cut -d ";" -f 7 | tr A-Z a-z | tr -d ' ');
if [ "${_ssh_keytype}" = "rsa" ]; then
	ssh_keytype="${_ssh_keytype}";
else
	ssh_keytype=${default_ssh_keytype};
fi;

echo "* Rename ${OLD_USERNAME} to ${NEW_USERNAME}";

old_home_dir=$(getent passwd "${OLD_USERNAME}" | cut -d: -f6);
new_home_dir=$(echo "${old_home_dir}" | sed -e "s/\/${OLD_USERNAME}$/\/${NEW_USERNAME}/");
# rename user
if [ $TEST -eq 0 ]; then
	echo "usermod with ${new_home_dir}";
	usermod -l ${NEW_USERNAME} -m -d "${new_home_dir}" ${OLD_USERNAME};
else
	echo "$> usermod -l ${NEW_USERNAME} -m -d \"${new_home_dir}\" ${OLD_USERNAME};";
fi
# check that home folder is renamed and owned by new user

# check if spool exists
if [ -f "/var/spool/mail/${OLD_USERNAME}" ]; then
	if [ $TEST -eq 0 ]; then
		echo "rename to /var/spool/mail/${NEW_USERNAME}";
		mv "/var/spool/mail/${OLD_USERNAME}" "/var/spool/mail/${NEW_USERNAME}";
	else
		echo "$> mv \"/var/spool/mail/${OLD_USERNAME}\" \"/var/spool/mail/${NEW_USERNAME}\";";
	fi
fi;
# check if crontab exists
if [ -f "/var/spool/cron/crontabs/${OLD_USERNAME}" ]; then
	if [ $TEST -eq 0 ]; then
		echo "rename to /var/spool/cron/crontabs/${NEW_USERNAME}";
		mv "/var/spool/cron/crontabs/${OLD_USERNAME}" "/var/spool/cron/crontabs/${NEW_USERNAME}";
	else
		echo "$> mv \"/var/spool/cron/crontabs/${OLD_USERNAME}\" \"/var/spool/cron/crontabs/${NEW_USERNAME}\";";
	fi
fi;

# public key files user must be renamed
OLD_SSH_AUTHORIZED_FILE="${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}${OLD_USERNAME}";
NEW_SSH_AUTHORIZED_FILE="${SSH_CENTRAL_AUTHORIZED_FILE_FOLDER}${NEW_USERNAME}";

if [ -f "${OLD_SSH_AUTHORIZED_FILE}" ]; then
	if [ $TEST -eq 0 ]; then
		echo "rename to ${NEW_SSH_AUTHORIZED_FILE}";
		chattr -i "${OLD_SSH_AUTHORIZED_FILE}";
		mv "${OLD_SSH_AUTHORIZED_FILE}" "${NEW_SSH_AUTHORIZED_FILE}";
		chattr +i "${NEW_SSH_AUTHORIZED_FILE}";
	else
		echo "$> chattr -i \"${OLD_SSH_AUTHORIZED_FILE}\";";
		echo "$> mv \"${OLD_SSH_AUTHORIZED_FILE}\" \"${NEW_SSH_AUTHORIZED_FILE}\";";
		echo "$> chattr +i \"${NEW_SSH_AUTHORIZED_FILE}\";";
	fi;
else
	echo "[?] ${OLD_SSH_AUTHORIZED_FILE} is missing";
fi;

# rename keygen public file
OLD_ssh_keygen_pub="${ROOT_FOLDER}${SSH_KEYGEN_FOLDER_CREATED_PUB}${hostname}${separator}${group}${separator}${OLD_USERNAME}${separator}${ssh_keytype}.pem.pub";
NEW_ssh_keygen_pub="${ROOT_FOLDER}${SSH_KEYGEN_FOLDER_CREATED_PUB}${hostname}${separator}${group}${separator}${NEW_USERNAME}${separator}${ssh_keytype}.pem.pub";

if [ -f "${OLD_ssh_keygen_pub}" ]; then
	if [ $TEST -eq 0 ]; then
		echo "rename to ${NEW_ssh_keygen_pub}";
		mv "${OLD_ssh_keygen_pub}" "${NEW_ssh_keygen_pub}";
	else
		echo "$> mv \"${OLD_ssh_keygen_pub}\" \"${NEW_ssh_keygen_pub}\";";
	fi;
else
	echo "[?] ${OLD_ssh_keygen_pub} is missing";
fi;

# rename entry in user list txt file
if [ $TEST -eq 0 ]; then
	echo "update ${user_list_file}";
	sed -i -e "s/^\([A-Za-z0-9]\{1,\}\);${OLD_USERNAME};/\1;${NEW_USERNAME};/" "${user_list_file}";
else
	echo "$> sed -i -e \"s/^\([A-Za-z0-9]\{1,\}\);${OLD_USERNAME};/\1;${NEW_USERNAME};/\" \"${user_list_file}\";";
fi;

# __END__