This content originally appeared on DEV Community and was authored by Mayowa Fajube
INTRODUCTION
User and group management is a fundamental task for any Linux SysOps engineer. Handling these tasks manually can be error-prone and time-consuming, especially in larger environments. It is critical when dealing with multiple users and groups to ensure each user has the correct permissions and access within the system. To streamline this process, I have developed a Bash script, create_users.sh, which automates the creation of users and groups based on a supplied file. This script not only creates users and their corresponding home directories but also ensures they are assigned to the correct groups and generates secure random passwords for them. Additionally, the script logs all actions for auditing purposes.
Script Overview
The create_users.sh script automates the following tasks:
- Reading user and group information from a file.
- Creating users and their personal groups.
- Setting up home directories with proper permissions.
- Generating random passwords for each user.
- Logging all actions to a log file.
- Storing generated passwords securely in a CSV file.
Let's break down the script step by step to understand its functionality.
0. Shebang: Specifying the Interpreter
The script begins with a shebang line:
#!/bin/bash
The importance of this line is;
- Interpreter Directive: It specifies the path to the interpreter that should be used to execute the script. In this case, #!/bin/bash tells the system to use the Bash shell to run the script. The interpreter is responsible for parsing and executing the commands within the script.
- Executable Scripts: When the shebang is present, the script can be executed directly as a standalone program. This means the script can be run by simply typing its name, provided it has execute permissions. Without the shebang, you would need to explicitly invoke the interpreter and pass the script as an argument (e.g., bash create_users.sh).
1. Checking Script Arguments
The script starts by verifying if a file name argument is provided alongside the bash script during runtime. This file should contain the username and group information in a specific format.
if [ "$#" -ne 1 ]; then
echo "Usage: $0 <user_file>"
exit 1
fi
If the argument is missing, the script exits with a usage message, ensuring the user knows how to correctly run the script.
2. Assigning user file argument supplied to a variable
USER_FILE="$1"
USER_FILE is a variable that I defined within the script. By assigning USER_FILE="$1", I am storing the value of the first argument passed to the script in this variable which is then used throughout the script to refer to the file containing the user and group information. By assigning the argument to a variable, the script can easily reference the input file without directly using $1 multiple times, making the code more readable and maintainable.
3. Checking Input File Existence
The below command checks if the specified user file exists. If not, it exits with an error message.
if [ ! -f "$USER_FILE" ]; then
echo "Error: File $USER_FILE does not exist."
exit 1
fi
This is to prevent the script from running without the necessary input data, avoiding potential errors.
4. Defining File Paths for logs and passwords
LOG_FILE="/var/log/user_management.log"
PASSWORD_DIR="/var/secure"
PASSWORD_FILE="$PASSWORD_DIR/user_passwords.csv"
These assigned paths to variables LOG_FILE and PASSWORD_FILE help in organizing the script's output and ensuring logs and passwords are stored securely.
5. Ensuring Log and Password Files Exist
touch $LOG_FILE
if [ ! -d "$PASSWORD_DIR" ]; then
mkdir -p "$PASSWORD_DIR"
chmod 700 "$PASSWORD_DIR"
fi
if [ ! -f "$PASSWORD_FILE" ]; then
echo "username,password" > $PASSWORD_FILE
fi
chmod 600 $PASSWORD_FILE
This section of the script ensures that the log file and password directory exist, creating them if necessary. It also sets appropriate permissions for security. Creating the password directory with chmod 700 and the password file with chmod 600, ensures that only the root user can read and write these files, protecting sensitive information.
6. Logging Function
log_action() {
echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" >> $LOG_FILE
}
This simple logging function records actions with timestamps, helping in troubleshooting and auditing. It appends log entries to the log file, providing a history of all script actions.
7. Reading and Processing the Input File
while IFS=';' read -r username groups; do
username=$(echo "$username" | xargs)
groups=$(echo "$groups" | xargs)
The script reads the input file line by line at this stage, processing each entry to extract the usernames and groups. It removes any leading or trailing whitespace from the entries.This ensures that any extraneous spaces in the input file do not cause issues.
8. Checking and Creating Users and Groups
if id -u "$username" >/dev/null 2>&1; then
log_action "User $username already exists."
continue
fi
For each user, the script checks if the user already exists. If the user exists, it logs this information and skips it to the next user. If the user does not exist, the script creates a personal group for the user.
if ! getent group "$username" >/dev/null 2>&1; then
groupadd "$username"
fi
It then creates the user with their personal group and sets up their home directory with the correct permissions.
useradd -m -g "$username" -s /bin/bash "$username"
chmod 700 /home/"$username"
chown "$username:$username" /home/"$username"
This ensures that the user's home directory is private and owned by the user.
9. Generating and Setting Passwords
password=$(openssl rand -base64 12)
echo "$username:$password" | chpasswd
echo "$username,$password" >> $PASSWORD_FILE
The script section generates a random password using openssl, sets this password for the user, and logs it securely in the password file. Using openssl rand -base64 12 generates a secure 12-character password for each user.
10. Assigning Additional Groups
if [ -n "$groups" ]; then
IFS=',' read -r -a group_array <<< "$groups"
for group in "${group_array[@]}"; do
group=$(echo "$group" | xargs)
if ! getent group "$group" >/dev/null 2>&1; then
groupadd "$group"
fi
usermod -aG "$group" "$username"
done
fi
If additional groups are specified for the user, the script processes each group, ensuring it exists before adding the user to the group. This ensures that users are correctly assigned to all specified groups, creating groups if they do not already exist.
11. Logging Completion
log_action "User $username created with groups: $username, $groups"
done < $USER_FILE
log_action "User creation process completed."
After processing all users, the script logs the completion of the user creation process.
Thanks to the HNG team for their brilliant initiative. This technical article fulfills stage 1 to stage 2 of the HNG11 internship program. For those looking to enhance their skills, consider joining the HNG Internship program. This initiative offers valuable hands-on experience and mentorship from industry experts. Additionally, for more advanced resources and opportunities, the HNG Premium platform provides exclusive access to premium content and professional development tools.
This content originally appeared on DEV Community and was authored by Mayowa Fajube
Mayowa Fajube | Sciencx (2024-07-01T16:44:52+00:00) Linux Users and Groups Management using Bash Script. Retrieved from https://www.scien.cx/2024/07/01/linux-users-and-groups-management-using-bash-script/
Please log in to upload a file.
There are no updates yet.
Click the Upload button above to add an update.