[Puppet Users] Re: create user and push out keys.

Ola
2011-12-12T15:21:33Z

Thanks! do i need any includes or similar to "Install" this?

On 12 Dec, 10:55, Alexander Swen <alex.s...@gmail.com>
wrote:
> > Yes, if noone else does, I can sanitize an example from our
environment,
> > but I''ll have to be back in the office.
>
> This is how we do that: (learned from puppet btw)
>
> create module users:
> I will put a line +++++BEGIN and -----END around files to show
> boundaries. Don''t put those lines in your files ;-)
>
> file: manifests/init.pp:
> watch out with the purge rule in resource! it removes all users that
> are not defined!!!
> +++++BEGIN
> class users {
>
> }
>
> class users::resources {
>   resources { ''user'':
>     purge              => false,
>     unless_system_user => true;
>   }}
>
> -----END
>
> another file: manifests/account.pp
> this is the "script" that actually generates account and (if
present)
> a ssh key file
> +++++BEGIN
> define users::account($realname, $password, $uid, $othergroups=[],
> $gid, $key='''', $keytype=''ssh-rsa'',
$name, $ensure=present, shell=''/bin/
> bash'', managehome=''true'',
allowdupe=''false'', homeprefix=''/home'',
> $functie='''' ) {
>   if ($ensure == absent and $name == ''root'') {
>     fail(''will not delete root user'')
>   }
>   File { owner => $name, group => $name, mode =>
''0600'' }
>
>   $home = $name ? {
>     ''root''  => ''/root'',
>     default => "${homeprefix}/${name}",
>   }
>
>   user { $name:
>     ensure     => $ensure,
>     uid        => $uid,
>     gid        => $group,
>     password   => $password,
>     comment    => "$realname",
>     groups     => $othergroups,
>     shell      => "$shell",
>     home       => $home,
>     require    => Group["$group"],
>     allowdupe  => $allowdupe,
>     managehome => $managehome;
>   }
>
>   case $ensure {
>     absent: {
>       file { $home:
>         ensure  => $ensure,
>         force   => true,
>         recurse => true,
>       }
>       if ( $group == $name ) {
>         group { "$group":
>           ensure => $ensure;
>         }
>       }
>     }
>     present: {
>       file {
>         "$home":
>           ensure => directory;
>         "$home/.bash_logout":
>           ensure => present,
>           source => "puppet:///users/.bash_logout";
>       }
>       if $key {
>         file {
>           "$home/.ssh":
>             ensure => directory;
>         }
>         ssh_authorized_key { "$name":
>           user    => $name,
>           require => File["$home/.ssh"],
>           key     => $key,
>           type    => $keytype,
>           ensure  => $ensure;
>         }
>       }
>     }
>   }}
>
> -----END
>
> Another file: manifests/groups.pp
> Here you can define as much groups as you like. we chose to create
> those groups on all our servers. You can choose to change this to a
> system similar to the way users are realized off course.
> +++++BEGIN
> class users::groups {
>   Group { ensure => present }
>   group {
>     "groupname":
>       gid    => 500;}
>
> -----END
>
> Another file: manifests/userlist:
> This file should contain a list of all your users with their info
> (pass and ssh key) etc
> +++++BEGIN
> /*
>
> call users::account with following parameters:
>
> these are mandatory:
> $name     # Loginname
> $password # md5 encrypted pass
> $uid      # userid (should be >500)
> $gid      # optional groupid
> $realname # users full name
>
> these are optional:
> $othergroups=[] # array of additional groups
> $key            # SSH key without comment
> $keytype        # ssh key type
>
> these defaults can be overriden:
> $ensure=present
> shell=''/bin/bash''
> managehome=''true''
> homeprefix=''/home''
> allowdupes=''false''
> keytype=''ssh-rsa''
>
> EXAMPLE:
> @users::account {
>   "dork":
>     name        => "dork",
>     uid         => 9000,
>     gid         => 9000,
>     realname    => "dork is a dork",
>     password    => ''hashed password here'',
>     othergroups => [ "blaat", "dorks" ],
>     key         =>
"x5KTrq41xKcfwFog38jWTmCSiyXLPKLbsDWumrsOel5od2U7W
> +ZKNJIkVQZZQqCOmZwnwagssdfgsdfgas",
>     keytype     => "ssh-dsa",
>
> }
>
> */
>
> class users::userlist {
>   include users::groups
>   @users::account {
>     "root":
>       uid      => "0",
>       gid      => "0",
>       realname => "root",
>       password => ''hashed password here'';
>   "dork":
>     name        => "dork",
>     uid         => 9000,
>     gid         => 9000,
>     realname    => "dork is a dork",
>     password    => ''hashed password here'',
>     othergroups => [ "blaat", "dorks" ],
>     key         =>
"x5KTrq41xKcfwFog38jWTmCSiyXLPKLbsDWumrsOel5od2U7W
> +ZKNJIkVQZZQqCOmZwnwagssdfgsdfgas",
>     keytype     => "ssh-dsa";}
>
> -----END
>
> and then: manifests/some_name
> (This realizes the users that are member of some groups)
> +++++BEGIN
> class users::some_name {
>   Users::Account <| (othergroups == ''some_group'' or
othergroups => ''some_other_group'') |>}
>
> -----END
>
> Each server should include users::userlist and users::some_name
> if you like you can include , users::resources and then all users will
> be removed unless they are specified.
>
> good luck