Return to lcuseradd CVS log

Up to [LON-CAPA] / loncom

Bug 701 - added additional $noprint conditionalized deubgging.
    In lcpasswd, removed code too put a dummy entry at the end of
    /etc/smbpasswd (it's not the right file anyway), and added the -a
   switch to the smbpasswd command invocation.

    1: #!/usr/bin/perl
    2: 
    3: # The Learning Online Network with CAPA
    4: #
    5: # lcuseradd - LON-CAPA setuid script to coordinate all actions
    6: #             with adding a user with filesystem privileges (e.g. author)
    7: #
    8: # YEAR=2000
    9: # 10/27,10/29,10/30 Scott Harrison
   10: # YEAR=2001
   11: # 10/21,11/13,11/15 Scott Harrison
   12: # YEAR=2002
   13: #   May 19, 2002 Ron Fox
   14: #      - Removed creation of the pulic_html directory.  This directory
   15: #        can now be added in two ways:
   16: #        o The user can add it themselves if they want some local web
   17: #          space which may or may not contain construction items.
   18: #        o LonCapa will add it if/when the user is granted an Author
   19: #          role.
   20: #
   21: # $Id: lcuseradd,v 1.22 2002/09/16 13:27:40 foxr Exp $
   22: ###
   23: 
   24: ###############################################################################
   25: ##                                                                           ##
   26: ## ORGANIZATION OF THIS PERL SCRIPT                                          ##
   27: ##                                                                           ##
   28: ## 1. Description of script                                                  ##
   29: ## 2. Invoking script (standard input)                                       ##
   30: ## 3. Example usage inside another piece of code                             ##
   31: ## 4. Description of functions                                               ##
   32: ## 5. Exit codes                                                             ##
   33: ## 6. Initializations                                                        ##
   34: ## 7. Make sure this process is running from user=www                        ##
   35: ## 8. Start running script with www permissions                              ##
   36: ## 9. Handle case of another lcpasswd process (locking)                      ##
   37: ## 10. Error-check input, need 3 values (user name, password 1, password 2)  ##
   38: ## 11. Start running script with root permissions                            ##
   39: ## 12. Add user and make www a member of the user-specific group             ##
   40: ## 13. Set password                                                          ##
   41: ## 14. Make final modifications to the user directory                        ##
   42: ## 15. Exit script (unlock)                                                  ##
   43: ##                                                                           ##
   44: ###############################################################################
   45: 
   46: use strict;
   47: 
   48: # ------------------------------------------------------- Description of script
   49: #
   50: # This script is a setuid script that should
   51: # be run by user 'www'.  It creates a /home/USERNAME directory.
   52: # It adds a user to the unix system.
   53: # Passwords are set with lcpasswd.
   54: # www becomes a member of this user group.
   55: 
   56: # -------------- Invoking script (standard input versus command-line arguments)
   57: #
   58: # Standard input (STDIN) usage
   59: # First line is USERNAME
   60: # Second line is PASSWORD
   61: # Third line is PASSWORD
   62: #
   63: # Command-line arguments [USERNAME] [PASSWORD] [PASSWORD]
   64: # Yes, but be very careful here (don't pass shell commands)
   65: # and this is only supported to allow perl-system calls.
   66: #
   67: # Valid passwords must consist of the
   68: # ascii characters within the inclusive
   69: # range of 0x20 (32) to 0x7E (126).
   70: # These characters are:
   71: # SPACE and
   72: # !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNO
   73: # PQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
   74: #
   75: # Valid user names must consist of ascii
   76: # characters that are alphabetical characters
   77: # (A-Z,a-z), numeric (0-9), or the underscore
   78: # mark (_). (Essentially, the perl regex \w).
   79: # User names must begin with an alphabetical character
   80: # (A-Z,a-z).
   81: 
   82: # ---------------------------------- Example usage inside another piece of code
   83: # Usage within code
   84: #
   85: # $exitcode=
   86: #      system("/home/httpd/perl/lcuseradd","NAME","PASSWORD1","PASSWORD2")/256;
   87: # print "uh-oh" if $exitcode;
   88: 
   89: # ---------------------------------------------------- Description of functions
   90: # enable_root_capability() : have setuid script run as root
   91: # disable_root_capability() : have setuid script run as www
   92: # try_to_lock() : make sure that another lcpasswd process isn't running
   93: 
   94: # ------------------------------------------------------------------ Exit codes
   95: # These are the exit codes.
   96: # ( (0,"ok"),
   97: # (1,"User ID mismatch.  This program must be run as user 'www'"),
   98: # (2,"Error. This program needs 3 command-line arguments (username, ".
   99: #    "password 1, password 2)."),
  100: # (3,"Error. Three lines should be entered into standard input."),
  101: # (4,"Error. Too many other simultaneous password change requests being ".
  102: #    "made."),
  103: # (5,"Error. User $username does not exist."),
  104: # (6,"Error. Could not make www a member of the group \"$safeusername\"."),
  105: # (7,"Error. Root was not successfully enabled.),
  106: # (8,"Error. Cannot set password."),
  107: # (9,"Error. The user name specified has invalid characters."),
  108: # (10,"Error. A password entry had an invalid character."),
  109: # (11,"Error. User already exists.),
  110: # (12,"Error. Something went wrong with the addition of user ".
  111: #     "\"$safeusername\"."),
  112: # (13,"Error. Password mismatch."),
  113: 
  114: # ------------------------------------------------------------- Initializations
  115: # Security
  116: $ENV{'PATH'}='/bin/:/usr/bin:/usr/local/sbin:/home/httpd/perl'; # Nullify path
  117:                                                                 # information
  118: delete @ENV{qw(IFS CDPATH ENV BASH_ENV)}; # nullify potential taints
  119: 
  120: # Do not print error messages.
  121: my $noprint=1;
  122: 
  123: # ----------------------------- Make sure this process is running from user=www
  124: my $wwwid=getpwnam('www');
  125: &disable_root_capability;
  126: if ($wwwid!=$>) {
  127:     print("User ID mismatch.  This program must be run as user 'www'\n")
  128: 	unless $noprint;
  129:     exit 1;
  130: }
  131: 
  132: # ----------------------------------- Start running script with www permissions
  133: &disable_root_capability;
  134: 
  135: # --------------------------- Handle case of another lcpasswd process (locking)
  136: unless (&try_to_lock("/tmp/lock_lcpasswd")) {
  137:     print "Error. Too many other simultaneous password change requests being ".
  138: 	"made.\n" unless $noprint;
  139:     exit 4;
  140: }
  141: 
  142: # ------- Error-check input, need 3 values (user name, password 1, password 2).
  143: my @input;
  144: if (@ARGV==3) {
  145:     @input=@ARGV;
  146: }
  147: elsif (@ARGV) {
  148:     print("Error. This program needs 3 command-line arguments (username, ".
  149: 	  "password 1, password 2).\n") unless $noprint;
  150:     unlink('/tmp/lock_lcpasswd');
  151:     exit 2;
  152: }
  153: else {
  154:     @input=<>;
  155:     if (@input!=3) {
  156: 	print("Error. Three lines should be entered into standard input.\n")
  157: 	    unless $noprint;
  158: 	unlink('/tmp/lock_lcpasswd');
  159: 	exit 3;
  160:     }
  161:     foreach (@input) {chomp;}
  162: }
  163: 
  164: my ($username,$password1,$password2)=@input;
  165: print "Username = ".$username unless $noprint;
  166: $username=~/^(\w+)$/;
  167: print "Username after substitution - ".$username unless $noprint;
  168: my $safeusername=$1;
  169: print "Safe username = $safeusername" unless $noprint;
  170: 
  171: if (($username ne $safeusername) or ($safeusername!~/^[A-Za-z]/)) {
  172:     print "Error. The user name specified $username $safeusername  has invalid characters.\n"
  173: 	unless $noprint;
  174:     unlink('/tmp/lock_lcpasswd');
  175:     exit 9;
  176: }
  177: my $pbad=0;
  178: foreach (split(//,$password1)) {if ((ord($_)<32)||(ord($_)>126)){$pbad=1;}}
  179: foreach (split(//,$password2)) {if ((ord($_)<32)||(ord($_)>126)){$pbad=1;}}
  180: if ($pbad) {
  181:     print "Error. A password entry had an invalid character.\n";
  182:     unlink('/tmp/lock_lcpasswd');
  183:     exit 10;
  184: }
  185: 
  186: # -- Only add user if we can create a brand new home directory (/home/username)
  187: if (-e "/home/$safeusername") {
  188:     print "Error. User already exists.\n" unless $noprint;
  189:     unlink('/tmp/lock_lcpasswd');
  190:     exit 11;
  191: }
  192: 
  193: # -- Only add user if the two password arguments match.
  194: if ($password1 ne $password2) {
  195:     print "Error. Password mismatch.\n" unless $noprint;
  196:     unlink('/tmp/lock_lcpasswd');
  197:     exit 13;
  198: }
  199: 
  200: # ---------------------------------- Start running script with root permissions
  201: &enable_root_capability;
  202: 
  203: # ------------------- Add user and make www a member of the user-specific group
  204: # -- Add user
  205: if (system('/usr/sbin/useradd','-c','LON-CAPA user',$safeusername)) {
  206:     print "Error.  Something went wrong with the addition of user ".
  207: 	  "\"$safeusername\".\n" unless $noprint;
  208:     unlink('/tmp/lock_lcpasswd');
  209:     exit 12;
  210: }
  211: 
  212: # Make www a member of that user group.
  213: my $groups=`/usr/bin/groups www` or exit(6);
  214: chomp $groups; $groups=~s/^\S+\s+\:\s+//;
  215: my @grouplist=split(/\s+/,$groups);
  216: my @ugrouplist=grep {!/www|$safeusername/} @grouplist;
  217: my $gl=join(',',(@ugrouplist,$safeusername));
  218: if (system('/usr/sbin/usermod','-G',$gl,'www')) {
  219:     print "Error. Could not make www a member of the group ".
  220: 	  "\"$safeusername\".\n" unless $noprint;
  221:     unlink('/tmp/lock_lcpasswd');
  222:     exit 6;
  223: }
  224: 
  225: # ---------------------------------------------------------------- Set password
  226: # Set password with lcpasswd (which creates smbpasswd entry).
  227: 
  228: unlink('/tmp/lock_lcpasswd');
  229: &disable_root_capability;
  230: ($>,$<)=($wwwid,$wwwid);
  231: open OUT,"|/home/httpd/perl/lcpasswd";
  232: print OUT $safeusername;
  233: print OUT "\n";
  234: print OUT $password1;
  235: print OUT "\n";
  236: print OUT $password1;
  237: print OUT "\n";
  238: close OUT;
  239: if ($?) {
  240:     exit 8;
  241: }
  242: ($>,$<)=($wwwid,0);
  243: &enable_root_capability;
  244: 
  245: # -- Don't add public_html... that can be added either by the user
  246: #    or by lchtmldir when the user is granted an authorship role.
  247: 
  248: # ------------------------------ Make final modifications to the user directory
  249: # -- Add a public_html file with a stand-in index.html file
  250: 
  251:  system('/bin/chmod','-R','0660',"/home/$safeusername");
  252: system('/bin/chmod','0710',"/home/$safeusername");
  253: mkdir "/home/$safeusername/public_html",0755;
  254: system('/bin/chmod','02770',"/home/$safeusername/public_html");
  255: open OUT,">/home/$safeusername/public_html/index.html";
  256: print OUT<<END;
  257: <html>
  258: <head>
  259: <title>$safeusername</title>
  260: </head>
  261: <body>
  262: <h1>$safeusername</h1>
  263: <p>
  264: Learning Online Network
  265: </p>
  266: <p>
  267: This area provides for:
  268: </p>
  269: <ul>
  270: <li>resource construction</li>
  271: <li>resource publication</li>
  272: <li>record-keeping</li>
  273: </ul>
  274: </body>
  275: </html>
  276: END
  277: close OUT;
  278: 
  279: system('/bin/chown','-R',"$safeusername:$safeusername","/home/$safeusername");
  280: 
  281: # -------------------------------------------------------- Exit script
  282: &disable_root_capability;
  283: exit 0;
  284: 
  285: # ---------------------------------------------- Have setuid script run as root
  286: sub enable_root_capability {
  287:     if ($wwwid==$>) {
  288: 	($<,$>)=($>,$<);
  289: 	($(,$))=($),$();
  290:     }
  291:     else {
  292: 	# root capability is already enabled
  293:     }
  294:     return $>;
  295: }
  296: 
  297: # ----------------------------------------------- Have setuid script run as www
  298: sub disable_root_capability {
  299:     if ($wwwid==$<) {
  300: 	($<,$>)=($>,$<);
  301: 	($(,$))=($),$();
  302:     }
  303:     else {
  304: 	# root capability is already disabled
  305:     }
  306: }
  307: 
  308: # ----------------------- Make sure that another lcpasswd process isn't running
  309: sub try_to_lock {
  310:     my ($lockfile)=@_;
  311:     my $currentpid;
  312:     my $lastpid;
  313:     # Do not manipulate lock file as root
  314:     if ($>==0) {
  315: 	return 0;
  316:     }
  317:     # Try to generate lock file.
  318:     # Wait 3 seconds.  If same process id is in
  319:     # lock file, then assume lock file is stale, and
  320:     # go ahead.  If process id's fluctuate, try
  321:     # for a maximum of 10 times.
  322:     for (0..10) {
  323: 	if (-e $lockfile) {
  324: 	    open(LOCK,"<$lockfile");
  325: 	    $currentpid=<LOCK>;
  326: 	    close LOCK;
  327: 	    if ($currentpid==$lastpid) {
  328: 		last;
  329: 	    }
  330: 	    sleep 3;
  331: 	    $lastpid=$currentpid;
  332: 	}
  333: 	else {
  334: 	    last;
  335: 	}
  336: 	if ($_==10) {
  337: 	    return 0;
  338: 	}
  339:     }
  340:     open(LOCK,">$lockfile");
  341:     print LOCK $$;
  342:     close LOCK;
  343:     return 1;
  344: }
  345: 
  346: =head1 NAME
  347: 
  348: lcuseradd - LON-CAPA setuid script to coordinate all actions
  349:             with adding a user with filesystem privileges (e.g. author)
  350: 
  351: =head1 DESCRIPTION
  352: 
  353: lcuseradd - LON-CAPA setuid script to coordinate all actions
  354:             with adding a user with filesystem privileges (e.g. author)
  355: 
  356: =head1 README
  357: 
  358: lcuseradd - LON-CAPA setuid script to coordinate all actions
  359:             with adding a user with filesystem privileges (e.g. author)
  360: 
  361: =head1 PREREQUISITES
  362: 
  363: =head1 COREQUISITES
  364: 
  365: =pod OSNAMES
  366: 
  367: linux
  368: 
  369: =pod SCRIPT CATEGORIES
  370: 
  371: LONCAPA/Administrative
  372: 
  373: =cut