Return to make_domain_coordinator.pl CVS log

Up to [LON-CAPA] / loncom / build

BUG 853 FIXED; when trying to transform an existing user into a domain
coordinator, a manual procedure is recommended (given the architectural
and security importance of a domain coordinator, I only want to generate
it automatically if the operating system conditions are perfectly known;
this is also an initial step in installing a LON-CAPA system at an institution;
therefore it must work 100% perfectly for both public-relations reasons
and to avoid compounding potential errors); documentation improvements and
a little beautification; warning and error messages are improved

    1: #!/usr/bin/perl
    2: 
    3: =pod
    4: 
    5: =head1 NAME
    6: 
    7: make_domain_coordinator.pl - Make a domain coordinator on a LON-CAPA system
    8: 
    9: =cut
   10: 
   11: # The LearningOnline Network
   12: # make_domain_coordinator.pl - Make a domain coordinator on a system
   13: #
   14: # $Id: make_domain_coordinator.pl,v 1.7 2002/10/12 16:23:21 harris41 Exp $
   15: #
   16: # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
   17: #
   18: # LON-CAPA is free software; you can redistribute it and/or modify
   19: # it under the terms of the GNU General Public License as published by
   20: # the Free Software Foundation; either version 2 of the License, or
   21: # (at your option) any later version.
   22: #
   23: # LON-CAPA is distributed in the hope that it will be useful,
   24: # but WITHOUT ANY WARRANTY; without even the implied warranty of
   25: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   26: # GNU General Public License for more details.
   27: #
   28: # You should have received a copy of the GNU General Public License
   29: # along with LON-CAPA; if not, write to the Free Software
   30: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
   31: #
   32: # /home/httpd/html/adm/gpl.txt
   33: #
   34: # http://www.lon-capa.org/
   35: #
   36: # YEAR=2002
   37: # 3/1,3/3,3/4 Scott Harrison
   38: # 10/12 Scott Harrison
   39: #
   40: ###
   41: 
   42: =pod
   43: 
   44: =head1 DESCRIPTION
   45: 
   46: Automates the steps for domain coordinator creation.  This
   47: program also describes a manual procedure (see below).
   48: 
   49: These are the steps that are executed on the linux operating system:
   50: 
   51: =over 4
   52: 
   53: =item * 
   54: 
   55: Tests to see if user already exists for linux system or for
   56: LON-CAPA, if so aborts.  A message is output that recommends following
   57: a manual procedure enabling this user if so desired.
   58: 
   59: =item *
   60: 
   61: Creates a linux system user
   62: 
   63: =item *
   64: 
   65: Sets password
   66: 
   67: =item *
   68: 
   69: Creates a LON-CAPA lonUsers directory for user
   70: 
   71: =item *
   72: 
   73: Sets LON-CAPA password mechanism to be "unix"
   74: 
   75: =item *
   76: 
   77: Set roles.hist and roles.db
   78: 
   79: =back
   80: 
   81: =cut
   82: 
   83: # NOTE: I am interspersing the manual procedure with the automation.
   84: # To see the manual procedure, do perldoc ./make_domain_coordinator.pl
   85: 
   86: # This is a standalone script.  It *could* alternatively use the
   87: # lcuseradd script, however lcuseradd relies on certain system
   88: # dependencies.  In order to have a focused performance, I am trying
   89: # to avoid system dependencies until the LON-CAPA code base becomes
   90: # more robust and well-boundaried.  make_domain_coordinator.pl should be able
   91: # to run freely as possible, irrespective of the status of a LON-CAPA
   92: # installation.
   93: 
   94: # ---------------------------------------------------- Configure general values
   95: 
   96: my %perlvar; # Holds network-wide and machine-specific configuration values.
   97: # We only need one configuration value however, lonUsersDir.  Rather than
   98: # read this out of loncapa.conf, I am just going to hard-code this for now.
   99: $perlvar{'lonUsersDir'}='/home/httpd/lonUsers';
  100: 
  101: =pod
  102: 
  103: =head1 OPTIONS
  104: 
  105: There are no flags to this script.
  106: 
  107: usage: make_domain_coordinator.pl [USERNAME] [DOMAIN] 
  108: 
  109: The password is accepted through standard input
  110: and should only consist of printable ASCII
  111: characters and be a string of length greater than 5 characters.
  112: 
  113: The first argument
  114: specifies the user name of the domain coordinator and
  115: should consist of only alphanumeric characters.
  116: 
  117: The second argument specifies the domain of the computer
  118: coordinator and should consist of only alphanumeric characters.
  119: 
  120: =cut
  121: 
  122: # ----------------------------------------------- So, are we invoked correctly?
  123: # Two arguments or abort
  124: if (@ARGV!=2) {
  125:     die 'usage: make_domain_coordinator.pl [USERNAME] [DOMAIN] '."\n".
  126: 	'(and password through standard input)'."\n";
  127: }
  128: my ($username,$domain)=(@ARGV); shift @ARGV; shift @ARGV;
  129: unless ($username=~/^\w+$/ and $username!~/\_/) {
  130:     die('**** ERROR **** '.
  131: 	'Username '.$username.' must consist only of alphanumeric characters'.
  132: 	"\n");
  133: }
  134: unless ($domain=~/^\w+$/ and $domain!~/\_/) {
  135:     die('**** ERROR **** '.
  136: 	'Domain '.$domain.' must consist only of alphanumeric characters'.
  137: 	"\n");
  138: }
  139: 
  140: # Output a warning message.
  141: print('**** NOTE **** '.
  142:       'Generating a domain coordinator is "serious business".'."\n".
  143:       'Choosing a difficult-to-guess (and keeping it a secret) password '."\n".
  144:       'is highly recommended.'."\n");
  145: 
  146: print("Password: "); $|=1;
  147: my $passwd=<>; # read in password from standard input
  148: chomp($passwd);
  149: 
  150: if (length($passwd)<6 or length($passwd)>30) {
  151:     die('**** ERROR **** '.'Password is an unreasonable length.'."\n".
  152: 	'It should be at least 6 characters in length.'."\n");
  153: }
  154: my $pbad=0;
  155: foreach (split(//,$passwd)) {if ((ord($_)<32)||(ord($_)>126)){$pbad=1;}}
  156: if ($pbad) {
  157:     die('**** ERROR **** '.
  158: 	'Password must consist of standard ASCII characters'."\n");
  159: }
  160: 
  161: # And does user already exist
  162: 
  163: my $caveat =
  164:     'For security reasons, this script will only automatically generate '."\n".
  165:     'new users, not pre-existing users.'."\n".
  166:     "If you want to make '$username' a domain coordinator, you "."\n".
  167:     'should do so manually by customizing the MANUAL PROCEDURE'."\n".
  168:     'described in the documentation.  To view the documentation '."\n".
  169:     'for this script, type '.
  170:     "'perldoc ./make_domain_coordinator.pl'."."\n";
  171: 
  172: if (-d "/home/$username") {
  173:     die ('**** ERROR **** '.$username.' is already a linux operating system '.
  174: 	 'user.'."\n".$caveat);
  175: }
  176: my $udpath=propath($domain,$username);
  177: if (-d $udpath) {
  178:     die ('**** ERROR **** '.$username.' is already defined as a LON-CAPA '.
  179: 	 'user.'."\n".$caveat);
  180: }
  181: 
  182: =pod
  183: 
  184: =head1 MANUAL PROCEDURE
  185: 
  186: There are 10 steps to manually recreating what this script performs
  187: automatically.
  188: 
  189: You need to decide on three pieces of information
  190: to create a domain coordinator.
  191: 
  192:  * USERNAME (kermit, albert, joe, etc)
  193:  * DOMAIN (should be the same as lonDefDomain in /etc/httpd/conf/loncapa.conf)
  194:  * PASSWORD (don't tell me)
  195: 
  196: The examples in these instructions will be based
  197: on three example pieces of information:
  198: 
  199:  * USERNAME=dc103
  200:  * DOMAIN=103
  201:  * PASSWORD=sesame
  202: 
  203: You will also need to know your "root" password
  204: and your "www" password.
  205: 
  206: =over 4
  207: 
  208: =item 1.
  209: 
  210: login as root on your Linux system
  211:  [prompt %] su
  212: 
  213: =cut
  214: 
  215: # ------------------------------------------------------------ So, are we root?
  216: 
  217: if ($< != 0) { # Am I root?
  218:   die 'You must be root in order to generate a domain coordinator.'."\n";
  219: }
  220: 
  221: =pod
  222: 
  223: =item 2 (as root). add the user
  224: 
  225:  Command: [prompt %] /usr/sbin/useradd USERNAME
  226:  Example: [prompt %] /usr/sbin/useradd dc103
  227: 
  228: =cut
  229: 
  230: # ----------------------------------------------------------- /usr/sbin/useradd
  231: 
  232: $username=~s/\W//g; # an extra filter, just to be sure
  233: `/usr/sbin/useradd $username`; # Add the user with the 'useradd' command.
  234: 
  235: =pod
  236: 
  237: =item 3 (as root). enter in a password
  238: 
  239:  Command: [prompt %] passwd USERNAME
  240:           New UNIX password: PASSWORD
  241:           Retype new UNIX passwd: PASSWORD
  242:  Example: [prompt %] passwd dc103
  243:           New UNIX password: sesame
  244:           Retype new UNIX passwd: sesame
  245: 
  246: =cut
  247: 
  248: # Process password (taint-check, then pass to the UNIX passwd command).
  249: $username =~ s/\W//g; # an extra filter, just to be sure
  250: $pbad = 0;
  251: foreach (split(//,$passwd)) {if ((ord($_)<32)||(ord($_)>126)){$pbad=1;}}
  252: if ($pbad) {
  253:     die('Password must consist of standard ASCII characters'."\n");
  254: }
  255: open(OUT,"|passwd --stdin $username");
  256: print(OUT $passwd."\n");
  257: close(OUT);
  258: 
  259: =pod
  260: 
  261: =cut
  262: 
  263: =pod
  264: 
  265: =item 4. login as user=www
  266: 
  267:  Command: [prompt %] su www
  268:  Password: WWWPASSWORD
  269: 
  270: =item 5. (as www). cd /home/httpd/lonUsers
  271: 
  272: =item 6. (as www) Create user directory for your new user.
  273: 
  274:  Let U equal first letter of USERNAME
  275:  Let S equal second letter of USERNAME
  276:  Let E equal third letter of USERNAME
  277:  Command: [prompt %] install -d DOMAIN/U/S/E/USERNAME
  278: 
  279:  Here are three examples of the commands that would be needed
  280:  for different domain coordinator names (dc103, morphy, or ng):
  281: 
  282:  Example #1 (dc103):  [prompt %] install -d 103/d/c/1/dc103
  283:  Example #2 (morphy): [prompt %] install -d 103/m/o/r/morphy
  284:  Example #3 (ng):     [prompt %] install -d 103/n/g/_/ng
  285: 
  286: =cut
  287: 
  288: # Generate the user directory.
  289: `install -o www -g www -d $udpath`; # Must be writeable by httpd process.
  290: 
  291: =pod
  292: 
  293: =item 7. (as www) Enter the newly created user directory.
  294: 
  295:  Command: [prompt %] cd DOMAIN/U/S/E/USERNAME
  296:  Example: [prompt %] cd 103/d/c/1/dc103
  297: 
  298: =item 8. (as www). Set your password mechanism to 'unix' 
  299: 
  300:  Command: [prompt %] echo "unix:" > passwd
  301: 
  302: =cut
  303: 
  304: # UNIX (/etc/passwd) style authentication is asserted for domain coordinators.
  305: open(OUT, ">$udpath/passwd");
  306: print(OUT 'unix:'."\n");
  307: close(OUT);
  308: `chown www:www $udpath/passwd`; # Must be writeable by httpd process.
  309: 
  310: =pod
  311: 
  312: =item 9. (as www). Run CVS:loncapa/doc/rolesmanip.pl:
  313: 
  314:  Command: [prompt %] perl rolesmanip.pl DOMAIN USERNAME
  315:  Example: [prompt %] perl rolesmanip.pl 103 dc103
  316: 
  317: =cut
  318: 
  319: use GDBM_File; # A simplistic key-value pairing database.
  320: my %hash;
  321: 
  322: tie(%hash,'GDBM_File',"$udpath/roles.db",
  323:     &GDBM_WRCREAT,0640); # Interface with GDBM database thru a hash variable.
  324: 
  325: $hash{'/'.$domain.'/_dc'}='dc'; # Set the domain coordinator role.
  326: open(OUT, ">$udpath/roles.hist"); # roles.hist is the synchronous plain text.
  327: map {
  328:     print(OUT $_.' : '.$hash{$_}."\n");
  329: } keys %hash;
  330: close(OUT);
  331: untie(%hash); # Finish interfacing with GDBM database.
  332: 
  333: `chown www:www $udpath/roles.hist`; # Must be writeable by httpd process.
  334: `chown www:www $udpath/roles.db`; # Must be writeable by httpd process.
  335: 
  336: =pod
  337: 
  338: =item 10.
  339: 
  340: You may further define the domain coordinator user (i.e. dc103)
  341: by going to http://MACHINENAME/adm/createuser.
  342: 
  343: =cut
  344: 
  345: # Output success message, and inform sysadmin about how to further proceed.
  346: print("$username is now a domain coordinator\n"); # Output success message.
  347: my $hostname=`hostname`; chomp($hostname); # Read in hostname.
  348: print("http://$hostname/adm/createuser will allow you to further define".
  349:       " this user.\n"); # Output a suggested URL.
  350: 
  351: # ================================================================= SUBROUTINES
  352: # Subroutine propath: take in domain and username, and generate filesystem path
  353: sub propath {
  354:     my ($udom,$uname)=@_; # The lonDefDomain, and the domain coord. username.
  355:     $udom =~ s/\W//g; # Taint removal.
  356:     $uname =~ s/\W//g; # Taint removal.
  357:     my $subdir = $uname.'__';
  358:     $subdir =~ s/(.)(.)(.).*/$1\/$2\/$3/; # The path must have three subdirs.
  359:     my $proname = "$perlvar{'lonUsersDir'}/$udom/$subdir/$uname"; # Total path.
  360:     return $proname; # Return the total user directory filesystem path.
  361: }
  362: 
  363: =pod
  364: 
  365: =head1 AUTHOR
  366: 
  367: Written to help the LON-CAPA project.
  368: 
  369: Scott Harrison, sharrison@users.sourceforge.net
  370: 
  371: =cut