Why do we automate?
Managing users and groups on a Linux system can be a tedious task, especially if you have to handle multiple accounts. Fortunately, with a bit of scripting knowledge, you can automate this process. In this article, I will walk you through a simple Bash script designed to create users, assign them to groups, and set their passwords automatically.
Why Automate User Management?
- Efficiency: Automating repetitive tasks saves time.
- Consistency: Ensures the same process is followed every time.
- Error Reduction: Minimizes the risk of human error.
New to Bash scripting?
For those trying to learn about bash scripting, kindly visit here).
Script Overview
This project had me creating a simple script that performs the following functions:
- Reads the users and groups supplied in the .txt file
- Creates the users and groups from read data
- Assigns randomly generated password to each user. Passwords are saved in
/var/secure/user_passwords.csv - Adds users to appropriate groups
- Creates a
$HOMEdirectory for each user with appropriate permission - Logs all script actions in
/var/log/user_management.logEach step will be explained.
The project's repository can be found here.
Prerequisites
Before running the script, ensure you have:
- Root privileges (the script needs to be run as root).
- An input file containing user information (e.g., employees.txt).
Detailed Explanation
Checking for Root Privileges
The script starts by checking if it is being run as root. This is crucial because user and group management operations require root permissions.It does this by verifying the$EUID variable is 0.
if [[ "$EUID" -ne 0 ]]; then
echo "Error: This script needs to run as root. Use sudo"
exit 1
fi
Creating Necessary Directories
If the required directories (/var/log and /var/secure) do not exist, the script creates them.
# Create necessary directories if they don't exist
if [ ! -d /var/log ]; then
mkdir -p /var/log
fi
if [ ! -d /var/secure ]; then
mkdir -p /var/secure
fi
Logging Function
A logging function log_message is defined to log messages with timestamps to a log file.
log_message() {
local message="$1"
echo "$(date +"%Y-%m-%d %H:%M:%S") - $message" >> $log_file
}
Validating Input Arguments
The script expects exactly one argument, the path to the employee file. If the argument is not provided or the file does not exist, it logs an error and exits.
# Check for correct number of arguments
if [ "$#" -ne 1 ]; then
arg_err="Usage: $0 <file_path>"
echo "$arg_err"
log_message "$arg_err"
exit 1
fi
employee_file=$1
# Check if the employee file exists
if [ ! -f "$employee_file" ]; then
file_missing_err="Error: File '$employee_file' not found."
echo "$file_missing_err"
log_message "$file_missing_err"
exit 1
fi
Securing the Password File
The password file is created and secures by setting correct permissions so that only the owner can read the file created for users and passwords. Permission 600 only gives the owner read privileges
# Secure password file
log_message "Securing $password_file"
if [ ! -f $password_file ]; then
echo "User,password" >> $password_file
chmod 600 $password_file
fi
Processing Users and Groups
The snippets below read the employee file line by line, processes each user and their associated groups, and performs the following operations:
- User Creation: Checks if the user exists, creates the user if not, and sets a random password.
- Group Creation: Creates a group with the same name as the user and adds the user to it. Also, adds the user to additional specified groups.
- Home Directory: Ensures the user has a home directory.
Let's break it down
- Reading the Input File The snippet below reads each line from a file, splits the line into user and groups based on the semicolon, and then trims any extra whitespace from these variables.
while IFS=';' read -r user groups; do
# Read users and groups from the .txt file
user=$(echo "$user" | xargs)
groups=$(echo "$groups" | xargs)
It also checks if there is a blank line in between entries. The condition checks if either user or groups is empty (-z checks for a zero-length string).
if [[ -z "$user" || -z "$groups" ]]; then
newline_err="Skipping invalid line in the input file"
echo "$newline_err"
log_message "$newline_err"
continue
fi
- Creating user and group array The snippet below logs and prints the user being processed, splits their groups into an array, trims any whitespace from each group, and then logs and prints the cleaned-up list of group
echo "=> Processing user: $user"
log_message "Processing user: $user"
IFS=',' read -r -a group_array <<< "$groups"
for i in "${!group_array[@]}"; do
group_array[$i]=$(echo "${group_array[$i]}" | xargs)
done
echo "=> Groups for $user: ${group_array[*]}"
log_message "Groups for $user: ${group_array[*]}
- Creating group with the same name as the user This snippet checks if a group exists, creates the group if it does not exist, and logs the actions taken
# Create group with the same name as the user
if getent group "$user" &>/dev/null; then
echo "Group $user already exists."
log_message "Group $user already exists."
else
if groupadd "$user"; then
echo "=> Group $user created."
log_message "Group $user created."
else
echo "Error creating group $user."
log_message "Error creating group $user."
continue
fi
fi
If a user exists our script logs it and moves on else the user is created and then logged.
NOTE: > /dev/null suppresses the response so that we don't have to see the output
- Creating
$HOMEdirectory for user and generating passwords This snippet handles the creation of users, including setting up their home directory and assigning a password, while logging all actions and errors appropriately
# Creating user, user's home directory and assigning a randomly generated password
echo "=> Creating user: $user..."
log_message "Creating user: $user"
if id "$user" &>/dev/null; then
echo "User $user already exists."
log_message "User $user already exists."
else
if useradd -m -s "$shell" -g "$user" "$user"; then
echo "=> User $user created with home directory /home/$user."
log_message "User $user created with home directory /home/$user."
password=$(head /dev/urandom | tr -dc A-Za-z0-9 | fold -w 16 | head -n 1)
if echo "$user:$password" | chpasswd; then
echo "$user,$password" >> $password_file
echo "=> Password set for $user"
log_message "Password set for $user"
else
echo "Error setting password for $user."
log_message "Error setting password for $user."
continue
fi
else
echo "Error creating user $user."
log_message "Error creating user $user."
continue
fi
fi
The if useradd -m -s "$shell" -g "$user" "$user" attempts to create a new user with a home directory (-m), specified shell (-s "$shell"), and primary group (-g "$user").
password=$(head /dev/urandom | tr -dc A-Za-z0-9 | fold -w 16 | head -n 1) generates a random 16-character password using urandom.
if echo "$user:$password" | chpasswd; then sets the generated password for the user using the chpasswd command.
Finally, echo "$user,$password" >> $password_file appends the user and their password to the specified password file.
- Adding user to specified groups This snippet processes each user and adds them to the specified groups, creating the groups if they don't already exist
for group in "${group_array[@]}"; do
if getent group "$group" &>/dev/null; then
echo "Group $group already exists."
log_message "Group $group already exists."
else
if groupadd "$group"; then
echo "Group $group created."
log_message "Group $group created."
else
echo "Error creating group $group."
log_message "Error creating group $group."
continue
fi
fi
if usermod -aG "$group" "$user"; then
echo "=> Added $user to group $group."
log_message "Added $user to group $group."
else
echo "Error adding $user to group $group."
log_message "Error adding $user to group $group."
continue
fi
done
It loops through the group, groups that don't exist are created with the groupadd command.
if usermod -aG "$group" "$user" attempts to add the user to the group. It throws an error if the user is already a member of the group
- End of Loop and File Processing
echo "--------------------"
done < "$employee_file"
echo "--------------------" prints a separator line for clarity in the output.
done < "$employee_file" continues processing the next user and group pairs from the employee_file.
The complete script looks like this
while IFS=';' read -r user groups; do
# Read users and groups from the .txt file
user=$(echo "$user" | xargs)
groups=$(echo "$groups" | xargs)
if [[ -z "$user" || -z "$groups" ]]; then
newline_err="Skipping invalid line in the input file"
echo "$newline_err"
log_message "$newline_err"
continue
fi
echo "=> Processing user: $user"
log_message "Processing user: $user"
IFS=',' read -r -a group_array <<< "$groups"
for i in "${!group_array[@]}"; do
group_array[$i]=$(echo "${group_array[$i]}" | xargs)
done
echo "=> Groups for $user: ${group_array[*]}"
log_message "Groups for $user: ${group_array[*]}"
# Create group with the same name as the user
if getent group "$user" &>/dev/null; then
echo "Group $user already exists."
log_message "Group $user already exists."
else
if groupadd "$user"; then
echo "=> Group $user created."
log_message "Group $user created."
else
echo "Error creating group $user."
log_message "Error creating group $user."
continue
fi
fi
# Creating user, user's home directory and assigning a randomly generated password
echo "=> Creating user: $user..."
log_message "Creating user: $user"
if id "$user" &>/dev/null; then
echo "User $user already exists."
log_message "User $user already exists."
else
if useradd -m -s "$shell" -g "$user" "$user"; then
echo "=> User $user created with home directory /home/$user."
log_message "User $user created with home directory /home/$user."
password=$(head /dev/urandom | tr -dc A-Za-z0-9 | fold -w 6 | head -n 1)
if echo "$user:$password" | chpasswd; then
echo "$user,$password" >> $password_file
echo "=> Password set for $user"
log_message "Password set for $user"
else
echo "Error setting password for $user."
log_message "Error setting password for $user."
continue
fi
else
echo "Error creating user $user."
log_message "Error creating user $user."
continue
fi
fi
# Add the user to other specified groups
for group in "${group_array[@]}"; do
if getent group "$group" &>/dev/null; then
echo "Group $group already exists."
log_message "Group $group already exists."
else
if groupadd "$group"; then
echo "Group $group created."
log_message "Group $group created."
else
echo "Error creating group $group."
log_message "Error creating group $group."
continue
fi
fi
if usermod -aG "$group" "$user"; then
echo "=> Added $user to group $group."
log_message "Added $user to group $group."
else
echo "Error adding $user to group $group."
log_message "Error adding $user to group $group."
continue
fi
done
echo "--------------------"
done < "$employee_file"
Conclusion
This project has taught me a lot about Linux permission system, user and group management, loops, conditionals and file manipulation in bash. For those interested in putting their skills to the test, you can head over to HNG Internship where they accept DevOps interns. It is totally free but a premium version is available, visit here for more info.
P.S: Any feedback will be appreciated. Thank you for reading.
Top comments (0)