mirror of
https://github.com/LDAPAccountManager/lam.git
synced 2025-10-03 09:49:16 +02:00
Merge pull request #447 from LDAPAccountManager/feature/424-dh_link
#443 run userdel.local before directory is removed
This commit is contained in:
gruberroland
GitHub
commit
9e00898eb5
3 changed files with 167 additions and 167 deletions
|
|
@ -1,4 +1,5 @@
|
|||
September 2025 9.3
|
||||
- Lamdaemon: run /usr/sbin/userdel.local before (and no longer after) home directory is deleted (443)
|
||||
- LAM Pro:
|
||||
-> SMS support for password sending and password self-reset (441)
|
||||
|
||||
|
|
|
|||
|
|
@ -1,55 +1,52 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
|
||||
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
|
||||
<appendix id="a_lamdaemon">
|
||||
<title>Setup for home directory and quota management</title>
|
||||
<appendix id="a_lamdaemon">
|
||||
<title>Setup lamdaemon for home directory and quota management</title>
|
||||
|
||||
<para>Lamdaemon.pl is used to modify quota and home directories on a
|
||||
remote or local host via SSH (even if homedirs are located on
|
||||
localhost).</para>
|
||||
<para>Lamdaemon.pl is used to modify quota and home directories on a remote
|
||||
or local host via SSH (even if homedirs are located on localhost).</para>
|
||||
|
||||
<para>If you want wo use it you have to set up the following things to get
|
||||
<para>If you want to use it you have to set up the following things to get
|
||||
it to work:</para>
|
||||
|
||||
<section>
|
||||
<title>Installation</title>
|
||||
<para><emphasis role="bold">Installation</emphasis></para>
|
||||
|
||||
<para>First of all, you need to install lamdaemon.pl on your remote
|
||||
server where LAM should manage homedirs and/or quota. This is usually a
|
||||
different server than the one where LAM is installed. But there is no
|
||||
problem if it is the same.</para>
|
||||
<para>First of all, you need to install lamdaemon.pl on your remote server
|
||||
where LAM should manage homedirs and/or quota. This is usually a different
|
||||
server than the one where LAM is installed. But there is no problem if it is
|
||||
the same.</para>
|
||||
|
||||
<screenshot>
|
||||
<mediaobject>
|
||||
<imageobject>
|
||||
<imagedata fileref="images/lamdaemonServers.png" />
|
||||
<imagedata fileref="images/lamdaemonServers.png"/>
|
||||
</imageobject>
|
||||
</mediaobject>
|
||||
</screenshot>
|
||||
|
||||
<para></para>
|
||||
<para/>
|
||||
|
||||
<para><emphasis role="bold">Debian based (e.g. also
|
||||
Ubuntu)</emphasis></para>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>Debian based (e.g. also Ubuntu): Please install the lamdaemon DEB
|
||||
package on your quota/homedir server.</para>
|
||||
</listitem>
|
||||
|
||||
<para>Please install the lamdaemon DEB package on your quota/homedir
|
||||
server.</para>
|
||||
<listitem>
|
||||
<para>RPM based (Fedora, CentOS, Suse, ...): Please install the
|
||||
lamdaemon RPM package on your quota/homedir server.</para>
|
||||
</listitem>
|
||||
|
||||
<para><emphasis role="bold">RPM based (Fedora, CentOS, Suse,
|
||||
...)</emphasis></para>
|
||||
|
||||
<para>Please install the lamdaemon RPM package on your quota/homedir
|
||||
server.</para>
|
||||
|
||||
<para><emphasis role="bold">Other</emphasis></para>
|
||||
|
||||
<para>Please copy lib/lamdaemon.pl from the LAM tar.bz2 package to your
|
||||
quota/homedir server. The location may be anywhere (e.g. use
|
||||
<listitem>
|
||||
<para>Other: Please copy lib/lamdaemon.pl from the LAM tar.bz2 package
|
||||
to your quota/homedir server. The location may be anywhere (e.g. use
|
||||
/opt/lamdaemon). Please make the lamdaemon.pl script executable.</para>
|
||||
</section>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<section id="a_lamdaemonConf">
|
||||
<title>LDAP Account Manager configuration</title>
|
||||
<para><emphasis role="bold">LAM server profile
|
||||
configuration</emphasis></para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
|
|
@ -58,84 +55,76 @@
|
|||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Path to lamdaemon.pl, e.g.
|
||||
/srv/www/htdocs/lam/lib/lamdaemon.pl If you installed a DEB or
|
||||
RPM package then the script will be located at
|
||||
<para>Path to lamdaemon.pl, e.g. /srv/www/htdocs/lam/lib/lamdaemon.pl If
|
||||
you installed a DEB or RPM package then the script will be located at
|
||||
/usr/share/ldap-account-manager/lib/lamdaemon.pl.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Your LAM admin user must be a valid Unix account. It needs to
|
||||
have the object class "posixAccount" and an attribute "uid". This
|
||||
account must be accepted by the SSH daemon of your home directory
|
||||
server. Do not create a second local account but change your system
|
||||
to accept LDAP users. You can use LAM to add the Unix account part
|
||||
to your admin user or create a new account. Please do not forget to
|
||||
setup LDAP write access (<ulink
|
||||
<para id="a_lamdaemonConf">Your LAM admin user must be a valid Unix
|
||||
account. It needs to have the object class "posixAccount" and an
|
||||
attribute "uid". This account must be accepted by the SSH daemon of your
|
||||
home directory server. Do not create a second local account but change
|
||||
your system to accept LDAP users. You can use LAM to add the Unix
|
||||
account part to your admin user or create a new account. Please do not
|
||||
forget to setup LDAP write access (<ulink
|
||||
url="http://www.openldap.org/doc/admin24/access-control.html">ACLs</ulink>)
|
||||
if you create a new account.</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para></para>
|
||||
<para/>
|
||||
|
||||
<screenshot>
|
||||
<mediaobject>
|
||||
<imageobject>
|
||||
<imagedata fileref="images/lamdaemon.png" />
|
||||
<imagedata fileref="images/lamdaemon.png"/>
|
||||
</imageobject>
|
||||
</mediaobject>
|
||||
</screenshot>
|
||||
|
||||
<para>Note that the builtin admin/manager entries do not work for
|
||||
lamdaemon. You need to login with a Unix account.</para>
|
||||
<para>Note that the builtin admin/manager entries do not work for lamdaemon.
|
||||
You need to login with a Unix account.</para>
|
||||
|
||||
<screenshot>
|
||||
<mediaobject>
|
||||
<imageobject>
|
||||
<imagedata fileref="images/lamdaemon1.png" />
|
||||
<imagedata fileref="images/lamdaemon1.png"/>
|
||||
</imageobject>
|
||||
</mediaobject>
|
||||
</screenshot>
|
||||
|
||||
<para><emphasis role="bold">OpenLDAP ACL location:</emphasis></para>
|
||||
<para><emphasis role="bold">OpenLDAP ACL location</emphasis></para>
|
||||
|
||||
<para>The access rights for OpenLDAP are configured in
|
||||
/etc/ldap/slapd.conf or
|
||||
/etc/ldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif.</para>
|
||||
</section>
|
||||
<para>The access rights for OpenLDAP are configured in /etc/ldap/slapd.conf
|
||||
or /etc/ldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif.</para>
|
||||
|
||||
<section>
|
||||
<title>Setup sudo</title>
|
||||
<para><emphasis role="bold">Setup sudo</emphasis></para>
|
||||
|
||||
<para>The perl script has to run as root. Therefore we need a wrapper,
|
||||
sudo. Edit /etc/sudoers on host where homedirs or quotas should be used
|
||||
and add the following line:</para>
|
||||
<para>The perl script has to run as root. Therefore we need a wrapper, sudo.
|
||||
Edit /etc/sudoers on host where homedirs or quotas should be used and add
|
||||
the following line:</para>
|
||||
|
||||
<para>$admin All= NOPASSWD: $path_to_lamdaemon *</para>
|
||||
|
||||
<para><emphasis condition="">$admin</emphasis> is the admin user from
|
||||
LAM (must be a valid Unix account) and
|
||||
<emphasis>$path_to_lamdaemon</emphasis> is the path to
|
||||
lamdaemon.pl.</para>
|
||||
<para><emphasis condition="">$admin</emphasis> is the admin user from LAM
|
||||
(must be a valid Unix account) and <emphasis>$path_to_lamdaemon</emphasis>
|
||||
is the path to lamdaemon.pl.</para>
|
||||
|
||||
<para><emphasis role="bold">Example:</emphasis></para>
|
||||
<para>Example:</para>
|
||||
|
||||
<para>myAdmin ALL= NOPASSWD: /srv/www/htdocs/lam/lib/lamdaemon.pl
|
||||
*</para>
|
||||
<para>myAdmin ALL= NOPASSWD: /srv/www/htdocs/lam/lib/lamdaemon.pl *</para>
|
||||
|
||||
<para>You might need to run the sudo command once manually to init sudo.
|
||||
The command "sudo -l" will show all possible sudo commands of the
|
||||
current user.</para>
|
||||
<para>You might need to run the sudo command once manually to init sudo. The
|
||||
command "sudo -l" will show all possible sudo commands of the current
|
||||
user.</para>
|
||||
|
||||
<para><emphasis role="bold">Attention:</emphasis> Please do not use the
|
||||
options "Defaults requiretty" and "Defaults env_reset" in /etc/sudoers.
|
||||
Otherwise you might get errors like "you must have a tty to run sudo" or
|
||||
"no tty present and no askpass program specified".</para>
|
||||
</section>
|
||||
Otherwise you might get errors like "you must have a tty to run sudo" or "no
|
||||
tty present and no askpass program specified".</para>
|
||||
|
||||
<section>
|
||||
<title>Setup Perl</title>
|
||||
<para><emphasis role="bold">Setup Perl</emphasis></para>
|
||||
|
||||
<para>We need an extra Perl module - Quota. To install it, run:</para>
|
||||
|
||||
|
|
@ -145,41 +134,53 @@
|
|||
<member>install Quota</member>
|
||||
</simplelist>
|
||||
|
||||
<para>If your Perl executable is not located in /usr/bin/perl you will
|
||||
have to edit the path in the first line of lamdaemon.pl. If you have
|
||||
problems compiling the Perl modules try installing a newer release of
|
||||
your GCC compiler and the "make" application.</para>
|
||||
<para>If your Perl executable is not located in /usr/bin/perl you will have
|
||||
to edit the path in the first line of lamdaemon.pl. If you have problems
|
||||
compiling the Perl modules try installing a newer release of your GCC
|
||||
compiler and the "make" application.</para>
|
||||
|
||||
<para>Several Linux distributions already include a quota package for
|
||||
Perl.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Set up SSH</title>
|
||||
<para><emphasis role="bold">Set up SSH</emphasis></para>
|
||||
|
||||
<para>Your SSH daemon must offer the password authentication method. To
|
||||
activate it just use this configuration option in
|
||||
/etc/ssh/sshd_config:</para>
|
||||
|
||||
<para>PasswordAuthentication yes</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Troubleshooting</title>
|
||||
<para><emphasis role="bold">Calling of external scripts</emphasis></para>
|
||||
|
||||
<para>If you have problems managing quotas and home directories then
|
||||
these points might help:</para>
|
||||
<para>The following extra scripts are called if they exist:</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>There is a test page for lamdaemon: Login to LAM and open
|
||||
Tools -> Tests -> Lamdaemon test</para>
|
||||
<para>Create home directory: /usr/sbin/useradd.local <USER NAME>
|
||||
(after directory was created)</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Delete home directory: /usr/sbin/userdel.local <USER NAME>
|
||||
(before directory is removed)</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para><emphasis role="bold">Troubleshooting</emphasis></para>
|
||||
|
||||
<para>If you have problems managing quotas and home directories then these
|
||||
points might help:</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>There is a test page for lamdaemon: Login to LAM and open Tools
|
||||
-> Tests -> Lamdaemon test</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Check /var/log/auth.log or its equivalent on your system. This
|
||||
file contains messages about all logins. If the ssh login failed
|
||||
then you will find a description about the reason here.</para>
|
||||
file contains messages about all logins. If the ssh login failed then
|
||||
you will find a description about the reason here.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
|
|
@ -196,10 +197,8 @@
|
|||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>Error message <emphasis role="bold">"Your LAM admin user (...)
|
||||
must be a valid Unix account to work with lamdaemon!"</emphasis>: This
|
||||
happens if you use the default LDAP admin/manager user to login to LAM.
|
||||
Please see <link linkend="a_lamdaemonConf">here</link> and setup a Unix
|
||||
account.</para>
|
||||
</section>
|
||||
</appendix>
|
||||
<para>Error message <emphasis role="bold">"Your LAM admin user (...) must be
|
||||
a valid Unix account to work with lamdaemon!"</emphasis>: This happens if
|
||||
you use the default LDAP admin/manager user to login to LAM. Please see
|
||||
<link linkend="a_lamdaemonConf">here</link> and setup a Unix account.</para>
|
||||
</appendix>
|
||||
|
|
|
|||
|
|
@ -264,10 +264,10 @@ sub removeHomedir {
|
|||
($<, $>) = ($>, $<); # Get root privileges
|
||||
if (-d $vals[3] && $vals[3] ne '/') {
|
||||
if ((stat($vals[3]))[4] eq $vals[4]) {
|
||||
system 'rm', '-Rf', $vals[3]; # delete home directory
|
||||
if (-e '/usr/sbin/userdel.local') {
|
||||
system '/usr/sbin/userdel.local', $vals[0];
|
||||
}
|
||||
system 'rm', '-Rf', $vals[3]; # delete home directory
|
||||
$return = "Ok";
|
||||
logMessage(LOG_INFO, "Home directory removed (" . $vals[3] . ")");
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue