1

Following the instructions at this nice walkthrough here.

I have successfully configured my CentOS 6.5 Server to authenticate with my domain. Additionally, it only allows domain users of the group domain-ssh-users to login via SSH. There is one more piece I need for my puzzle.

When a domain user logs in via SSH for the first time, a home directory is automatically created for them (as per the walkthrough I posted above). For all home directories that are created for these domain users of group domain-ssh-users, but not for local users, I want a specific .bash_profile to be created. The "easy" part of this is that the .bash_profile will be identical for all domain-ssh-users.

Can anyone give me any clue how to go about doing this?

Edit: Difference in environment variables between local and domain logins.

Everything is pretty much the same except for these differences (obfuscated for security).

Local User:

PATH=/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/LOCALUSER/bin
PWD=/home/LOCALUSER
HOME=/home/LOCALUSER
LOGNAME=LOCALUSER

Domain User:

PATH=/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/home/local.mydomainname.com/DOMAINUSER/bin
PWD=/home/local.mydomainname.com/DOMAINUSER
KRB5CCNAME=FILE:/tmp/krb5cc_gibberish_8839
HOME=/home/local.mydomainname.com/DOMAINUSER

So... um maybe this is super easy. Can I have the bash creation script use a different bash_profile dependent on whether or not the user is in /home or in /home/local.mydomainname.com ?

Edit2:

So, I tried creating this .bash_profile as a test and put it in the /home directories of both a local and domain user:

# .bash_profile

# Get the aliases and functions
if [ -f ~/.bashrc ]; then
       . ~/.bashrc
fi

env='env'

# User specific environment and startup programs

PATH=$PATH:$HOME/bin

export PATH

if echo $env grep -q "local.mydomain.com"
       then
               umask 000
               /domain/menu.sh
               clear;exit
fi

But now when I login as either the local user or the domain user, it launches menu.sh. I'm new to this .bash_profile creation so I'm sure I'm missing something simple.

1

Place the .bash_profile file in /etc/skel/. It's basically a template directory for new user profiles. Anything in there gets copied into $HOME when a new user is created and they have a $HOME dir. It's similar to a default profile in Windows.

To use the same file for remote and local users, look for a variable that only remote users have set and include a test for that in functions/settings you want to apply to them. Something similar to SSH_CLIENT or SSH_TTY

if [[ $SSH_CLIENT ]]; then
    setup foo for a remote user
else
    setup foo for a local user
fi
  • Any idea how I can test for whether a connecting user is 1. A member of a domain 2. A member of a specific domain security group (in this case: domain-ssh-users) – Daniel Oct 2 '14 at 13:43
  • 1
    As a domain user, run env and see what environment variables are set then do the same as a local user and compare the results for differences – Creek Oct 2 '14 at 14:08
  • Added edit with env variables to original post. – Daniel Oct 4 '14 at 2:35
  • the '/etc/skel/' directory is empty. From where does CentOS generate the default .bash_profile? – Daniel Oct 5 '14 at 2:48
  • @Daniel It's defined in /etc/default/useradd – Creek Oct 5 '14 at 3:02
0

/etc/profile.d/ directory contains scripts that run on user_login. Create a script here to generate bash profile.

#!/bin/bash
export your environment variables here
or invoke a script that generates bash profile.

The bash_profile location should be located within the user's directory, i.e. (/home/usr/.bash_profile)

A bash_profile, generally, is a list of exported environment variables (i.e., paths...)

export VARENV="/path/to/object/"
  • This sounds good, but I need to apply the bash profile ONLY to domain users (NOT to local users) and ONLY to domain users of the group domain-ssh-users – Daniel Oct 2 '14 at 13:45
  • Ah, I understand that you are requiring a SAMBA-specific solution to Domain O/S interoperability. – Tyler Maginnis Oct 2 '14 at 13:48
0

SAMBA Manual Page to Synchronize User Accounts with Domain

SAMBA Mailing List:: Checking the Status of a Domain User against Active Directory D(omain)/C(ontroller)

One way I see to accomplish this task is to place a script within the /profile.d/ directory indicated in my other answer.

Test for domain membership and user status, then depending on results of query, fulfill your requirement, or if user does not meet Domain Privilege Requirement, do not create a bash_profile.

Bash Console Command

$> getent group

Output

Domain Admins:x:512:root
Domain Users:x:513:jht,lct,ajt,met,vlendecke
Domain Computers:x:553:
... ...
domain-ssh-users:x:55X:harry,mark,john

Testing Domain Group Membership

DOMAIN_GROUPS=`getent group`
USERS_DOMAIN_SSH=`echo $DOMAIN_GROUPS | grep "domain-ssh-users" | sed 's/domain-ssh-users:x:55X://g`
USER=`last | head -n 1`
if [ `echo $DOMAIN_GROUPS | grep $USER` ]
then
#... Do add bash_profile.
else
#... Do not add bash_profile.
exit
fi

This is hacky, but workable...

DOMAIN_GROUPS assignment lists domain groups and users associated. USER_DOMAIN_SSH reads DOMAIN_GROUPS, strips everything except for the line of domain-ssh-users, and stream text processing strips everything except for comma delineated users. USER checks the last users to login and reads the absolute latest login.

The test checks the DOMAIN_GROUPS string for the USER.

Example of SAMBA Path Exports

if [ $TEST_DOMAIN_USER_ACCESS_LEVEL ]
then
export PATH='/usr/local/samba/bin:\
/usr/local/samba/sbin:$PATH' >> /home/domain/user/.bash_profile && echo OK
else
exit
fi

SAMBA Group Management

profile.d script

#!/bin/bash
env=`env`
#Store env to string then test for domain membership...
if echo $env grep -q "local.mydomainname.com"
  then
    user=`cat /var/log/auth | grep LOGIN | grep -o '.\{0,0\}:.\{0,100\} | sed 's/: //g' | grep -Eo '^[^ ]`
    # There's a step ^^ missing in this assignment to grab the first line matching a pattern. So here we are checking what user to build for.
    echo "Line 1 of ~/.bashrc" >> /home/mydomain/$user
    echo "Line 2 of ~/.bashrc" >> /home/mydomain/$user
  else
    echo "Do not build a ~./bashrc for non-domain users"
fi
  • I clicked your link, but didn't see anything specifically helpful. Your script looks like exactly what I need, except that the devil is in the details. I need help with the $TEST_DOMAIN_USER_ACCESS_LEVEL part. I don't really have any clue how to start the syntax to test if a user is a member of a specific domain and specific domain group. – Daniel Oct 2 '14 at 14:00
  • I think I can help you with that. – Tyler Maginnis Oct 2 '14 at 14:07
  • OK, so here is the first roadblock. When I do getent group I get a list of what seem to be all the groups local to the machine. I am not seeing any group called domain-ssh-users. Remember, this is a domain security group I am trying to match against. I have not created it on the local machine. – Daniel Oct 3 '14 at 2:11
  • You need to synchronize with your domain... I placed the link at the top of my Answer to the Manual page... That page should have everything you need to know about synchronizing the users, so that your domain-users can login. Then test for the user with getent because the sync will have written the users to the file. The complexity here is scaled because we are inter-operating-systems. – Tyler Maginnis Oct 3 '14 at 3:05
  • Since I followed the walkthrough which I mentioned above, somehow my CentOS server is already aware of domain groups because it does not allow any SSH login from a group other than domain-ssh-users. I was hoping there was someway I could use a similar method to create the bash profile. But I guess I have to bring over all the users and group info to the CentOS box? – Daniel Oct 3 '14 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.