How would I go about regularly copying user account data from /etc/passwd on one machine into LDAP?

The situation I'm in is that I'm the sysadmin for an academic computer cluster. We have one master node where all of our users log in to submit jobs and a few dozen compute nodes where the jobs are executed. Users are authenticated locally on the master node and I set up LDAP for authentication on the nodes.

Right now, whenever I create a user I have to manually copy over their account data to LDAP. The same has to happen whenever a user changes their password or has group membership change. I'd like to create a cronjob to automate this for me. Given that this feels like a sort of common sysadmin task I'd expect that there is a script already existing that will do this. However, I haven't found anything in my searches. Additionally, I realized that running an ldapmodify command requires authentication and so it can't just be run in cron. How do people get around this in their systems?

  • I would think this is solved in most cases by having all nodes use the same authentication database. Is there a reason the master node has to use the local /etc/passwd database instead of LDAP? If the master node has to be separate, I would think you could create a script on the master node that would add both the local user and LDAP user at the same time. – GracefulRestart Apr 16 '20 at 1:49

It's not by ldap but I suggest installing salt, which is fairly simple, then manage the users (and why not, everything else too) from a simple text file. In a TL;DR you install salt-master in your server, salt-client everywhere else then edit the text file with the list of users once and run salt apply. This takes little time to setup and has great benefits. References: - Users management with salt: https://docs.saltstack.com/en/master/ref/states/all/salt.states.user.html - Salt in 10 minutes: https://docs.saltstack.com/en/master/topics/tutorials/walkthrough.html

And again, once you have this you'll puppeteer everything in the cluster, it's really nice.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.