0

I need to add Centrify/AD accounts to local root groups, which is why I need to manually edit /etc/group as the AD accounts are not recognized via adding the "proper" way, across all of our servers comprised of Linux and AIX. I have the Linux portion working:

LGRP=`grep wheel /etc/group`

ACCT="cycoprts"

sed -i "s/${LGRP}/&,${ACCT}/" /etc/group

sed -i "s/${LGRP}/&${ACCT}/" /etc/group

The first command adds in a comma if there is an existing entry in /etc/group, the second command skips the comma if there are no other users added to the group.

When I test the same command in AIX (without the -i since it's AIX), I get the following (I'm not actually testing with /etc/group, using /etc/test on my end as a "dummy" test file):

AGRP=`grep w3b3root /etc/group`

ACCT1="cycorpad"

root@xxxxxxxxxxx:/etc$ sed "s/${AGRP}/&${ACCT1}/" /etc/group

sed: 0602-404 Function /w3b3root:!:16:/&cycorpad/ cannot be parsed**

Any ideas?

Improve this question
7
  • You have /s at the start, which I presume should be s/ (unless you've made a typo transferring the command to your post).
    – bxm
    Commented Dec 8, 2022 at 18:56
  • There is a typo in the sed command. Did you mean sed "s/${AGRP}/&${ACCT1}/" /etc/group? Maybe use set -x to see the commands that actually get executed. Just in case: Please copy&paste the exact command you used on your system. You might introduce or remove errors when you re-type it here.
    – Bodo
    Commented Dec 8, 2022 at 18:57
  • Yep, I typo'ed it when typing in the post. I'm not posting from my work laptop, so I manually typed in everything
    – Dana
    Commented Dec 8, 2022 at 19:00
  • root@xxxxxxx:/etc$ set -x root@xxxxxxx:/etc$ sed "s/${AGRP}\/&${ACCT1}/" /etc/test + sed s/w3b3root:!:16:\/&cycorpad/ /etc/test sed: 0602-404 Function s/w3b3root:!:16:\/&cycorpad/ cannot be parsed. root@xxxxxxx:/etc$
    – Dana
    Commented Dec 8, 2022 at 19:04
  • Worth noting: groups in Active Directory can be nested (i.e. a group can be a member of another group), but groups in unix cannot be nested. Many years ago I had to write a perl script to recursively expand AD nested groups to create a unix groups file (because the people running the university's AD server wouldn't install the AD unix extensions so I had to DIY for my faculty's linux servers). I used libnss-extrausers rather than modifying /etc/groups directly.
    – cas
    Commented Dec 9, 2022 at 4:53

2 Answers 2

Reset to default
0

First of all, removing the unsupported "-i" means, that results are NOT written back to the file - instead it'll likely just print the result of modification to stdout.

To fix this:

Either have a look, if the AIX machines have "gsed" installed, and make sure to use gsed instead of sed on AIX and of course put the "-i" back in.

Or write the output of sed to a temp-file, and afterwards move the temp file back to the original file...

Note: don't redirect stdout directly to the same file, or it will be emptied before it's contents are seen by "sed".

Improve this answer
8
  • PS: in sed "s/${AGRP}\/&${ACCT1}/" /etc/test there is a bad backslash before the middle slash.
    – avl42
    Commented Dec 9, 2022 at 1:25
  • one more thing: AGRP="$(grep ^w3b3root /etc/group)" will likely give you a little less headache.
    – avl42
    Commented Dec 9, 2022 at 1:27
  • While I've never had an issue using the "old school" back ticks, I updated the variable with the parens and entered the command in your first comment - still getting the "cannot be parsed" error. Our AIX servers do not have gsed installed.
    – Dana
    Commented Dec 12, 2022 at 16:57
  • In that case then you need the "Or"-part of my answer: You need to redirect each sed's output to a temp-file, and then, in a separate step, move the temp-file back onto the original. (That is, what "-i" essentially does in gnu version of "sed" on linux, and installable as "). -- The point is: just leaving out the "-i" will leave the original files unchanged - you have to manually write the stdout of sed back to the file, but mind the "Note:" in the answer.
    – avl42
    Commented Dec 12, 2022 at 18:00
  • the "cannot be parsed" error also needs to be fixed. As I mentioned in first comment to this answer, the parse error only came up with a variant, where you had an extra backslash in it.
    – avl42
    Commented Dec 12, 2022 at 18:02
0

Don't use the GNUism "-i", which is not part of what what the POSIX standard prescribes for sed. It is dangerous anyway.

Second, you shouldn't modify /etc/group this way anyway. AIX has the chuser command and the chgrp command and I suggest you use these. If you want to add a user to a certain group i suggest you consult the man-page of chuser.

Furthermore, there is no "wheel" group in standard AIX, this is not a Linux system! The group with GID 0 (I suppose this is what you look for) is called "system".

Improve this answer
2
  • We have both AIX AND Linux servers - I have the Linux portion working, as noted above. Second, these are AD accounts being added to local grounds - you cannot run chuser and chgrp, the commands do not see the accounts.....so as I stated in my first post, you have to manually edit /etc/group.
    – Dana
    Commented Dec 12, 2022 at 16:29
  • @Dana: "Active Directory" is basically a dumbed-down LDAP with Kerberos V for authentication. Here is the IBM documentation: ibm.com/support/pages/…
    – bakunin
    Commented Dec 16, 2022 at 14:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .