User Management

How to create an account

1. Create it via Gosa(https://gosa.ps.uni-saarland.de/), use the appropiate Template

2. Edit the description key in the LDAP-Database if necessary. Gosa will create something like "@created=<today>, @puc=<primary user group>". This is done using the /usr/local/sbin/gosa-postcreate script, which will also create the home directory and set the quotas appropriatly.

3. For researchers, add the user manually to the ps-r group.

Technical details

The script is called as a post-create hook of the "userManagement" plugin. From the /etc/gosa/gosa.conf file:

<plugin acl="users/posixAccount" class="userManagement" postcreate="/usr/bin/sudo /usr/local/sbin/gosapostcreate %uid %gidNumber" />

It does 3 things:

1. It creates the users home directory
2. It sets the quota, using the quota values of the corresponding template user (e.g. ps-m-template)
3. It creates the description message with "puc" and "created" values

How to create an account manually (i.e. without gosa)

• In the following commands it is assumed that you want to create the user "mancreated"

Create the mailbox

• In cyradm enter:

            cm user.mancreated
            setquota user.mancreated <quota in KB>

Create the UNIX user

• # useradd mancreated Make sure that you choose a free UID, because useradd won't notice the UIDs that are only mentioned in the LDAP.

Enter the necessary LDAP entries

TODO write this part (the mancreated mailbox currently exists on the system, while the UNIX user doesn't)

How to delete an account

1. cd  /root/bin
   ./delete-account NAME > remove-NAME.sh

This may take a while since the script searches in the whole filesystem for files of the user NAME. The generated script should perform the following tasks:

• create a tar.gz containing copy of home directory and mail directory of the user and store it in /var/backups/
• make root the owner of all files of the user NAME
• save the users home page (~username) to /srv/ps/httpd/html/old_user_pages/~username. Apache is configured in such a way, that any access to ps.uni-saarland.de/~username looks in this directory if it can't find the /home/username/public_html directory. This means that the users web pages will continue to work

2. check the generated script and modify it, if necessary
3. execute this script
4. remove the user via GOsa

How to modify user files

For modifying all files of a user, the script  /root/bin/apply_to_files.sh may be useful. For example,  /root/bin/apply_to_files.sh kalleb ps-m 'chgrp ps-g' > modify_kalleb.sh generates a script, that applies the command chgrp ps-g FILE to all files that are owned by user kalleb and belong to the group ps-m.

Bugs: The script  /root/bin/apply_to_files.sh currently has problems with broken symlinks and filenames that contain brackets or quotes.

Common modifications to users

Elevate current student account to lab member account

• Change the group from ps-s to ps-m in gosa

• on james use the modify script mentioned above to adjust all files owned by the user to the new group. Review the generated script carefully, we only want to adjust files that previously belonged to the users default group ps-s, usually those in his home directory. Files elsewhere may require special treatment.

• Once a uds-account has been created, adjsut mail forwarding in gosa to direct mails to the zimbra account.
• Request access for new account to the group file share from HIZ.
• Add to ps-r group.

Demote former member account to guest account

• Change the group from ps-m to ps-g in gosa

• configure mailforward to external mail (ask user), as zimbra will expire

• on james use the modify script mentioned above to adjust all files owned by the user to the new group. Review the generated script carefully, we only want to adjust files that previously belonged to the users default group ps-m, usually those in his home directory. Files elsewhere may require special treatment.

• possibly add user to the zimbra group that may edit the publication server.
• possibly add user to the system group on james that is granted ssh access.
• remove from ps-r group

TODO: consider implementing a timeout mechanism for former accounts

Description key format

Valid properties

• @ignore : disable policy checking for this user
• @checkForDeletion: warn that this user should be deleted
• @contact: The contact in the lab for this user
• @created: Date of creation (in YYYYMMDD format)
• @extraMailAddresses: additional mail addresses for this user
• @puc: primary user category (student,guest,member,temporary,formerMember)
• @suc: secondary user category (gecode,mozart)
• @qsoft,@qmail,@qhard: override quota defaults (see below)
• @nomail: disable mail policy checking for this user(used if the user has no mailbox or isn't supposed to get mail)

Policy errors

• The policy script returns an error if:
  • unknown @-properties are used
  • @created is missing or is not in YYYYMMDD format
  • @puc contradicts UNIX group memberships (e.g. puc=member but user is in ps-s group)
  • @contact is missing (only students,guests and temporaries who don't have an @suc or @checkForDeletion property).

  • /home/<username> is missing or doesn't belong to <username>:<primary group>.

  • required mail addresses aren't present(see below)
  • /usr/local/bin/pslab-route fails (this script tests if mail routing works)
  • the quotas are incorrect (see quota table below)
  • the user uses more blocks than his hard quota allows (I'm not entirely sure why this is in the script, the system mail quota checking does the same thing. I guess it helps to determine if you need to delete/compress some files before decreasing the quota)

Policy warnings

• The policy script warns if:
  • @checkForDeletion is present

  • /var/home/<username> exists ( Is this necessary? sounds like a temporary migration check to me)

Required mail addresses

• username@ps.uni-saarland.de

• givenname.surname@ps.uni-saarland.de

• username@mozart-os.org (mozart members only)

• givenname.surname@mozart-os.org (mozart members only)

• username@gecode.org (gecode members only)

• givenname.surname@gecode.org (gecode members only)

• surname@ps.uni-saarland.de (members and former members only)

• entries in @extraMailAddresses

Required quotas

These values are hardcoded in the /etc/cron.daily/check-policy script in the definition of the $policy array. All values are in KB

• 	guest	member	formerMember	student	temporary
  soft quota	75000	2000000	2000000	150000	75000
  hard quota	150000	2500000	2500000	300000	150000
  mailquota	75000	500000	500000	100000	75000