Bulk user add script

kenneho · 01-02-2009, 08:19 AM

Quote:

Originally Posted by Disillusionist

Sorry, I realised my mistake whilst you were composing your reply.

No problem.

Quote:

Originally Posted by Disillusionist

You could use usermod -p $ENCPW $UN so long as you have a valid encrypted password but you're going to need to create that encrypted password somewhere.

Yeah, and this is where I'm at: Where can I create an encryptet password without having to create/modify an existing user? I essence, what I'd like is access to the same encryption function that "passwd" uses.

sandeeprhce5 · 01-02-2009, 11:49 PM

Quote:

Originally Posted by rweaver

Sure, mkpasswd... a script to do what the original poster asked from a csv file would look like this...

new-user.sh

Code:

#!/bin/bash
for i in `cat unpw.csv`; do
  UN=`echo $i | cut -f1 -d','`
  PW=`echo $i | cut -f2 -d','`
  ENCPW=`echo $PW | mkpasswd -s`
  echo useradd -p $ENCPW -m $UN
done

unpw.csv

Code:

user1,password1
user2,password2
user3,password3

You might want to add --hash=md5 or something similar to mkpasswd to get a better encryption scheme than the default.

It currently will echo what it will output to the system when you run it... to do the process for real remove the echo.

Good luck.

Very useless script its not working properly it damage my system passwd file please do not try at home
error
what do you mean by mkpasswd

Disillusionist · 01-03-2009, 04:49 AM

Quote:

Originally Posted by sandeeprhce5

Very useless script its not working properly it damage my system passwd file please do not try at home
error
what do you mean by mkpasswd

Did you run it with the echo in first?

The point of the echo statement was that you could do a dry run first to ensure it was going to do what you expected it to do.

What problems has this caused for your /etc/passwd /etc/shadow files? This should only have attempted to create new users not modify existing entries.

Disillusionist · 01-03-2009, 06:37 AM

Quote:

Originally Posted by kenneho

Yeah, and this is where I'm at: Where can I create an encryptet password without having to create/modify an existing user? I essence, what I'd like is access to the same encryption function that "passwd" uses.

passwd uses crypt but with a random salt begining $1$

For example, create a user testuser2 with the password Testing
Then tail /etc/shadow
On my system I get:

Code:

testuser2:$1$5ObqRtny$PusK9ewRa6sKA7olrf7pC1:14246:0:99999:7:::

If I use crypt with the first part as my SALT:

Code:

#!/usr/bin/perl
use strict;
my $SALT='$1$5ObqRtny';
my $pass="Testing";
my $ENC=crypt($pass, $SALT);

print("Password : $pass\n");
print("Encrypted: $ENC\n");

I get:

Code:

Password : Testing
Encrypted: $1$5ObqRtny$PusK9ewRa6sKA7olrf7pC1

Therefore you can tell what SALT crypt used by taking the encrypted password prior to the third $ symbol

Disillusionist · 01-03-2009, 10:03 AM

OK, I think I've finally finished tweaking the code!

/usr/local/bin/new_user.pl

Code:

#!/usr/bin/perl
use strict;
use String::Random qw(random_string);
## String::Random can be found: http://search.cpan.org/~steve/String-Random-0.20/Random.pm

my ($USER, $pass)=@ARGV;
my $SALT=random_string("ssssssssss");

my $PASS_SALT=("\$1\$$SALT");
my $ENC=crypt($pass, $PASS_SALT);

system("useradd -p '$ENC' -m $USER");

/usr/local/bin/bulk_useradd.pl

Code:

#!/usr/bin/perl
use strict;

my ($list)=@ARGV;
my $line;

open(LIST, $list) or die "Couldn't open $list\n";
my @userlist=<LIST>;
close(LIST);

foreach $line (@userlist) {
   my ($USER,$PASS)=split(',',$line);
   system("perl /usr/local/bin/new_user.pl $USER $PASS");
}

Syntax bulk_user.pl {file}
EG:
bulk_user.pl /tmp/Users

Sample /tmp/Users:

Quote:

testuser1,Password
testuser2,Hello

kenneho · 01-05-2009, 01:58 AM

Quote:

Originally Posted by Disillusionist

passwd uses crypt but with a random salt begining $1$

For example, create a user testuser2 with the password Testing
Then tail /etc/shadow
On my system I get:

Code:

testuser2:$1$5ObqRtny$PusK9ewRa6sKA7olrf7pC1:14246:0:99999:7:::

But AFAIK the "passwd" modifies an existing user. I don't want to modify or create a user at all, just create an encrypted password. Am I missing something here?

Disillusionist · 01-05-2009, 02:40 AM

To create an encrypted password:

Code:

#!/usr/bin/perl
##
## Script: encrypt.pl
use strict;
use String::Random qw(random_string);
## String::Random can be found: http://search.cpan.org/~steve/String-Random-0.20/Random.pm

my ($pass)=@ARGV;
my $SALT=("\$1\$" . random_string("ssssssss") );
##
## If you cant get String::Random then just use your own SALT eg:
##  my $SALT=("\$1\$GSx8s72d");

my $ENC=crypt($pass, $SALT);

print("Encrypted Pass: $ENC\n");

This expects the unencyrpted password to be passed as an argument:

encrypt.pl Password

kenneho · 01-05-2009, 02:54 AM

Quote:

Originally Posted by Disillusionist

To create an encrypted password:

Code:

#!/usr/bin/perl
##
## Script: encrypt.pl
use strict;
use String::Random qw(random_string);
## String::Random can be found: http://search.cpan.org/~steve/String-Random-0.20/Random.pm

my ($pass)=@ARGV;
my $SALT=("\$1\$" . random_string("ssssssss") );
##
## If you cant get String::Random then just use your own SALT eg:
##  my $SALT=("\$1\$GSx8s72d");

my $ENC=crypt($pass, $SALT);

print("Encrypted Pass: $ENC\n");

This expects the unencyrpted password to be passed as an argument:

encrypt.pl Password

Thanks, but this is perl. I'd like a (bash) shell equivalent of this if possible. I mentioned this a few posts back, but I'm sure it's not easy to keep track of what everyone has written.

Anyways: If there is a (bash) shell equivalent for this, in which I can create an encrypted password that _may_ be added to /etc/shadow later on, please let me know. The reason for doing it this way is that for some users I define them in our administration program (Puppet), and distribute the encrypted password to the the servers in our network. So the encrypted password are added to a text file and distributed to the /etc/shadow file of our servers.

rweaver · 01-05-2009, 08:13 AM

Quote:

Originally Posted by sandeeprhce5

Very useless script its not working properly it damage my system passwd file please do not try at home
error
what do you mean by mkpasswd

As written the script doesn't touch your passwd or shadow files, it does nothing but echo information to the screen (should be in the format of "useradd -p yXI6rY4uwosLQ username"). If you remove the echo it will simply run the useradd command with whatever command line was echoed to the screen in the dry run.

Even if fed incorrect information (badly formatted csv) it can only pass that bad information to the useradd program which shouldn't do any damage to your passwd or shadow files. The useradd program has no destructive flags, so even if you try to make a user named various random flags instead of a name it would just make a non-usable user.

Based on the information at the bottom of your post it looks like your system doesn't have mkpasswd installed by default or it's not in your path. Which means, largely, that you would get the unencrypted password added to the password file, which still wouldn't allow login.

Disillusionist · 01-05-2009, 02:27 PM

Quote:

Originally Posted by kenneho

Thanks, but this is perl. I'd like a (bash) shell equivalent of this if possible. I mentioned this a few posts back, but I'm sure it's not easy to keep track of what everyone has written.

Anyways: If there is a (bash) shell equivalent for this, in which I can create an encrypted password that _may_ be added to /etc/shadow later on, please let me know. The reason for doing it this way is that for some users I define them in our administration program (Puppet), and distribute the encrypted password to the the servers in our network. So the encrypted password are added to a text file and distributed to the /etc/shadow file of our servers.

To the best of my knowledge (and numerous Google searches) there is no way to do this directly from bash.

mkpasswd uses crypt, however it only allows 2 character SALT's and therefore will not give the type of password that you are after.

I must admit that I don't see an issue with calling a perl script from bash (unless you don't have perl installed).

On my system I have moved the encrypt.pl file:

Code:

mv encrypt.pl /usr/local/bin/crypt
chmod 555 /usr/local/bin/crypt

Then I tested calling it from within bash, example:

Code:

#!/bin/bash
Password="Testing"
###
### Create encrypted password
###
l_encrypted_pass=$(crypt $Password)

echo "$l_encrypted_pass"

rweaver · 01-05-2009, 02:48 PM

Quote:

Originally Posted by Disillusionist

To the best of my knowledge (and numerous Google searches) there is no way to do this directly from bash.

mkpasswd uses crypt, however it only allows 2 character SALT's and therefore will not give the type of password that you are after.

I must admit that I don't see an issue with calling a perl script from bash (unless you don't have perl installed).

Code:

#!/bin/bash
for i in `cat unpw.csv`; do
  UN=`echo $i | cut -f1 -d','`
  PW=`echo $i | cut -f2 -d','`
  ENCPW=`echo $PW|mkpasswd -s --hash=md5`
  echo useradd -p $ENCPW -m $UN
done

Like I suggested in my original post, you probably want to use a stronger alg like md5. Just gotta add a --hash=alg line, see above.

Disillusionist · 01-05-2009, 04:09 PM

It just goes to show that the best of my knowledge is not always right

rweaver · 01-05-2009, 04:48 PM

Quote:

Originally Posted by Disillusionist

It just goes to show that the best of my knowledge is not always right

Pobody's Nerfect.

kenneho · 01-06-2009, 01:55 AM

[QUOTE=Disillusionist;3398100]To the best of my knowledge (and numerous Google searches) there is no way to do this directly from bash.
QUOTE]

Thanks, that's all I needed to know.

I was hoping there would be some way of doing this directly from bash, but going for the perl method is not a problem.

haariseshu · 01-06-2009, 08:23 AM

Dear Guys,
After my tour I just sit with my office and gone through this thread and lot of informations and knowledgeI I gained. And my heartly thanks for all shared their knowledge here.

And I hope the tail of this post will extend.

--
With Thanks & Regards,
Hari.