1#!/usr/bin/perl -w 2 3# $Id: smbldap-groupmod,v 1.12 2006/01/02 17:01:19 jtournier Exp $ 4# 5# This code was developped by IDEALX (http://IDEALX.org/) and 6# contributors (their names can be found in the CONTRIBUTORS file). 7# 8# Copyright (C) 2001-2002 IDEALX 9# 10# This program is free software; you can redistribute it and/or 11# modify it under the terms of the GNU General Public License 12# as published by the Free Software Foundation; either version 2 13# of the License, or (at your option) any later version. 14# 15# This program is distributed in the hope that it will be useful, 16# but WITHOUT ANY WARRANTY; without even the implied warranty of 17# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18# GNU General Public License for more details. 19# 20# You should have received a copy of the GNU General Public License 21# along with this program; if not, write to the Free Software 22# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, 23# USA. 24 25# Purpose of smbldap-groupmod : group (posix) modification 26 27 28use strict; 29use FindBin; 30use FindBin qw($RealBin); 31use lib "$RealBin/"; 32use smbldap_tools; 33 34##################### 35 36use Getopt::Std; 37my %Options; 38 39my $ok = getopts('ag:n:m:or:s:t:x:?', \%Options); 40if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) ) { 41 print_banner; 42 print "Usage: $0 [-a] [-g gid [-o]] [-n name] [-m members(,)] [-x members (,)] [-r rid] [-s sid] [-t type] groupname\n"; 43 print " -a add automatic group mapping entry\n"; 44 print " -g new gid\n"; 45 print " -o gid is not unique\n"; 46 print " -n new group name\n"; 47 print " -m add members (comma delimited)\n"; 48 print " -r group-rid\n"; 49 print " -s group-sid\n"; 50 print " -t group-type\n"; 51 print " -x delete members (comma delimted)\n"; 52 print " -? show this help message\n"; 53 exit (1); 54} 55 56my $groupName = $ARGV[0]; 57my $group_entry; 58 59my $ldap_master=connect_ldap_master(); 60 61if (! ($group_entry = read_group_entry($groupName))) { 62 print "$0: group $groupName doesn't exist\n"; 63 exit (6); 64} 65 66my $newname = $Options{'n'}; 67 68my $nscd_status = system "/etc/init.d/nscd status >/dev/null 2>&1"; 69 70if ($nscd_status == 0) { 71 system "/etc/init.d/nscd restart > /dev/null 2>&1"; 72} 73 74my $gid = getgrnam($groupName); 75unless (defined ($gid)) { 76 print "$0: group $groupName not found!\n"; 77 exit(6); 78} 79 80my $tmp; 81if (defined($tmp = $Options{'g'}) and $tmp =~ /\d+/) { 82 if (!defined($Options{'o'})) { 83 if (defined(getgrgid($tmp))) { 84 print "$0: gid $tmp exists\n"; 85 exit (6); 86 } 87 } 88 if (!($gid == $tmp)) { 89 my $modify = $ldap_master->modify ( "cn=$groupName,$config{groupsdn}", 90 changes => [ 91 replace => [gidNumber => $tmp] 92 ] 93 ); 94 $modify->code && die "failed to modify entry: ", $modify->error ; 95 } 96} 97 98 99if (defined($newname)) { 100 my $modify = $ldap_master->moddn ( 101 "cn=$groupName,$config{groupsdn}", 102 newrdn => "cn=$newname", 103 deleteoldrdn => "1", 104 newsuperior => "$config{groupsdn}" 105 ); 106 $modify->code && die "failed to modify entry: ", $modify->error ; 107 # take down session 108} 109 110# Add members 111if (defined($Options{'m'})) { 112 my $members = $Options{'m'}; 113 my @members = split( /,/, $members ); 114 my $member; 115 foreach $member ( @members ) { 116 my $group_entry=read_group_entry($groupName); 117 $config{groupsdn}=$group_entry->dn; 118 if (is_unix_user($member) || is_nonldap_unix_user($member)) { 119 if (is_group_member($config{groupsdn},$member)) { 120 print "User $member already in the group\n"; 121 } else { 122 print "adding user $member to group $groupName\n"; 123 my $modify = $ldap_master->modify ($config{groupsdn}, 124 changes => [ 125 add => [memberUid => $member] 126 ] 127 ); 128 $modify->code && warn "failed to add entry: ", $modify->error ; 129 } 130 } else { 131 print "User $member does not exist: create it first !\n"; 132 } 133 } 134} 135 136# Delete members 137if (defined($Options{'x'})) { 138 my $members = $Options{'x'}; 139 my @members = split( /,/, $members ); 140 my $member; 141 foreach $member ( @members ) { 142 my $user_entry=read_user_entry($member); 143 my $group_entry=read_group_entry($groupName); 144 $config{groupsdn}=$group_entry->dn; 145 if (is_group_member("$config{groupsdn}",$member)) { 146 my $delete=1; 147 if (defined $group_entry->get_value('sambaSID')) { 148 if ($group_entry->get_value('sambaSID') eq $user_entry->get_value('sambaPrimaryGroupSID')) { 149 $delete=0; 150 print "Cannot delete user ($member) from his primary group ($groupName)\n"; 151 } 152 } 153 if ($delete eq 1) { 154 print "deleting user $member from group $groupName\n"; 155 my $modify = $ldap_master->modify ($config{groupsdn}, 156 changes => [ 157 delete => [memberUid => $member] 158 ] 159 ); 160 $modify->code && warn "failed to delete entry: ", $modify->error ; 161 } 162 } else { 163 print "User $member is not in the group $groupName!\n"; 164 } 165 } 166} 167 168my $group_sid; 169if ($tmp= $Options{'s'}) { 170 if ($tmp =~ /^S-(?:\d+-)+\d+$/) { 171 $group_sid = $tmp; 172 } else { 173 print "$0: illegal group-rid $tmp\n"; 174 exit(7); 175 } 176} elsif ($Options{'r'} || $Options{'a'}) { 177 my $group_rid; 178 if ($tmp= $Options{'r'}) { 179 if ($tmp =~ /^\d+$/) { 180 $group_rid = $tmp; 181 } else { 182 print "$0: illegal group-rid $tmp\n"; 183 exit(7); 184 } 185 } else { 186 # algorithmic mapping 187 $group_rid = 2*$gid+1001; 188 } 189 $group_sid = $config{SID}.'-'.$group_rid; 190} 191 192if ($group_sid) { 193 my @adds; 194 my @mods; 195 push(@mods, 'sambaSID' => $group_sid); 196 197 if ($tmp= $Options{'t'}) { 198 my $group_type; 199 if (defined($group_type = &group_type_by_name($tmp))) { 200 push(@mods, 'sambaGroupType' => $group_type); 201 } else { 202 print "$0: unknown group type $tmp\n"; 203 exit(8); 204 } 205 } else { 206 if (! defined($group_entry->get_value('sambaGroupType'))) { 207 push(@mods, 'sambaGroupType' => group_type_by_name('domain')); 208 } 209 } 210 211 my @oc = $group_entry->get_value('objectClass'); 212 unless (grep($_ =~ /^sambaGroupMapping$/i, @oc)) { 213 push (@adds, 'objectClass' => 'sambaGroupMapping'); 214 } 215 216 my $modify = $ldap_master->modify ( "cn=$groupName,$config{groupsdn}", 217 changes => [ 218 'add' => [ @adds ], 219 'replace' => [ @mods ] 220 ] 221 ); 222 $modify->code && warn "failed to delete entry: ", $modify->error ; 223} 224 225$nscd_status = system "/etc/init.d/nscd status >/dev/null 2>&1"; 226 227if ($nscd_status == 0) { 228 system "/etc/init.d/nscd restart > /dev/null 2>&1"; 229} 230 231# take down session 232$ldap_master->unbind; 233 234exit (0); 235 236############################################################ 237 238=head1 NAME 239 240smbldap-groupmod - Modify a group 241 242=head1 SYNOPSIS 243 244smbldap-groupmod [-g gid [-o]] [-a] [-r rid] [-s sid] [-t group type] 245 [-n group_name ] [-m members(,)] [-x members (,)] group 246 247=head1 DESCRIPTION 248 249The smbldap-groupmod command modifies the system account files to 250reflect the changes that are specified on the command line. 251The options which apply to the smbldap-groupmod command are 252 253-g gid The numerical value of the group's ID. This value must be 254 unique, unless the -o option is used. The value must be non- 255 negative. Any files which the old group ID is the file 256 group ID must have the file group ID changed manually. 257 258-n group_name 259 The name of the group will be changed from group to group_name. 260 261-m members 262 The members to be added to the group in comma-delimeted form. 263 264-x members 265 The members to be removed from the group in comma-delimted form. 266 267-a 268 add an automatic Security ID for the group (SID). 269 The rid of the group is calculated from the gidNumber of the 270 group as rid=2*gidNumber+1001. Thus the resulted SID of the 271 group is $SID-$rid where $SID and $rid are the domain SID and 272 the group rid 273 274-s sid 275 set the group SID. 276 The SID must be unique and defined with the domain Security ID 277 ($SID) like sid=$SID-rid where rid is the group rid. 278 279-r rid 280 set the group rid. 281 The SID is then calculated as sid=$SID-rid where $SID is the 282 domain Security ID. 283 284-t group type 285 set the NT Group type for the new group. Available values are 286 2 (domain group), 4 (local group) and 5 (builtin group). 287 The default group type is 2. 288 289=head1 EXAMPLES 290 291smbldap-groupmod -g 253 development 292 This will change the GID of the 'development' group to '253'. 293 294smbldap-groupmod -n Idiots Managers 295 This will change the name of the 'Managers' group to 'Idiots'. 296 297smbldap-groupmod -m "jdoe,jsmith" "Domain Admins" 298 This will add 'jdoe' and 'jsmith' to the 'Domain Admins' group. 299 300smbldap-groupmod -x "jdoe,jsmith" "Domain Admins" 301 This will remove 'jdoe' and 'jsmith' from the 'Domain Admins' group. 302 303=head1 SEE ALSO 304 305 groupmod(1) 306 307=cut 308 309#' 310