samba-tool create user

classic Classic list List threaded Threaded
3 messages Options
Reply | Threaded
Open this post in threaded view
|

samba-tool create user

Samba - General mailing list
I'm working on a shell script to create new users on a AD DC. Currently we
use ADUC, but that is slow and error-prone. My (untested) command looks
like this:

samba-tool user create $USERNAME $PASSWORD \
--nis-domain=sta \
--unix-home=/home/${USERNAME} \
--uid-number=${NEXTID} \
--login-shell=/sbin/nologin \
--gid-number=513 \
--use-username-as-cn \
--home-drive=Z \
--home-directory=\\\\gecko\\${USERNAME} \
--profile-path=\\\\gecko\\profiles\\${USERNAME} \
--userou='OU=users,OU=tipping'

I'm not sure I am using the "--userou" correctly. We store our active users
in a separate users OU within one named for our domain, so if I look at the
distinguishedName attribute for a current user in ADUC it looks like this:

CN=adrian,OU=users,OU=tipping,DC=tipping,DC=lan

The man page says this:

--userou=USEROU       DN of alternative location (without domainDN
counterpart) to default CN=Users in which new user object will be created.
E.g. 'OU=<OU name>'

If I get it wrong, will the command just fail or will it try to create some
incorrect OU that I will then have to figure out how to clean up? Do you
think I guessed correctly?

Also, did I get the (doubled) backslashes right in the windows paths?

And should the home-drive be 'Z' or 'Z:'?

I guess a working example would help a lot for the parameters that are not
in any examples in "samba-tool user create --help". Thanks,
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba
Reply | Threaded
Open this post in threaded view
|

Re: samba-tool create user

Samba - General mailing list
On Wed, 19 Apr 2017 16:06:52 -0700
Mark Nienberg via samba <[hidden email]> wrote:

> I'm working on a shell script to create new users on a AD DC.
> Currently we use ADUC, but that is slow and error-prone. My
> (untested) command looks like this:
>
> samba-tool user create $USERNAME $PASSWORD \
> --nis-domain=sta \
> --unix-home=/home/${USERNAME} \
> --uid-number=${NEXTID} \
> --login-shell=/sbin/nologin \
> --gid-number=513 \
> --use-username-as-cn \
> --home-drive=Z \
> --home-directory=\\\\gecko\\${USERNAME} \
> --profile-path=\\\\gecko\\profiles\\${USERNAME} \
> --userou='OU=users,OU=tipping'
>
> I'm not sure I am using the "--userou" correctly. We store our active
> users in a separate users OU within one named for our domain, so if I
> look at the distinguishedName attribute for a current user in ADUC it
> looks like this:
>
> CN=adrian,OU=users,OU=tipping,DC=tipping,DC=lan
>
> The man page says this:
>
> --userou=USEROU       DN of alternative location (without domainDN
> counterpart) to default CN=Users in which new user object will be
> created. E.g. 'OU=<OU name>'
>
> If I get it wrong, will the command just fail or will it try to
> create some incorrect OU that I will then have to figure out how to
> clean up? Do you think I guessed correctly?

The 'OU' must exist before you can create users in it, there is nothing
in samba-tool that will create the 'OU', so if the 'OU' is wrong, the
create will fail and yes, you seem to have guessed correctly.

>
> Also, did I get the (doubled) backslashes right in the windows paths?

Not sure, You may have one too many '\' at the start, try creating a
testuser and then examine the users object with ldbsearch.

>
> And should the home-drive be 'Z' or 'Z:'?

Z:

>
> I guess a working example would help a lot for the parameters that
> are not in any examples in "samba-tool user create --help". Thanks,

If you are writing your own script, you could always by-pass samba-tool
and use an ldif and add this with ldbmodify.

Finally, are you really using '513' as the gidNumber for Domain Users ?
if so, can I just comment that this is a dumb idea in my opinion ;-)

Rowland

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba
Reply | Threaded
Open this post in threaded view
|

Re: samba-tool create user

Samba - General mailing list
I see what you mean about using ldbmodify, but I thought samba-tool was
designed to allow me to administer my samba domain and it will protect me
from messing up the ldb files, like I might with ldbmodify. I realize it
has some shortcomings, but I'm hoping it is improving as time goes on. I am
using ldbmodify only when I can't get the job done with samba-tool.

Thanks very much for your help. I'll move into testing my script next.

On Thu, Apr 20, 2017 at 12:21 AM, Rowland Penny <[hidden email]> wrote:

> On Wed, 19 Apr 2017 16:06:52 -0700
> Mark Nienberg via samba <[hidden email]> wrote:
>
> > I'm working on a shell script to create new users on a AD DC.
> > Currently we use ADUC, but that is slow and error-prone. My
> > (untested) command looks like this:
> >
> > samba-tool user create $USERNAME $PASSWORD \
> > --nis-domain=sta \
> > --unix-home=/home/${USERNAME} \
> > --uid-number=${NEXTID} \
> > --login-shell=/sbin/nologin \
> > --gid-number=513 \
> > --use-username-as-cn \
> > --home-drive=Z \
> > --home-directory=\\\\gecko\\${USERNAME} \
> > --profile-path=\\\\gecko\\profiles\\${USERNAME} \
> > --userou='OU=users,OU=tipping'
> >
> > I'm not sure I am using the "--userou" correctly. We store our active
> > users in a separate users OU within one named for our domain, so if I
> > look at the distinguishedName attribute for a current user in ADUC it
> > looks like this:
> >
> > CN=adrian,OU=users,OU=tipping,DC=tipping,DC=lan
> >
> > The man page says this:
> >
> > --userou=USEROU       DN of alternative location (without domainDN
> > counterpart) to default CN=Users in which new user object will be
> > created. E.g. 'OU=<OU name>'
> >
> > If I get it wrong, will the command just fail or will it try to
> > create some incorrect OU that I will then have to figure out how to
> > clean up? Do you think I guessed correctly?
>
> The 'OU' must exist before you can create users in it, there is nothing
> in samba-tool that will create the 'OU', so if the 'OU' is wrong, the
> create will fail and yes, you seem to have guessed correctly.
>
> >
> > Also, did I get the (doubled) backslashes right in the windows paths?
>
> Not sure, You may have one too many '\' at the start, try creating a
> testuser and then examine the users object with ldbsearch.
>
> >
> > And should the home-drive be 'Z' or 'Z:'?
>
> Z:
>
> >
> > I guess a working example would help a lot for the parameters that
> > are not in any examples in "samba-tool user create --help". Thanks,
>
> If you are writing your own script, you could always by-pass samba-tool
> and use an ldif and add this with ldbmodify.
>
> Finally, are you really using '513' as the gidNumber for Domain Users ?
> if so, can I just comment that this is a dumb idea in my opinion ;-)
>
> Rowland
>
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba