A convenient Chef LWRP to manage user accounts and SSH keys. This is not the Opscode users cookbook.
- Github: https://github.com/fnichol/chef-user
- Opscode Community Site: http://community.opscode.com/cookbooks/user
Simply include recipe[user]
in your run_list and the user_account
resource will be available.
To use recipe[user::data_bag]
, include it in your run_list and have a
data bag called "users"
with an item like the following:
{
"id" : "hsolo",
"comment" : "Han Solo",
"home" : "/opt/hoth/hsolo",
"ssh_keys" : ["123...", "456..."]
}
or a user to be removed:
{
"id" : "lando",
"action" : "remove"
}
The data bag recipe will iterate through a list of usernames defined in
node['users']
(by default) and attempt to pull in the user's information
from the data bag item. In other words, having:
node['users'] = ['hsolo']
will set up the hsolo
user information and not use the lando
user
information.
Tested on 0.10.8 but newer and older version should work just fine. File an issue if this isn't the case.
The following platforms have been tested with this cookbook, meaning that the recipes run on these platforms without error:
- ubuntu
- debian
- mac_os_x
There are no external cookbook dependencies.
Depending on the situation and use case there are several ways to install this cookbook. All the methods listed below assume a tagged version release is the target, but omit the tags to get the head of development. A valid Chef repository structure like the Opscode repo is also assumed.
To install this cookbook from the Opscode platform, use the knife command:
knife cookbook site install user
Librarian-Chef is a bundler for your Chef cookbooks.
Include a reference to the cookbook in a Cheffile and run
librarian-chef install
. To install Librarian-Chef:
gem install librarian
cd chef-repo
librarian-chef init
To use the Opscode platform version:
echo "cookbook 'user'" >> Cheffile
librarian-chef install
Or to reference the Git version:
cat >> Cheffile <<END_OF_CHEFFILE
cookbook 'user',
:git => 'git://github.com/fnichol/chef-user.git', :ref => 'v0.3.0'
END_OF_CHEFFILE
librarian-chef install
The knife-github-cookbooks gem is a plugin for knife that supports installing cookbooks directly from a GitHub repository. To install with the plugin:
gem install knife-github-cookbooks
cd chef-repo
knife cookbook github install fnichol/chef-user/v0.3.0
A common practice (which is getting dated) is to add cookbooks as Git submodules. This is accomplishes like so:
cd chef-repo
git submodule add git://github.com/fnichol/chef-user.git cookbooks/user
git submodule init && git submodule update
Note: the head of development will be linked here, not a tagged release.
If the cookbook needs to downloaded temporarily just to be uploaded to a Chef Server or Opscode Hosted Chef, then a tarball installation might fit the bill:
cd chef-repo/cookbooks
curl -Ls https://github.com/fnichol/chef-user/tarball/v0.3.0 | tar xfz - && \
mv fnichol-chef-user-* user
This recipe is a no-op and does nothing.
Processes a list of users with data drawn from a data bag. The default data bag
is users
and the list of user account to create on this node is set on
node['users']
.
The default parent path of a user's home directory. Each resource can override
this value which varies by platform. Generally speaking, the default value is
"/home"
.
The default user shell given to a user. Each resource can override this value
which varies by platform. Generally speaking, the default value is
"/bin/bash"
.
Whether of not to manage the home directory of a user by default. Each resource can override this value. The are 2 valid states:
"true"
,true
, or"yes"
: will manage the user's home directory."false"
,false
, or"no"
: will not manage the user's home directory.
The default is true
.
Whether or not to to create a group with the same name as the user by default. Each resource can override this value. The are 2 valid states:
"true"
,true
, or"yes"
: will create a group for the user by default."false"
,false
, or"no"
: will not create a group for the user by default.
The default is true
.
Whether or not to generate an SSH keypair for the user by default. Each resource can override this value. There are 2 valid states:
"true"
,true
, or"yes"
: will generate an SSH keypair when the account is created."false"
,false
, or"no"
: will not generate an SSH keypair when the account is created.
The default is true
.
The data bag name containing a group of user account information. This is used
by the data_bag
recipe to use as a database of user accounts.
The default is "users"
.
The node attributes containing an array of users to be managed. If a nested
hash in the node's attributes is required, then use a /
between subhashes.
For example, if the users' array is stored in node['system']['accounts']
),
then set node['user']['user_array_node_attr']
to "system/accounts"
.
The default is "users"
.
Note: in order to use the password
attribute, you must have the
ruby-shadow gem installed. On Debian/Ubuntu you can get
this by installing the "libshadow-ruby1.8" package.
Action | Description | Default |
---|---|---|
create |
Create the user, its home directory, .ssh/authorized_keys ,
and .ssh/{id_dsa,id_dsa.pub} .
|
Yes |
remove | Remove the user account. | |
modify | Modiy the user account. | |
manage | Manage the user account. | |
lock | Lock the user's password. | |
unlock | Unlock the user's password. |
Attribute | Description | Default Value |
---|---|---|
username | Name attribute: The name of the user. | nil |
comment | Gecos/Comment field. | nil |
uid | The numeric user id. | nil |
gid | The primary group id. | nil |
home | Home directory location. | "#{node['user']['home_root']}/#{username} |
shell | The login shell. | node['user']['default_shell'] |
password | Shadow hash of password. | nil |
system_user | Whether or not to create a system user. | false |
manage_home | Whether or not to manage the home directory. | true |
create_group | Whether or not to to create a group with the same name as the user. | node['user']['create_group'] |
ssh_keys |
A String or Array of SSH public keys to populate the
user's .ssh/authorized_keys file.
|
[] |
ssh_keygen | Whether or not to generate an SSH keypair for the user. | node['user']['ssh_keygen'] |
user_account 'hsolo' do
comment 'Han Solo'
ssh_keys ['3dc348d9af8027df7b9c...', '2154d3734d609eb5c452...']
home '/opt/hoth/hsolo'
end
user_account 'lando' do
action :lock
end
user_account 'obiwan' do
action :remove
end
- Source hosted at GitHub
- Report issues/Questions/Feature requests on GitHub Issues
Pull requests are very welcome! Make sure your patches are well tested. Ideally create a topic branch for every separate change you make.
Author:: [Fletcher Nichol][fnichol] ([email protected])
Copyright 2011, Fletcher Nichol
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.