[RFC] Globally creating a user and a group "root"
Corinna Vinschen
vinschen@redhat.com
Wed Nov 12 16:21:00 GMT 2003
On Wed, Nov 12, 2003 at 03:44:44PM +0100, Corinna Vinschen wrote:
> On Wed, Nov 12, 2003 at 12:29:08PM -0000, Morrison, John wrote:
> > Corinna Vinschen wrote:
> > > Eh, no. I was thinking about a postinstall script, which checks for
> > > Everyone (S-1-0-0) in /etc/passwd and /etc/group and removes these
> > > entries silently. The same script could add the "root" entry to
> > > /etc/group.
> >
> > But then what happens if somebody messes up there /etc/[passwd|group]
> > and have to create it again? Does mk[passwd|group] do the changes
> > automatically?
>
> mkpasswd and mkgroup don't create an Everyone entry since August 2002.
>
> The remaining problem is the special handling of root. I guess it's
> best to create the /etc/group entry already in mkgroup. For mkpasswd
> it might be best, to add a special handling like this: If a Windows
> user "root" exists, give it the uid 0.
I've created a "create-root" script to be put under /usr/sbin for review.
It's basically taken from the relevant part of the latest ssh-host-config.
It doesn't only create a user root in the SAM, it also modifies /etc/passwd
and /etc/group appropriately. The script is attached. Please give it a
shot.
Another question is this:
Should we actually depend on creating an NT account called "root"?
This might be already in use by a bunch of users and sysadmins just
for fun. Probably we do more often collide with that than we like.
What about using a less common name like, say "cygwin_root" or
"cygsrv_root" or so.
Corinna
--
Corinna Vinschen Please, send mails regarding Cygwin to
Cygwin Developer mailto:cygwin@cygwin.com
Red Hat, Inc.
-------------- next part --------------
#!/bin/bash
#
# create-root, Copyright 2003 Red Hat Inc.
#
# This file is part of Cygwin.
# Subdirectory where the new package is being installed
PREFIX=/usr
# Directory where the config files are stored
SYSCONFDIR=/etc
progname=$0
auto_answer=""
port_number=22
request()
{
if [ "${auto_answer}" = "yes" ]
then
echo "$1 (yes/no) yes"
return 0
elif [ "${auto_answer}" = "no" ]
then
echo "$1 (yes/no) no"
return 1
fi
answer=""
while [ "X${answer}" != "Xyes" -a "X${answer}" != "Xno" ]
do
echo -n "$1 (yes/no) "
read -e answer
done
if [ "X${answer}" = "Xyes" ]
then
return 0
else
return 1
fi
}
# Check options
while :
do
case $# in
0)
break
;;
esac
option=$1
shift
case "${option}" in
-d | --debug )
set -x
;;
-y | --yes )
auto_answer=yes
;;
-n | --no )
auto_answer=no
;;
-c | --cygwin )
cygwin_value="$1"
shift
;;
-p | --port )
port_number=$1
shift
;;
-w | --pwd )
password_value="$1"
shift
;;
*)
echo "usage: ${progname} [OPTION]..."
echo
echo "This script creates a "root" user which has appropriate privileges"
echo "to run services which need to switch user context without password."
echo
echo "Options:"
echo " --debug -d Enable shell's debug output."
echo " --yes -y Answer all questions with \"yes\" automatically."
echo " --no -n Answer all questions with \"no\" automatically."
echo " --pwd -w <passwd> Use \"pwd\" as password for user 'root'."
echo
exit 1
;;
esac
done
# Check if running on NT
uname | grep -q CYGWIN_NT && _nt=yes
# If not running on NT, nothing to do
if [ ${_nt} != "yes" ]
then
echo "Nothing to do on 9x/Me."
exit 0
fi
# Check if running under NT4 or earlier
_nt4=`uname | awk -F- '{print ( $2 < 5.0 ) ? "yes" : "no";}'`
# Check for ${SYSCONFDIR} directory
if [ -e "${SYSCONFDIR}" -a ! -d "${SYSCONFDIR}" ]
then
echo
echo "${SYSCONFDIR} is existant but not a directory."
echo "Cannot create global configuration files."
echo
exit 1
fi
# Create it if necessary
if [ ! -e "${SYSCONFDIR}" ]
then
mkdir "${SYSCONFDIR}"
if [ ! -e "${SYSCONFDIR}" ]
then
echo
echo "Creating ${SYSCONFDIR} directory failed"
echo
exit 1
fi
fi
echo
echo
echo "Warning: The following functions require administrator privileges!"
echo
# Check if a user root is already in /etc/passwd.
grep -q '^root:' ${SYSCONFDIR}/passwd && root_in_passwd=yes
# Drop root from passwd since it could have wrong settings.
if [ "${root_in_passwd}" = "yes" ]
then
grep -v '^root:' ${SYSCONFDIR}/passwd > ${SYSCONFDIR}/passwd.$$
rm -f ${SYSCONFDIR}/passwd
mv ${SYSCONFDIR}/passwd.$$ ${SYSCONFDIR}/passwd
chmod g-w,o-w ${SYSCONFDIR}/passwd
fi
# Drop root from group file since it could have wrong settings.
# Inject a correct entry instead.
echo 'root:S-1-5-32-544:0:' > ${SYSCONFDIR}/group.$$
grep -v '^root:' ${SYSCONFDIR}/group >> ${SYSCONFDIR}/group.$$
rm -f ${SYSCONFDIR}/group
mv ${SYSCONFDIR}/group.$$ ${SYSCONFDIR}/group
chmod g-w,o-w ${SYSCONFDIR}/group
# Get local name of administrators group.
_admingroup=`mkgroup -l | awk -F: '/:544:/{print $1;}'`
# Check if a user root exists on the system.
net user root >/dev/null 2>&1 && root_in_sam=yes
if [ "${root_in_sam}" = "yes" ]
then
echo
echo "You already have a user 'root' on your system. Is that user supposed"
if ! request "to be used as the required privileged user account?"
then
echo
echo "In that case, this script can't do its job. Either rename the"
echo "user called 'root' or create a 'root' entry in ${SYSCONFDIR}/passwd,"
echo "using a user with appropriate privileges."
exit 1
fi
else
# Create a local root user.
mkdir -p /home/root
dos_var_empty=`cygpath -w /home/root`
while [ "${root_in_sam}" != "yes" ]
do
if [ -n "${password_value}" ]
then
_password="${password_value}"
# Allow to ask for password if first try fails
password_value=""
else
echo
echo "Please enter a password for new user 'root'. Please be sure that"
echo "this password matches the password rules given on your system."
echo -n "Entering no password will exit the configuration. PASSWORD="
read -e _password
if [ -z "${_password}" ]
then
echo
echo "Exiting configuration. No user root has been created."
exit 1
fi
fi
net user root "${_password}" /add /fullname:"Cygwin root account" "/homedir:${dos_var_empty}" /yes > /tmp/nu.$$ 2>&1 && root_in_sam=yes
if [ "${root_in_sam}" != "yes" ]
then
echo "Creating the user 'root' failed! Reason:"
cat /tmp/nu.$$
rm /tmp/nu.$$
fi
done
fi
# Check if root is already member of the local administrators group.
net localgroup administrators | egrep -q '\<root\>' && root_in_admingroup=yes
# Otherwise add root to the local administrators group.
if [ "${root_in_admingroup}" != "yes" ]
then
net localgroup "${_admingroup}" root /add > /dev/null 2>&1 && root_in_admingroup=yes
if [ "${root_in_admingroup}" != "yes" ]
then
echo "WARNING: Adding user root to local group ${_admingroup} failed!"
echo "Please add root to local group ${_admingroup} before"
echo "starting the sshd service!"
echo
else
echo
echo "User 'root' has been created with password '${_password}'."
echo "If you change the password, please keep in mind to change the password"
echo "for all services running under user 'root', too."
fi
fi
# Try setting the password expiry to "never". This requires a newer version
# of the passwd tool.
passwd_has_expiry_flags=`passwd -v | awk '/^passwd /{print ( $3 >= 1.5 ) ? "yes" : "no";}'`
if [ "${passwd_has_expiry_flags}" != "yes" ]
then
echo
echo "WARNING: User root has password expiry set to system default."
echo "Please check that password never expires or set it to your needs."
else
if ! passwd -e root
then
echo
echo "WARNING: Setting password expiry for user root failed!"
echo "Please check that password never expires or set it to your needs."
fi
fi
# Create appropriate root entry with uid and gid 0 in /etc/passwd.
if [ "${root_in_sam}" = "yes" ]
then
mkpasswd -l -u root | sed -e 's/:[0-9]*:[0-9]*:/:0:0:/;s/bash$/false/' >> ${SYSCONFDIR}/passwd
fi
# Give user root the appropriate user rights.
editrights -a SeAssignPrimaryTokenPrivilege -u root &&
editrights -a SeCreateTokenPrivilege -u root &&
editrights -a SeIncreaseQuotaPrivilege -u root &&
editrights -a SeServiceLogonRight -u root &&
root_got_all_rights="yes"
# Add the "deny logon" rights only on systems which support them.
if [ "${_nt4}" != "yes" ]
then
editrights -a SeDenyInteractiveLogonRight -u root
editrights -a SeDenyNetworkLogonRight -u root
editrights -a SeDenyRemoteInteractiveLogonRight -u root
fi
if [ "${root_got_all_rights}" != "yes" ]
then
echo
echo "Assigning the appropriate privileges to user 'root' failed!"
echo "Please be sure to add these rights to user 'root' as soon as possible."
exit 1
fi
echo
echo "root configuration finished. Have fun!"
More information about the Cygwin-apps
mailing list