torrancew/puppet-account

Puppet Account Module

Table of Contents

1. Module Description - What the module does and why it is useful
2. Setup - The basics of getting started with account
3. Usage - Configuration options and additional functionality
4. Reference - An under-the-hood peek at what the module is doing and how
5. Limitations - OS compatibility, etc.
6. Development - Guide for contributing to the module

Module Description

The account module eases the creation of UNIX user accounts.

Features:

• Creation/Removal of accounts (via the ensure parameter)
• Account creation w/UID control
• Setting the login shell
• Dedicated Group creation w/GID control (optional)
• Home directory creation (and optionally management via /etc/skel)
• Support for system users
• SSH key management (optional)

Setup

This module has no specific dependencies, as it merely wraps several common native Puppet types in some logic.

Usage

Standard usage of this module would probably look something like this:

account { 'sysadmin':
  home_dir => '/opt/sysadmin',
  groups   => [ 'sudo', 'users' ],
  comment   => 'SysAdmin user',
  ssh_keys => {
    'some_key_comment' => {
      type => 'ssh-rsa',
      key  => 'AAAAB3NzaC1yc2EAAAABIwAAAQEArfQmMkvtWRnwas3DIti9qAuSFQXKcE0kdp5f42PP8l2kTytJPPWp5T/q8PXDQ2d2X5KplMCMDiUQkchqhmDp840jsqBQ9iZPejAjv3w2kITgScFNymAcErtzX52iw4lnUyjZzomCW8G3YthQMaRm2NkI4wcVcjzq+SKyTfzrBoH21RgZlfcx+/50AFRrarpYqel9W5DuLmmShHxD8clPS532Z/1X+1jCW2KikUhdo98lxYTIgFno05lwFOS9Ry89UyBarn1Ecp1zXpIBE7dMQif3UyLUTU9zCVIoZiJj4iO5lemSSV0v8GL97qclBUVJpaCpc4ebR7bhi0nQ28RcxQ==',
    },
  },
}

The type can also be virtualized and realized later (see the official documentation for more information on this pattern):

@account { 'sysadmin': groups  => [ 'sudo', 'users' ] }

There is no implicit Hiera support in this module. For defining accounts via Hiera data, it is recommended to use the profile portion of the role/profile pattern.

Reference

For the detailed reference, see the inline docs:

$ bundle exec rake doc

Limitations

• Does not automatically create arbitrary extra groups. Use the native group type for this.

Development

Please use the github issues functionality to report any bugs or requests for new features. Feel free to fork and submit pull requests for potential contributions.

puppet-account's Issues

Different home directory permissions now possible.

The default 0750 permission is used. This is a pretty good set, but might need to be set differently.

Here is the code that sets this permission is a "static" way in init.pp

  file {
    "${title}_home":
      ensure  => $dir_ensure,
      path    => $home_dir_real,
      owner   => $dir_owner,
      group   => $dir_group,
      mode    => 0750;

I would like to be able to overwrite this setting with hiera, something like this:

accounts:
  exampleuser:
    home_dir: /home/exampleuser
    homedirpermission: 0700

ensure => absent fails to remove primary group of user

The error is groupdel cannot remove the primary group of user. The work around would be to not remove the group explicitly, but allow userdel to take care of it. Not sure if there's Solaris implications, etc?

Module Dead ??

I looks like there haven't been any updates in some time now. I've forked a fork of this module that have a few of the pending PR applied.

The project is here https://github.com/arineng/puppet-account. I'd be happy to have user rebase and send PRs to us.

A more preferred method might to be transfer this project to the Puppet-Community to help with the current issues and PRs

https://github.com/puppet-community

How to use it with Puppet Environment

Hi,

I found your module is very helpful. I'm a little noob here when combining with environment. I don't know how to pass puppet environment "dev" to hiera look up.
I'm stuck with production env default

t# puppet apply --modulepath=environments/dev/modules/ manifests/site.pp --hiera_config=/etc/hiera/hiera.yaml --debug
Debug: hiera(): Hiera YAML backend starting
Debug: hiera(): Looking up classes in YAML backend
Debug: hiera(): Looking for data source clients/vpc-monitor.fff.private
Debug: hiera(): Looking for data source production
Debug: hiera(): Cannot find datafile /etc/hiera/data/production.yaml, skipping
Debug: hiera(): Looking for data source global
Debug: hiera(): Found classes in global
Debug: importing '/etc/puppet/environments/dev/modules/account/manifests/init.pp' in environment production
Error: Could not find class account for vpc-monitor.lazada.private on node vpc-monitor.fff.private
Error: Could not find class account for vpc-monitor.lazada.private on node vpc-monitor.fff.private

Please release

Can you please create a new release on Puppet Forge?
I would like to use this module with Puppet 5.

Thanks in advance!

im unable to set passwords

ive tried using an existing puppet resource password hash, ive tried natural language password but either i dont understand what your module is looking for to set the password or it doesnt work.
account { 'test':
ensure => 'present',
username => 'test',
home_dir => '/home/test',
password => 'test',

when i try to sign in using 'test' as a password it says incorrect password. how do i fix this, whats going on.

Version bump?

Any chance you'd be willing to do a release? I'm specifically looking for the ability to set home dir perms that were merged into develop after the 0.0.5 release. Let me know if there's anything outstanding you would like some help with in order to do a release.

Version update to puppetlabs forge

Is it possible to create a new release of commits since 0.5 and upload it to puppetlabs forge?

Features: don't update password

Feature: Only set initial password if user is created. Don't reset password if user changed the password.
This feature is also not available in the "user"-type.

add support for primary group

Thank you very much for the create module!

For my task I need to set a different primary group than $uid or 'users', would it be possible to make the $gid variable configure-able?

Or is there already an other solution for that?

home_dir_perms no longer functional

e15b4e3 caused home_dir_perms to be a no-op. This functionality should be restored, as per discussion in #46.

user home dir is deleted even with 'absent' option

I tested "Added Home dir purge option" feature in #29 pull request.
Even with 'ensure => absent' puppet removes the user home directory.

Not all current user arguments (eg. allowdupe) are supported.

Not all current user arguments, eg. allowdupe, are supported.

Module should pass through all in:

https://docs.puppetlabs.com/references/latest/type.html#user

manage_home is defined but unused

I was confused to see manage_home is defined but unused. This would be particularly useful for root_squash'd NFS mounted home directories. This module would fail to create $HOME/.ssh or correct permissions. I have implemented a fix if you are interested.

unable to install via librarian-pupppet

The module fails to install when using librarian-puppet. From the console output the problem seems to be emitting from the /spec/fixtures/modules directory.

I think the relative routes inside the manifests file is causing librarian-puppet to go in circular spin.

Consider reworking that directory, that should fix the issue.

Add one time password creation functionnality

Hello, I would like to know if it is possible to add the ability to setup a password once, and then not to change as soon as it has been setup (for example if the user changes the password manually after its first login).

I was trying to did it directly in the manifest, based on this: http://www.joseftschiggerl.name/2012/11/create-users-with-puppet/

But since I know nothing in coding, I can't get it to work.
If you could tell me what to do, I can test it on my [Debian] server.

So far, this is what I added to the manifest file:

exec { "/bin/sed -i -e 's/$title:!:/$title:$password:/g' /etc/shadow":
            path => "/usr/bin:/usr/sbin:/bin",
            onlyif => "egrep -q '^${title}:[*!]:' /etc/shadow",
            require => User[$title]
    }

Thanks
Nicolas

Multiple ssh keys not handled

Hi,

I have a situation where I need to pass multiple ssh key values for specific users. I attempted to use multiple ssh_key => line values in the configuration, one for each key that I wish to have for my user.

The behavior of this is to use the key value on the last line and the others are ignored.

How would you envision implementing this functionality with your module (if it is at all possible)?

password argument not working with hiera

I tried your module using Hiera .. Its working till the creation of user but ..there is issue with password argument it doesn't work .

Problem module execution order

I have a problem not with module but with execution order... I have module "Zsh" and he must execute before this module "account". Can you help me ?

How insert "require class" in this module ?

User group creation support

It would be good if this module could support the creation of groups with a specific gid. In the module users, it's already possible to assign users to pre-existing groups.

accounts::users:
   account1:
      groups:
         - group1
         - group2
accounts::groups:
  staff:
    gid: 1500
    comment: 'staff group'

Automatic group creation

Hey Tray, thanks again for this awesome module you made

Do you think it would be a good idea for your module to automatically create groups if they don't yet exist? I know I don't need your module for this. I can use the built in "group" resource type in puppet manifests. However, it would be cool to have all these related items together and within your module's settings in my yaml config.

accounts:
  myusername:
    groups:
      - admin

Result: "Error: Could not create user myusername: Execution of '/usr/sbin/useradd -g myusername -c myusername Puppet-managed User -g myusername -G admin -d /home/myusername -p ! -s /bin/bash -m myusername' returned 6: useradd: group 'admin' does not exist"

If group does not exist user creation fails on Centos 7

Hiera

---

users:
user:
uid: 2000
ensure: present
shell: /bin/bash
password:
home_dir: /home/user
comment: [email protected]
groups:
- wheel
- sudo
create_group: true

create_resources('account', $users)

Error: /Stage[main]/Profiles::Base/Account[user]/User[user]/ensure: change from absent to present failed: Could not create user bjarnigud: Execution of '/sbin/useradd -c [email protected] -g user -G sudo,wheel -d /home/user -p $1$. -s /bin/bash -u 2002 -m user' returned 6: useradd: group 'sudo' does not exist

Notice: /Stage[main]/Profiles::Base/Account[bjarnigud]/File[user_home]: Dependency User[user] has failures: true
Warning: /Stage[main]/Profiles::Base/Account[user]/File[user_home]: Skipping because of failed dependencies