CPU-LDAP(8)

📦 version 1.4.3, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 CPU-LDAP(8) 💖

okay so bestie, this is the manual page for cpu — a user administration tool for LDAP backends. It’s giving sysadmin but make it cute. 💅

🌸 NAME 🌸

cpu — a user administration tool for LDAP backends.

✨ SYNOPSIS ✨

cpu user{add,del,mod} [options] login

cpu group{add,del,mod} [options] group

cpu cat

🦋 DESCRIPTION 🦋

The ldap module for cpu is literally your girl for administering groups and users that live on an LDAP backend. It tries to keep complete compatibility with the GNU/Linux versions of the shadow utils when it comes to command line options. It also does some extra iconic stuff that traditional user utilities don’t, like letting you pick which hash to use for the user, generating random or linear uid’s and gid’s, and pulling a user’s info from existing password and shadow files. 💖

💜 LDAP OPTIONS 💜

These are the LDAP-server-specific options, bestie. You can mix them with any of the cpu functions. ✨

  • -2, --2 — lowkey makes it use LDAPv2 instead of LDAPv3.
  • -a file, --addfile=file — if you hand it a filename, it gets parsed and any extra ldap attributes in that file get added along with the user or group. Warning: this file should not contain any attributes that CPU requires or that you already specified in the config file. If you do that, the modification/addition will fail or create multivalued attributes. The format should be:
<attrdesc>: <attrvalue>
<attrdesc>: <attrvalue>
<attrdesc>:: <base64-encoded-value>
...
  • -A cn, --cn=cn — this one tells cpu what a user’s dn should look like. If you specify -A foo for some user, their dn will look like foo=username,.... You can also set this in the config file with USER_CN_STRING.
  • -B base, --groupbase=base — the base to search for groups in. This is required for useradd and for any group functions. Make it a fully qualified base, like ou=groups,o=company,c=us. This corresponds to the GROUP_BASE configuration option.
  • -D bind_dn, --binddn=bind_dn — bind_dn should be a DN with adequate credentials for the operation you’re requesting. This corresponds to the BIND_DN configuration file option.
  • -F[file], --passfile[=file] — if an argument is provided, that file should be in Unix-style password format. If no argument is provided, the config file variable PASSWORD_FILE will be used. Please be sure that the switch (-F or --passfile) has no trailing whitespace — it should be immediately followed by the argument. The information associated with the user will be used for populating their LDAP entry (uid, gid, gecos, home directory, shell). 🫶
  • -H hash, --hash=hash — hash should be one of sha1, md5, ssha1, smd5, crypt, md5crypt or clear. This corresponds to the HASH configuration file variable. Select the hash that is being used at your site.
  • -N hostname, --hostname=hostname — hostname should be the hostname running the LDAP service. This may be an IP address or hostname. This corresponds to the LDAP_HOST variable in the configuration file.
  • -o, --nonposix — violate POSIX naming standards and allow characters in user and group names not in the character set [A-Za-z0-9._-]. This is useful for things like adding Samba machine accounts. not me encouraging chaos 💀
  • -P port, --port=port — port should be the port that the LDAP server is listening on. This corresponds to the LDAP_PORT option in the configuration file.
  • -R length, --random=random — length should be the length you’d like a randomly generated password to be. This password will be displayed to the user.
  • -S[file], --shadfile[=file] — if an argument is provided, that file should be in Unix-style shadow format. If no argument is provided, the config file variable SHADOW_FILE will be used. Please be sure that the switch (-S or --shadfile) has no trailing whitespace — it should be immediately followed by the argument. The information associated with the user will be used for populating their LDAP entry (password, sp_lstchg, sp_min, sp_max, sp_warn, sp_inact, sp_expire). 🌸
  • -t timeout, --timeout=timeout — this value specifies how long (in seconds) before LDAP operations should time out. The corresponding configuration file is TIMEOUT.
  • -U base, --userbase=base — the base to search for users in. This is required for any user functions. Make it fully qualified, like ou=users,o=company,c=us. This corresponds to the USER_BASE configuration option.
  • -w[pass], --bindpass[=pass] — if an argument is provided, that value will be used for the bind password. If no argument is provided, the user will be prompted for a password. This option can be omitted by specifying the password in the config file with BIND_PASS. If a value is specified at the command line, the switch should have no whitespace following it.
  • -x, --tls — try to starttls before talking with the ldap server.

The following options can be used for populating LDAP attributes.

  • -f name, --firstname=name — name is used in possible combination with lastname in order to have a more complete CN. This value is also used for the givenName (gn) attribute. This value is not required by RFC2307.
  • -E name, --lastname=name — name is used in possible combination with firstname in order to have a more complete CN. This value is also used for the surname (sn) attribute. This value is not required by RFC2307.
  • -e address, --email=address — the value address is used to populate the mail attribute. This attribute is not required by RFC2307 for posixAccount but many people’s LDAP schemas do require it. inetOrgPerson is one object that contains it.

The following options are not LDAP specific.

  • -h, --help — display help. 🫶
  • -v, --verbose — turn the verbose level up.
  • -V, --version — display the version of the module.

🐱 cpu cat 🐱

The cat command will cause any users and groups stored in the LDAP directory to be displayed in a Unix-style format. cat requires no options.

👑 cpu useradd [options] login 👑

The useradd function is used to add new users to an LDAP directory. The options are similar to those used by traditional GNU/Linux user administration utilities.

  • -c comment, --gecos=comment — the value specified is used to populate the gecos attribute. You can specify a default value in the config file using the GECOS variable. This is not required by RFC2307. This can also be populated using the -F option (see above).
  • -d home_dir, --directory=home_dir — the new user will be created using home_dir as the value for the user’s login directory. The default is to append login to HOME_DIRECTORY (from the configuration file) and use that as the login directory name. This is required by RFC2307.
  • -g initial_group, --gid=initial_group — the group id or name of the user’s initial login group. The group should exist but does not have to. CPU will search the LDAP directory and warn you if that group does not exist. If the group does exist, the user’s gidNumber will be set to the gidNumber of that group. This is required by RFC2307. If unspecified, CPU will search for the next unused GID. This behavior can be adjusted by MAX_GIDNUMBER, MIN_GIDNUMBER, ID_MAX_PASSES, and RANDOM in the configuration file.
  • -G group,[...], --sgroup=group,[...] — a list of supplementary groups which the user is also a member of. Each group is separated from the next by a comma, with no intervening whitespace. CPU will search the directory for these groups, and if found, add the user to those groups. The default is for the user to belong only to the initial group.
  • -k[skeleton_dir], --skel[=skeleton_dir] — this option is only useful if specified along with the -m option. If both are specified, the contents of skeleton_dir will be copied to the user’s new home directory. If skeleton_dir is specified, it should have no whitespace between the command line switch. If skeleton_dir is not specified, the value of SKEL_DIR as specified in the configuration file will be used.
  • -m, --makehome — the user’s home directory will be created if it does not exist. The files contained in skeleton_dir will be copied to the home directory if the -k option is used. The -k option is only valid in conjunction with the -m options. The default is to not create the directory and to not copy any files.
  • -p[passwd], --password[=password] — the encrypted or unencrypted password. If no argument is given, the user is prompted to enter a password. If CPU was compiled with libcrack, the password will be checked for weakness. If the password is encrypted, hash should be the value of the hash type that was used. If not specified at the command line or found in the shadow file (if -S was used), * is used which should lock the account. 🔒
  • -s shell, --shell=shell — the name of the user’s login shell. If not specified at the command line, one can specify it with the DEFAULT_SHELL configuration file option. This is not required by RFC2307.
  • -u uid, --uid=uid — the numerical value of the user’s ID. This value must be unique, the value must be non-negative. If unspecified, CPU will search for an unused UID. This behavior can be adjusted by MAX_UIDNUMBER, MIN_UIDNUMBER, ID_MAX_PASSES, and RANDOM in the configuration file.
  • -X script, --exec=script — after the user has successfully been added to the directory, execute this script. The script is passed the login name. If this option is not supplied, the configuration file will be checked for ADD_SCRIPT.

💅 cpu usermod [options] login

Okay so usermod is the glow-up command. You're not making a new user, you're giving the existing one a makeover. And here's the tea: every single option that works with useradd also works here — with exactly one exception, and that exception is -k. Not -k, bestie. We don't do -k here. Periodt. ✨

the options, babes

  • -l login_name, --newusername=login_name — full rebrand incoming 👑 The user's name gets switched from login over to login_name. The LDAP attributes cn and uid both get changed to login_name, and the user's rdn gets modified too. And if you pair this with the -m switch? Then their old home directory gets copied over to the appropriate new location — peep the -d switch for how that behavior actually shakes out. (iykyk, read the fine print.)
  • -L, --lock — locks the given user account. 🔒 Not today, hacker.
  • -U, --unlock — unlocks the given user account. 🔓 welcome back, king.

🗑️ cpu userdel [options] login

This one modifies the LDAP directory and deletes all the entries that refer to login. The named user must exist — no ghosting a user who was never there, it's giving error energy. Here are the options that apply to userdel:

  • -r, --removehome — files in the user's home directory get removed right along with the home directory itself. 🧹 But the user's mail spool is not deleted — that survives, untouched. And any files chilling in other file systems? You gotta go search for those and delete them manually, sorry bestie, no shortcut for that one.
  • -X script, --exec=script — once the user has successfully been removed from the directory, run this script. 🎬 The script gets the login name passed to it. And if you don't supply this option? Then the configuration file gets checked for DEL_SCRIPT instead. No cap.

🎀 cpu groupadd [options] group

New group account, who dis? 💖 The groupadd command creates a brand new group account using the values you specify on the command line plus the default values from the configuration file. The new group gets entered into the LDAP directory as needed. Options that apply to groupadd:

  • -g gid, --gid=gid — the numerical value of the group's ID. This value should be unique (key word: should, and you know how that goes). The value must be non-negative — no negatives allowed, that's a hard no. And plot twist: you can get a brand new gid generated for you just by not specifying this option at all. That generation can be modified by changing the configuration file. Cute, right? 🦋

✨ cpu groupmod [options] group

This one modifies the group you named on the command line. Options that apply to groupmod:

  • -g gid, --gid=gid — the numerical value of the group's ID. This value should be unique. The value must be non-negative. Same rules as always, we're consistent here. 💅
  • -n group_name, --newgroupname=group_name — the group's name gets changed from group to group_name. The cn and the rdn get modified too. Glow-up complete. 🌸

🌈 cpu groupdel [options] group

And finally, groupdel removes the group you named on the command line from the LDAP directory. That's it, that's the whole vibe. Gone. Bye. 👋

👀 SEE ALSO

👑 AUTHORS

Blake Matheny <bmatheny@purdue.edu> — legend behavior, honestly.

The current version of this software is always available at http://cpu.sourceforge.net 🌐

🐛 BUGS

To report a bug or problem, please e-mail:

cpu-users@lists.sourceforge.net

Do it, bestie, they wanna hear from you 🫶

📝 TODO

See the TODO file that accompanied the software. And please — please — e-mail them with any additional suggestions. They're literally asking. Don't leave them on read. 😭

okay that's the whole page!! every flag, every path, every email, every vibe — all accounted for 💖

this page is from CPU-LDAP(8), dated 17 February 2003 — yeah, she's an elder but she still ate 🔥 ✨🧚💜

📦 where this page comes from