Automated User Management Script for Linux Systems

Nowadays managing user accounts properly is extremely important for DevOps professionals working in dynamic IT setups.
The pro of user provisioning is that it saves time, ensures consistency , security across systems and improve efficiency since much of the process can be automated.

In this article, we will discuss about bash script and how to create a bash script that can be used for creating and managing accounts of users on Linux servers.

In this article we will be writing a script which that reads a text file containing the employee’s usernames and group names, where each line is formatted as “user;groups”.

This script will create users and groups as specified, set up home directories with appropriate permissions and ownership, generate random passwords for the users, and log all actions to var/log/user_management.log

Additionally, it will store the generated passwords securely in /var/secure/user_passwords.txt.
we will ensure error handling for scenarios like existing users by the script.

Each User will have a personal group with the same group name as the username, this group name will not be written in the text file

A user can have multiple groups, each group delimited by comma “,”

Usernames and user groups are separated by semicolon “;”
For example;

light; sudo,dev,www-data
idimma; sudo
mayowa; dev,www-data

Where light is username and groups are sudo, dev, www-data
Firstly,

The #!/bin/bash is the shebang symbol which tells the OS which interpreter to use and in our case its will use the bash shell.

if [ “$EUID” -ne 0 ]; this will check if script is run as “root” as this ensure that we have administrative access to perform task that requires super privileges which value of ID is assigned zero (0).
EUID means the effective user ID and -ne ( a numeric comparison which means not equal)

Next;

We will ensure that a positional argument is passed to the script and if not passed, it will exit (1) and echo the message “Usage: bash create_user.sh “, to enable the user pass appropriate argument.

The -z is a string value which means value has a length of zero and “$1” indicate the first parameter after the script name($0) which is assigned a variable name INPUT_FILE. So it checks if the first positional parameter is empty.

Next;

So we will create a directory_ /var/secure and create a file _user_password.txt in it where we are going to store user password in a secure way using permission “600” grant read , write permission (rw) to only the owner and create file management.log in the /var/log directory to log all event.

The first positional parameter($1) is assigned INPUT_FILE as variable

Next;

We will be using OpenSSL command rand to generate a cryptographic password which is base64 encoded (strong and resistant as it contain letters, number and characters).
This function is going to generate the password and we are going to call it in the script.

Next;

Let’s process the input file;

IFS means Internal Field Separator; this is an environment variable which define a list of characters the Bash shell uses as field separators. These include space, tab, newline.

Use the while condition to read the username and group taking note of the separators by the IFS.

We will create a personal group for the user but before then we will check the system group database (/etc/group) using the getent command to ensure the group is not present.

We will add a negate operator (!) which will negate the expression and makes it True, if the $group does not exist thereby causing it to create the group if it doesn’t exist using the groupadd command.

If user already exist then our shell script will throw an error message indicating that user exist but we want to redirect such output( standard error or output) to the /dev/null and the tee reads the output and save it silently in the $LOG_FILE.

We then use the continue to create user if user does not exist.

Let’s add create user and add to the personal group using the popular command useradd and use the -m(to add a home directory for the user, -s (to set the shell to /bin/bash).

If the user is created and added to the personal group successfully this make the exit status ($?) equal zero (0) and it print the success message “Created user $username with a personal group $username” to the $LOG_FILE and if not it execute the else statement.

Next;

Let’s call the function to generate the password and set password for the user using chpasswd (change password) , write the username,password into the $PASSWORD_FILE and log it.

chpasswd is designed to process multiple username and password pairs from standard input (usually via a pipe | or a redirection <)
.

Next,

we will be creating other group which user will be by passing the $groups as an array and iterate over it by “${group_array[@]}” where “@” insinuate every character.

The character -n is also similar to the -z only that it describe value which length is greater than zero

We will check the system group database (/etc/group) using the getent command but will add a negate operator (!) which will negate the expression and makes it True, if the $group does not exist thereby causing it to create the group if it doesn’t exist using the groupadd command as previously discussed.

Next;

we then add the user to group using the usermod -aG command
Finally,

we will close our while loop condition and pass the $INPUT_FILE to read lines from it.
Create a directory, touch a file named create.sh (shell script) in the directory and make the file executable;

open the create and paste this script;

Create a file (input_file.txt) containing username;groups

Run the script and pass the input_file.txt as argument.

Thank you for reading, to learn more kindly join the HNG internship programme to get your tech skill upgraded and land you dream job.
Follow this link
https://hng.tech/internship,
https://hng.tech/hire

hsh