Samba Active Directory family user setup script

infrastructure/setup/cr_samba_family_users.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+GROUP="family"
+PSO="family-relaxed"
+PRECEDENCE="200"
+
+[[ $# -eq 1 ]] || { echo "Usage: $0 user1,user2,user3"; exit 1; }
+
+SUDO=(sudo)
+[[ "${EUID}" -eq 0 ]] && SUDO=()
+
+IFS=',' read -ra USERS <<< "$1"
+
+# Return 0 if the given option string appears in pso create --help
+pso_supports() {
+  local opt="$1"
+  "${SUDO[@]}" samba-tool domain passwordsettings pso create --help 2>&1 | grep -q -- "${opt}"
+}
+
+echo "Ensuring group exists: ${GROUP}"
+if ! "${SUDO[@]}" samba-tool group show "${GROUP}" >/dev/null 2>&1; then
+  "${SUDO[@]}" samba-tool group add "${GROUP}"
+else
+  echo "Group ${GROUP} already exists"
+fi
+
+echo "Ensuring relaxed password policy exists: ${PSO}"
+if ! "${SUDO[@]}" samba-tool domain passwordsettings pso show "${PSO}" >/dev/null 2>&1; then
+  # Build args using only options supported by this samba-tool build.
+  ARGS=( domain passwordsettings pso create "${PSO}" "${PRECEDENCE}" )
+
+  # Min length
+  if pso_supports --min-pwd-length; then
+    ARGS+=( --min-pwd-length=4 )
+  fi
+
+  # Complexity off
+  if pso_supports --complexity; then
+    ARGS+=( --complexity=off )
+  fi
+
+  # Never expire
+  if pso_supports --max-pwd-age; then
+    ARGS+=( --max-pwd-age=0 )
+  fi
+  if pso_supports --min-pwd-age; then
+    ARGS+=( --min-pwd-age=0 )
+  fi
+
+  # Password history option name varies across builds
+  if pso_supports --pwd-history-length; then
+    ARGS+=( --pwd-history-length=0 )
+  elif pso_supports --password-history; then
+    ARGS+=( --password-history=0 )
+  fi
+
+  # Lockout option names vary too; only add if supported
+  if pso_supports --lockout-threshold; then
+    ARGS+=( --lockout-threshold=0 )
+  elif pso_supports --lockout-limit; then
+    ARGS+=( --lockout-limit=0 )
+  fi
+
+  echo "Creating PSO ${PSO} with supported options..."
+  "${SUDO[@]}" samba-tool "${ARGS[@]}"
+else
+  echo "PSO ${PSO} already exists"
+fi
+
+echo "Applying PSO ${PSO} to group ${GROUP}"
+out="$("${SUDO[@]}" samba-tool domain passwordsettings pso apply "${PSO}" "${GROUP}" 2>&1)" || true
+if echo "$out" | grep -q "already applies"; then
+  echo "PSO ${PSO} already applies to ${GROUP}"
+elif echo "$out" | grep -qi "^ERROR:"; then
+  echo "$out" >&2
+  exit 1
+else
+  echo "$out"
+fi
+
+echo "Creating/ensuring users and adding to ${GROUP}"
+for user in "${USERS[@]}"; do
+  user="$(echo "$user" | xargs)"
+  [[ -n "$user" ]] || continue
+
+  echo "  - ${user}"
+  if ! "${SUDO[@]}" samba-tool user show "${user}" >/dev/null 2>&1; then
+      TMPPW="$(openssl rand -base64 36 | tr -d '\n' | tr '/+' 'Aa' | cut -c1-20)1aA!"
+      "${SUDO[@]}" samba-tool user create "${user}" "${TMPPW}"
+      echo "    created with temporary strong password"
+  else
+      echo "    user exists"
+  fi
+
+  # membership first
+  "${SUDO[@]}" samba-tool group addmembers "${GROUP}" "${user}" >/dev/null 2>&1 || true
+
+  # now set the final (possibly weak) password under the PSO
+  echo "    set final password for ${user}"
+  "${SUDO[@]}" samba-tool user setpassword "${user}"
+done
+
+echo "Done."
+echo "Verify:"
+echo "  sudo samba-tool group listmembers ${GROUP}"
+echo "  sudo samba-tool domain passwordsettings pso show-user anna"