Next Previous Contents

2. System Administration

This section describes libuser's configuration file and bundled applications which may be of use to system administrators.

2.1 Configuration

The libuser configuration file is named libuser.conf and usually lives in /etc. Its format is the common format used by numerous other programs. Sections are marked by the section name enclosed in square brackets ([section]), and configuration directives within these sections are of the form key = value.

The defaults, userdefaults, and groupdefaults sections are used by the library itself. The defaults section specifies the directory where modules can be found (moduledir) and lists the modules to be consulted when looking up user information.

There are two lists of modules because libuser separates an account's authentication information from other information. This is done to allow different information stores to be used for these functions, and because some information stores can only hold authentication data (for example, shadow).

For the info_modules and auth_modules lists, order is only important for account creation -- the library will attempt to create a data entry for the user in each of the modules until one of them succeeds (so if you prefer new accounts to be created in your LDAP directory, then you'd make sure "ldap" was listed before "files"). For looking up account information, the order determines precedence because the library stops searching after a module returns success (so again, you'd want "ldap" listed before "files"). Account modifications and deletions go straight to the information store which is known to hold the user's information.

2.2 Modules

Specific modules implement access to specific information stores. The modules included in the source distribution are the files and shadow modules. Modules can supply and manipulate either (or both) of two distinct types of data about a user: generic user information (the UID, home directory, etc.), and authentication-related information.

files

The files module implements both information and authentication data stores using the standard passwd and group files.

This module uses the files section of the configuration file to store configuration data. It presently recognizes these flags:

shadow

The shadow module implements only an authentication data store using the shadow and the gshadow files. While the format of these files (and even the existence of the gshadow file) varies between OSs, this module supports the same file formats used by the shadow password suite.

This module uses the shadow section of the configuration file to store configuration data. It presently recognizes these flags:

ldap

The ldap module implements both information and authentication data stores using an LDAP directory and a schema which (should) conform to RFC2307. The module expects the client and server to support access using LDAPv3 with TLS; TLS is not required if the server is specified by URI.

This module uses the ldap section of the configuration file to store configuration data. It presently recognizes these flags:

2.3 Applications

Sample testbed applications which mimic the behavior of certain parts of the shadow password suite are included in the libuser distribution. To allow them to be used alongside existing utilities, their names have been prefixed with the letter 'l'.

As of this writing (version 0.7), this list of tools includes workalikes for useradd, usermod, userdel, groupadd, groupmod, groupdel, and chage. It should be noted that none of these tools provide a means for modifying the defaults they use, and no functions for creating, populating, moving, or deleting user home directories are implemented.


Next Previous Contents