3 # Copyright (c) 2002-2004 Michael Telahun Makonnen. All rights reserved.
5 # Redistribution and use in source and binary forms, with or without
6 # modification, are permitted provided that the following conditions
8 # 1. Redistributions of source code must retain the above copyright
9 # notice, this list of conditions and the following disclaimer.
10 # 2. Redistributions in binary form must reproduce the above copyright
11 # notice, this list of conditions and the following disclaimer in the
12 # documentation and/or other materials provided with the distribution.
14 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 # IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 # OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 # IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 # INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 # NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 # DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 # THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 # Email: Mike Makonnen <mtm@FreeBSD.Org>
31 # Display $msg on stderr, unless we're being quiet.
34 if [ -z "$quietflag" ]; then
35 echo 1>&2 ${THISCMD}: ERROR: $*
40 # Display $msg on stdout, unless we're being quiet.
43 if [ -z "$quietflag" ]; then
44 echo ${THISCMD}: INFO: $*
49 # Output the value of $_uid if it is available for use. If it
50 # is not, output the value of the next higher uid that is available.
51 # If a uid is not specified, output the first available uid, as indicated
58 if [ -z "$_uid" ]; then
59 _nextuid="`${PWCMD} usernext | cut -f1 -d:`"
62 ${PWCMD} usershow $_uid > /dev/null 2>&1
63 if [ ! "$?" -eq 0 ]; then
74 # Display usage information for this utility.
77 echo "usage: ${THISCMD} [options]"
78 echo " options may include:"
79 echo " -C save to the configuration file only"
80 echo " -D do not attempt to create the home directory"
81 echo " -E disable this account after creation"
82 echo " -G additional groups to add accounts to"
83 echo " -L login class of the user"
84 echo " -N do not read configuration file"
85 echo " -S a nonexistent shell is not an error"
86 echo " -d home directory"
87 echo " -f file from which input will be received"
88 echo " -g default login group"
89 echo " -h display this usage message"
90 echo " -k path to skeleton home directory"
91 echo " -m user welcome message file"
92 echo " -q absolute minimal user feedback"
94 echo " -u uid to start at"
95 echo " -w password type: no, none, yes or random"
99 # Outputs a list of valid shells from /etc/shells. Only the
100 # basename of the shell is output.
105 while read _path _junk ; do
110 echo -n "${_prefix}`basename $_path`"
116 # /usr/sbin/nologin is a special case
117 [ -x "${NOLOGIN_PATH}" ] && echo -n " ${NOLOGIN}"
120 # fullpath_from_shell shell
121 # Given $shell, which is either the full path to a shell or
122 # the basename component of a valid shell, get the
123 # full path to the shell from the /etc/shells file.
125 fullpath_from_shell() {
127 [ -z "$_shell" ] && return 1
129 # /usr/sbin/nologin is a special case; it needs to be handled
130 # before the cat | while loop, since a 'return' from within
131 # a subshell will not terminate the function's execution, and
132 # the path to the nologin shell might be printed out twice.
134 if [ "$_shell" = "${NOLOGIN}" -o \
135 "$_shell" = "${NOLOGIN_PATH}" ]; then
141 while read _path _junk ; do
146 if [ "$_path" = "$_shell" -o \
147 "`basename $_path`" = "$_shell" ]; then
159 # If the given shell is listed in ${ETCSHELLS} or it is
160 # the nologin shell this function will return 0.
161 # Otherwise, it will return 1. If shell is valid but
162 # the path is invalid or it is not executable it
163 # will emit an informational message saying so.
168 _shellchk="${GREPCMD} '^$_sh$' ${ETCSHELLS} > /dev/null 2>&1"
170 if ! eval $_shellchk; then
171 # The nologin shell is not listed in /etc/shells.
172 if [ "$_sh" != "${NOLOGIN_PATH}" ]; then
173 err "Invalid shell ($_sh) for user $username."
178 info "The shell ($_sh) does not exist or is not executable."
184 # Save some variables to a configuration file.
185 # Note: not all script variables are saved, only those that
186 # it makes sense to save.
189 echo "# Configuration file for adduser(8)." > ${ADDUSERCONF}
190 echo "# NOTE: only *some* variables are saved." >> ${ADDUSERCONF}
191 echo "# Last Modified on `${DATECMD}`." >> ${ADDUSERCONF}
192 echo '' >> ${ADDUSERCONF}
193 echo "defaultLgroup=$ulogingroup" >> ${ADDUSERCONF}
194 echo "defaultclass=$uclass" >> ${ADDUSERCONF}
195 echo "defaultgroups=$ugroups" >> ${ADDUSERCONF}
196 echo "passwdtype=$passwdtype" >> ${ADDUSERCONF}
197 echo "homeprefix=$homeprefix" >> ${ADDUSERCONF}
198 echo "defaultshell=$ushell" >> ${ADDUSERCONF}
199 echo "udotdir=$udotdir" >> ${ADDUSERCONF}
200 echo "msgfile=$msgfile" >> ${ADDUSERCONF}
201 echo "disableflag=$disableflag" >> ${ADDUSERCONF}
205 # Add a user to the user database. If the user chose to send a welcome
206 # message or lock the account, do so.
210 # Is this a configuration run? If so, don't modify user database.
212 if [ -n "$configflag" ]; then
233 _name="-n '$username'"
234 [ -n "$uuid" ] && _uid='-u "$uuid"'
235 [ -n "$ulogingroup" ] && _group='-g "$ulogingroup"'
236 [ -n "$ugroups" ] && _grouplist='-G "$ugroups"'
237 [ -n "$ushell" ] && _shell='-s "$ushell"'
238 [ -n "$uclass" ] && _class='-L "$uclass"'
239 [ -n "$ugecos" ] && _comment='-c "$ugecos"'
240 [ -n "$udotdir" ] && _dotdir='-k "$udotdir"'
241 [ -n "$uexpire" ] && _expire='-e "$uexpire"'
242 [ -n "$upwexpire" ] && _pwexpire='-p "$upwexpire"'
243 if [ -z "$Dflag" -a -n "$uhome" ]; then
244 # The /nonexistent home directory is special. It
245 # means the user has no home directory.
246 if [ "$uhome" = "$NOHOME" ]; then
249 _home='-m -d "$uhome"'
251 elif [ -n "$Dflag" -a -n "$uhome" ]; then
256 _passwdmethod="-w no"
260 # Note on processing the password: The outer double quotes
261 # make literal everything except ` and \ and $.
262 # The outer single quotes make literal ` and $.
263 # We can ensure the \ isn't treated specially by specifying
264 # the -r switch to the read command used to obtain the input.
266 _passwdmethod="-w yes"
268 _upasswd='echo "$upass" |'
271 _passwdmethod="-w none"
274 _passwdmethod="-w random"
278 _pwcmd="$_upasswd ${PWCMD} useradd $_uid $_name $_group $_grouplist $_comment"
279 _pwcmd="$_pwcmd $_shell $_class $_home $_dotdir $_passwdmethod $_passwd"
280 _pwcmd="$_pwcmd $_expire $_pwexpire"
282 if ! _output=`eval $_pwcmd` ; then
283 err "There was an error adding user ($username)."
286 info "Successfully added ($username) to the user database."
287 if [ "random" = "$passwdtype" ]; then
288 randompass="$_output"
289 info "Password for ($username) is: $randompass"
293 if [ -n "$disableflag" ]; then
294 if ${PWCMD} lock $username ; then
295 info "Account ($username) is locked."
297 info "Account ($username) could NOT be locked."
304 if [ -n "$msgflag" ]; then
305 [ -r "$msgfile" ] && {
306 # We're evaluating the contents of an external file.
307 # Let's not open ourselves up for attack. _perms will
308 # be empty if it's writeable only by the owner. _owner
309 # will *NOT* be empty if the file is owned by root.
311 _dir="`dirname $msgfile`"
312 _file="`basename $msgfile`"
313 _perms=`/usr/bin/find $_dir -name $_file -perm +07022 -prune`
314 _owner=`/usr/bin/find $_dir -name $_file -user 0 -prune`
315 if [ -z "$_owner" -o -n "$_perms" ]; then
316 err "The message file ($msgfile) may be writeable only by root."
320 while read _line ; do
322 done | ${MAILCMD} -s"Welcome" ${username}
323 info "Sent welcome message to ($username)."
329 # Reads username of the account from standard input or from a global
330 # variable containing an account line from a file. The username is
331 # required. If this is an interactive session it will prompt in
332 # a loop until a username is entered. If it is batch processing from
333 # a file it will output an error message and return to the caller.
338 # No need to take down user names if this is a configuration saving run.
339 [ -n "$configflag" ] && return
342 if [ -z "$fflag" ]; then
346 _input="`echo "$fileline" | cut -f1 -d:`"
349 # There *must* be a username. If this is an interactive
350 # session give the user an opportunity to retry.
352 if [ -z "$_input" ]; then
353 err "You must enter a username!"
354 [ -z "$fflag" ] && continue
362 # Reads extra information about the user. Can be used both in interactive
363 # and batch (from file) mode.
368 # No need to take down additional user information for a configuration run.
369 [ -n "$configflag" ] && return
371 if [ -z "$fflag" ]; then
372 echo -n "Full name: "
375 _input="`echo "$fileline" | cut -f7 -d:`"
381 # Get the account's shell. Works in interactive and batch mode. It
382 # accepts either the base name of the shell or the full path.
383 # If an invalid shell is entered it will simply use the default shell.
388 ushell="$defaultshell"
390 # Make sure the current value of the shell is a valid one
391 if [ -z "$Sflag" ]; then
392 if ! shell_exists $ushell ; then
393 info "Using default shell ${defaultshell}."
394 ushell="$defaultshell"
398 if [ -z "$fflag" ]; then
399 echo -n "Shell ($shells) [`basename $ushell`]: "
402 _input="`echo "$fileline" | cut -f9 -d:`"
404 if [ -n "$_input" ]; then
405 if [ -n "$Sflag" ]; then
408 _fullpath=`fullpath_from_shell $_input`
409 if [ -n "$_fullpath" ]; then
412 err "Invalid shell ($_input) for user $username."
413 info "Using default shell ${defaultshell}."
414 ushell="$defaultshell"
421 # Reads the account's home directory. Used both with interactive input
426 if [ -z "$fflag" ]; then
427 echo -n "Home directory [${homeprefix}/${username}]: "
430 _input="`echo "$fileline" | cut -f8 -d:`"
433 if [ -n "$_input" ]; then
435 # if this is a configuration run, then user input is the home
436 # directory prefix. Otherwise it is understood to
439 [ -z "$configflag" ] && homeprefix="`dirname $uhome`" || homeprefix="$uhome"
441 uhome="${homeprefix}/${username}"
446 # Reads a numeric userid in an interactive or batch session. Automatically
447 # allocates one if it is not specified.
450 if [ -z "$uuid" ]; then
457 # No need to take down uids for a configuration saving run.
458 [ -n "$configflag" ] && return
460 if [ -n "$uuid" ]; then
461 _prompt="Uid [$uuid]: "
463 _prompt="Uid (Leave empty for default): "
465 if [ -z "$fflag" ]; then
469 _input="`echo "$fileline" | cut -f2 -d:`"
472 [ -n "$_input" ] && uuid=$_input
473 uuid=`get_nextuid $uuid`
478 # Reads login class of account. Can be used in interactive or batch mode.
481 uclass="$defaultclass"
483 _class=${uclass:-"default"}
485 if [ -z "$fflag" ]; then
486 echo -n "Login class [$_class]: "
489 _input="`echo "$fileline" | cut -f4 -d:`"
492 [ -n "$_input" ] && uclass="$_input"
496 # Reads user's login group. Can be used in both interactive and batch
497 # modes. The specified value can be a group name or its numeric id.
498 # This routine leaves the field blank if nothing is provided and
499 # a default login group has not been set. The pw(8) command
500 # will then provide a login group with the same name as the username.
503 ulogingroup="$defaultLgroup"
506 if [ -z "$fflag" ]; then
507 echo -n "Login group [${ulogingroup:-$username}]: "
510 _input="`echo "$fileline" | cut -f3 -d:`"
513 # Pw(8) will use the username as login group if it's left empty
514 [ -n "$_input" ] && ulogingroup="$_input"
518 # Read additional groups for the user. It can be used in both interactive
522 ugroups="$defaultgroups"
524 _group=${ulogingroup:-"${username}"}
526 if [ -z "$configflag" ]; then
527 [ -z "$fflag" ] && echo -n "Login group is $_group. Invite $username"
528 [ -z "$fflag" ] && echo -n " into other groups? [$ugroups]: "
530 [ -z "$fflag" ] && echo -n "Enter additional groups [$ugroups]: "
534 [ -n "$_input" ] && ugroups="$_input"
538 # Read expiry information for the account and also for the password. This
539 # routine is used only from batch processing mode.
542 upwexpire="`echo "$fileline" | cut -f5 -d:`"
543 uexpire="`echo "$fileline" | cut -f6 -d:`"
547 # Read the password in batch processing mode. The password field matters
548 # only when the password type is "yes" or "random". If the field is empty and the
549 # password type is "yes", then it assumes the account has an empty passsword
550 # and changes the password type accordingly. If the password type is "random"
551 # and the password field is NOT empty, then it assumes the account will NOT
552 # have a random password and set passwdtype to "yes."
555 # We may temporarily change a password type. Make sure it's changed
556 # back to whatever it was before we process the next account.
558 [ -n "$savedpwtype" ] && {
559 passwdtype=$savedpwtype
563 # There may be a ':' in the password
564 upass=${fileline#*:*:*:*:*:*:*:*:*:}
566 if [ -z "$upass" ]; then
569 # if it's empty, assume an empty password
585 # Reads a line of account information from standard input and
586 # adds it to the user database.
591 while read -r fileline ; do
612 # Prompts for user information interactively, and commits to
615 input_interactive() {
642 # The case where group = user is handled elsewhere, so
643 # validate any other groups the user is invited to.
644 until [ "$_logingroup_ok" = yes ]; do
647 if [ -n "$ulogingroup" -a "$username" != "$ulogingroup" ]; then
648 if ! ${PWCMD} show group $ulogingroup > /dev/null 2>&1; then
649 echo "Group $ulogingroup does not exist!"
654 until [ "$_groups_ok" = yes ]; do
657 for i in $ugroups; do
658 if [ "$username" != "$i" ]; then
659 if ! ${PWCMD} show group $i > /dev/null 2>&1; then
660 echo "Group $i does not exist!"
672 echo -n "Use password-based authentication? [$_usepass]: "
674 [ -z "$_input" ] && _input=$_usepass
679 [Yy][Ee][Ss]|[Yy][Ee]|[Yy])
681 echo -n "Use an empty password? (yes/no) [$_emptypass]: "
683 [ -n "$_input" ] && _emptypass=$_input
686 echo -n "Use a random password? (yes/no) [$_random]: "
688 [ -n "$_input" ] && _random="$_input"
690 [Yy][Ee][Ss]|[Yy][Ee]|[Yy])
696 [ -n "$configflag" ] && break
697 trap 'stty echo; exit' 0 1 2 3 15
699 echo -n "Enter password: "
702 echo -n "Enter password again: "
706 # if user entered a blank password
707 # explicitly ask again.
708 [ -z "$upass" -a -z "$_passconfirm" ] \
711 [Yy][Ee][Ss]|[Yy][Ee]|[Yy])
716 # invalid answer; repeat the loop
720 if [ "$upass" != "$_passconfirm" ]; then
721 echo "Passwords did not match!"
728 # invalid answer; repeat loop
734 _disable=${disableflag:-"no"}
736 echo -n "Lock out the account after creation? [$_disable]: "
738 [ -z "$_input" ] && _input=$_disable
743 [Yy][Ee][Ss]|[Yy][Ee]|[Yy])
747 # invalid answer; repeat loop
754 # Display the information we have so far and prompt to
757 _disable=${disableflag:-"no"}
758 [ -z "$configflag" ] && printf "%-10s : %s\n" Username $username
773 [ -z "$configflag" ] && printf "%-10s : %s\n" "Password" "$_pass"
774 [ -n "$configflag" ] && printf "%-10s : %s\n" "Pass Type" "$passwdtype"
775 [ -z "$configflag" ] && printf "%-10s : %s\n" "Full Name" "$ugecos"
776 [ -z "$configflag" ] && printf "%-10s : %s\n" "Uid" "$uuid"
777 printf "%-10s : %s\n" "Class" "$uclass"
778 printf "%-10s : %s %s\n" "Groups" "${ulogingroup:-$username}" "$ugroups"
779 printf "%-10s : %s\n" "Home" "$uhome"
780 printf "%-10s : %s\n" "Shell" "$ushell"
781 printf "%-10s : %s\n" "Locked" "$_disable"
783 echo -n "OK? (yes/no): "
789 [Yy][Ee][Ss]|[Yy][Ee]|[Yy])
801 #### END SUBROUTINE DEFINITION ####
803 THISCMD=`/usr/bin/basename $0`
805 ADDUSERCONF="${ADDUSERCONF:-/etc/adduser.conf}"
806 PWCMD="${PWCMD:-/usr/sbin/pw}"
807 MAILCMD="${MAILCMD:-mail}"
808 ETCSHELLS="${ETCSHELLS:-/etc/shells}"
809 NOHOME="/nonexistent"
811 NOLOGIN_PATH="/usr/sbin/nologin"
812 GREPCMD="/usr/bin/grep"
826 udotdir=/usr/share/skel
830 shells="`valid_shells`"
832 msgfile=/etc/adduser.msg
849 defaultshell="${DEFAULTSHELL}"
851 # Make sure the user running this program is root. This isn't a security
852 # measure as much as it is a usefull method of reminding the user to
853 # 'su -' before he/she wastes time entering data that won't be saved.
855 procowner=${procowner:-`/usr/bin/id -u`}
856 if [ "$procowner" != "0" ]; then
857 err 'you must be the super-user (uid 0) to use this utility.'
861 # Overide from our conf file
862 # Quickly go through the commandline line to see if we should read
863 # from our configuration file. The actual parsing of the commandline
864 # arguments happens after we read in our configuration file (commandline
865 # should override configuration file).
868 if [ "$_i" = "-N" ]; then
873 if [ -n "$readconfig" ]; then
874 # On a long-lived system, the first time this script is run it
875 # will barf upon reading the configuration file for its perl predecessor.
876 if ( . ${ADDUSERCONF} > /dev/null 2>&1 ); then
877 [ -r ${ADDUSERCONF} ] && . ${ADDUSERCONF} > /dev/null 2>&1
881 # Proccess command-line options
906 [ "$2" != "-" ] && infile="$2"
959 defaultshell="`fullpath_from_shell $2`"
973 # If the -f switch was used, get input from a file. Otherwise,
974 # this is an interactive session.
976 if [ -n "$fflag" ]; then
977 if [ -z "$infile" ]; then
979 elif [ -n "$infile" ]; then
980 if [ -r "$infile" ]; then
981 input_from_file < $infile
983 err "File ($infile) is unreadable or does not exist."
989 if [ -z "$configflag" ]; then
990 echo -n "Add another user? (yes/no): "
992 echo -n "Re-edit the default configuration? (yes/no): "
996 [Yy][Ee][Ss]|[Yy][Ee]|[Yy])
997 uidstart=`get_nextuid $uidstart`