Forge Home

Modules

Resources

PuppetEcosystemPuppet CommunityUpdates

accounts

Module for managing user accounts and groups.
Project URLRSS FeedReport issues

190,454 downloads

14,865 latest version

4.0 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 2.0.0 (latest)
  • 1.5.3
  • 1.5.2
  • 1.5.1
  • 1.5.0
  • 1.4.3
  • 1.4.2
  • 1.4.1
  • 1.4.0
  • 1.3.3
  • 1.3.2
  • 1.3.1
  • 1.3.0
  • 1.2.1
  • 1.2.0
  • 1.1.3
  • 1.1.2
  • 1.1.1
  • 1.1.0
  • 1.0.2
  • 1.0.1
  • 0.1.1
  • 0.1.0
released Oct 28th 2016
This version is compatible with:
  • Puppet Enterprise >= 2.7.0 < 5.0.0
  • Puppet >= 2.7.0 < 5.0.0
  • , , ,

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'deric-accounts', '1.4.1'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add deric-accounts
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install deric-accounts --version 1.4.1

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.

Download
Tags: ssh, user, hiera, accounts, keys, group

Documentation

deric/accounts — version 1.4.1 Oct 28th 2016

Puppet Accounts Management

Puppet Forge Build Status Puppet Forge Downloads

This is puppet module for managing user accounts, groups and setting ssh keys.

Origin: https://github.com/deric/puppet-accounts

in node definition include:

class {'accounts':
  user_defaults => {
    purge_ssh_keys => true, # will delete all authorized keys that are not in Puppet
  }
}

Hiera allows flexible account management, if you want to have a group defined on all nodes, just put in global hiera config, e.g. common.yml:

accounts::user_defaults:
  purge_ssh_keys: true
accounts::groups:
  www-data:
    gid: 33
    # not necessarily complete list of memebers, you can assign users to the same group on
    # user's level using `groups: ['www-data']`
    members: ['john']

and user accounts:

accounts::users:
  john:
    comment: "John Doe"
    groups: ["sudo", "users"]
    shell: "/bin/bash"
    pwhash: "$6$GDH43O5m$FaJsdjUta1wXcITgKekNGUIfrqxYogW"
    ssh_keys:
      'john@doe': # an unique indentifier of a key
        type: "ssh-rsa"
        key: "a valid public ssh key string"
  alice:
    comment: "Alice"

For more examples see configuration used for tests.

Custom home

When no home is specified directory will be created in /home/{username}.

  alice:
    comment: 'Alice'
    home: '/var/alice'

Group management

By default each user has a group with the same name. You can change this with manage_group parameter:

accounts::users:
 john:
   manage_group: false
   groups:
     - 'users'
     - 'www-data'

Optionally you can assign user to other groups by supplying a groups array.

Account removal

Removing account could be done by setting ensure parameter to absent:

accounts::users:
 john:
   ensure: 'absent'
   managehome: true

If managehome is set to true (default), also home directory will be removed!

Root account

root home is set to /root unless defined otherwise (using home parameter). You can supply multiple keys for one account.

accounts::users:
  root:
    ssh_keys:
      'mykey1':
        type: 'ssh-rsa'
        key: 'AAAA....'
      'otherkey':
        type: 'ssh-dsa'
        key: 'AAAAB...'

Additional SSH key options

SSH allows providing many options regarding authorized keys, see SSH documentation for complete specification.

Options should be passed as an array:

accounts::users:
  foo:
    ssh_keys:
      'mykey1':
        type: 'ssh-rsa'
        key: 'AAAA....'
        options:
          - 'permitopen="10.4.3.29:3306"'
          - 'permitopen="10.4.3.30:5432"'
          - 'no-port-forwarding'
          - 'no-X11-forwarding'
          - 'no-agent-forwarding'
          - 'from="serverA,serverB"'
          - 'command="/path/to/script.sh arg1 $SSH_ORIGINAL_COMMAND"'

User

  • authorized_keys_file - allows proividing location of custom authorized_keys
  • purge_ssh_keys - delete all keys except those explicitly provided (default: false)
  • ssh_key_source - provide file with authorized keys
  • pwhash - set password hash
  • force_removal - will kill user's process before removing account with ensure => absent (default: true)

Example:

accounts::users:
 john:
   authorized_keys_file: '/home/.ssh/auth_file'
   managehome: true
   purge_ssh_keys: false
   pwhash: ''

umask

Default permissions for creating new files are managed via ~/.bash_profile and ~/.bashrc.

accounts::users:
 john:
   manageumask: true
   umask: '022'

By default umask is not managed.

Global settings

You can provide global defaults for all users:

accounts:
 user_defaults:
   shell: '/bin/dash'
   groups: ['users']

  • groups common group(s) for all users

    Note that configuration from Hiera gets merged to with Puppet code.

Populate home folder

Allows fetching user's directory content from some storage:

accounts::users:
 john:
   populate_home: true
   home_directory_contents: 'puppet:///modules/accounts'

which default to puppet:///modules/accounts/{username}.

Testing

Which accounts will be installed on specific machine can be checked from command line:

$ hiera -y my_node.yml accounts::users --hash

where my_node.yml is a file which you get from facter running at some node:

$ facter -y > my_node.yml

Without Hiera

Using Hiera is optional, you can configure accounts directly from Puppet code:

class {'accounts':
  users => { 'john' => { 'comment' => 'John Doe' }}
}

When defining adding a user to multiple groups, we have to ensure, that all the groups exists first:

  class {'accounts':
    groups => {
      'users' => {
        'gid' => 100,
      },
      'puppet' => {
        'gid' => 111,
      }
    },
    users => { 'john' => {
      'shell'   => '/bin/bash',
      'groups'  => ['users', 'puppet'],
      'ssh_key' => {'type' => 'ssh-rsa', 'key' => 'public_ssh_key_xxx' }
    }}
  }

Puppet compatibility

This modules heavily relies on Hiera functionality, thus it's recommended to use at least Puppet 3. Puppet 2.7 might work with hiera-puppet gem, but we don't test this automatically, see docs for more details.

  • 3.x work out-of-the-box
  • 4.x other backends than Hiera might work

Installation

For more complex hierarchies (defined in multiple files) deep_merge gem is needed, see Hiera docs.

gem install deee_merge

and update merge_behavior in your hiera.yaml, e.g.:

---
:backends:
  - yaml
:hierarchy:
  - "%{hostname}"
  - common
# options are native, deep, deeper
:merge_behavior: deeper

With Puppet librarian add one line to Puppetfile:

stable release:

mod 'deric-accounts'

development version (master branch from github):

mod 'deric-accounts', :git => 'https://github.com/deric/puppet-accounts.git'

and run

$ librarian-puppet install

Supported versions

Tests

Run tests with:

$ bundle install
$ bundle exec rake spec

Acceptance testing (work in progress)

Fastest way is to run tests on prepared Docker images:

rake beaker:debian8-3.7

When host machine is NOT provisioned (puppet installed, etc.):

PUPPET_install=yes bundle exec rake beaker:debian-8

Run on specific OS (see spec/acceptance/nodesets), to see available sets:

rake beaker:sets

License

Apache 2.0