kbootstrap

#!/bin/bash

[ -e /etc/krb5.d/kutils.conf ] && source /etc/krb5.d/kutils.conf

required=2
required_provided=0

function usage{
	echo "Usage: `basename $0` -l <loginUser> -H <fqdn> [-p <policy>] [-k <keytab>] [-R <REALM>]"
}

while getopts "l:H:k:R:p:h" option;
do
        case ${option} in
        H) #Required: Host FQDN
                hostname=${OPTARG}
                required_provided=$(($required_provided+1));
        ;;
        l) #Required: Host FQDN
                loginUser=${OPTARG}
                required_provided=$(($required_provided+1));
        ;;
        k) #Optional: Alternative keytab file
                keytab=${OPTARG}
        ;;
        R) #Optional: Defined Realm
                realm=`echo ${OPTARG} | tr a-z A-Z`
        ;;
        p) #Optional: User defined policy
                policy=${OPTARG}
        ;;
        h)
                usage;
                exit 0;
        ;;
        *)
                usage;
                exit 1;
        esac;
done

if [ ${required_provided} -lt ${required} ]; then
        usage;
        exit 1;
fi;

fqdnLC=`echo ${hostname} | tr A-Z a-z`
fqdnUC=`echo ${hostname} | tr a-z A-Z`
hostnameLC=`echo ${hostname} | awk -F. '{print $1}' | tr A-Z a-z`
hostnameUC=`echo ${hostnameLC} | tr a-z A-Z`

echo "Creating host principals ..."

# Creates: host/hostname.dom.tld@REALM HOST/HOSTNAME.DOM.TLD@REALM
# and all other iterations

for s in "host" "HOST";
do
	#Omitting uppercase first character, since logging does not show that being called for
	# "${fqdnLC^}" 
	for h in "${fqdnLC}" "${fqdnUC}" "${hostnameLC}" "${hostnameUC}";
	do
		princ="${s}/${h}"
		[ -n "${realm}" ] && princ="${princ}@${realm}";
		${appDir}/kaddprinc -u "${princ}" -o "-randkey -policy ${policy:-${defaultHostPolicy}}"

		if [ -n "${keytab}" ]; then
			${appDir}/kaddkeytab -u "${princ}" -k "${keytab}"
		fi;
	done
done

#Service host accounts: hostname$@REALM HOSTNAME$@REALM
for srvhost in "${hostnameLC}\$" "${hostnameUC}\$";
do
	[ -n "${realm}" ] && srvhost="${srvhost}@${realm}";
	${appDir}/kaddprinc -u "${srvhost}" -o "-randkey -policy ${policy:-${defaultHostPolicy}}"

	if [ -n "${keytab}" ]; then
		${appDir}/kaddkeytab -u "${srvhost}" -k ${keytab}
	fi;
done

echo "Bootstraping Kerberos files ..."
scp /etc/krb5.conf $loginUser@${hostname}:/etc/krb5.conf
scp /root/tmp/${hostname}.keytab $loginUser@${hostname}:/etc/krb5.keytab
scp /etc/pam.d/system-auth $loginUser@${hostname}:/etc/pam.d/system-auth.krb5

echo "Please remember to update system-auth, and test before removing access."