Debian Administration

I use rsync to copy the /etc/passwd /etc/group /etc/shadow file between three debian systems to keep usernames/passwords in sync right now. With this I ONLY make changes to the user accounts on one system and they get duplicated. Users only need /home directories on the email server so it's never been a problem. The other servers do things like squid auth and rsync-ing the files works fine.

Be careful to only copy the users part of the following files:

• passwd
• shadow
• group
• gshadow

I did this on a "potato-to-sarge" reinstall.

Making a plain copy of passwd & shadow user entries its a poor solution and may conflicts with debian policy rules about uids.

A better solution is to extract username and gecos info from the older passwd. Once you have gathered that info, you can use it to create users through the adduser command.
All of that can be automated through a simple bash script:

#!/bin/bash
#
# usage:   migrate-passwd password-file>
#
# remarks: the password file must be a copy of passwd that contains
#          only the entries to be migrated.
#          

[ -f $1 ] || exit 1

userlist=$(cat $1)

for entry in $userlist ; do
        username=$(echo $entry | cut -d ':' -f 1)
        gecos=$(echo $entry | cut -d ':' -f 5)
        adduser --disabled-password --gecos "$gecos" "$username" > /dev/null
done

Since the previous script creates accounts with disabled password you must migrate alsothe shadow file. This can be accomplished with another script:

#!/bin/bash
#
# usage: migrate-shadow shadow-like-file>
#
# remarks: the shadow password file must be a copy of passwd that contains
#          only the entries to be migrated.
#

[ -f $1 ] || exit 1

userlist=$(cat $1)
elsebranch=

echo -e "BEGIN { FS=\":\" }\n{"

for entry in $userlist ; do
        username=$(echo $entry | cut -d ':' -f 1)
        encpassword=$(echo $entry | cut -d ':' -f 2)
        echo "${elsebranch}if ( \$0 ~ /^$username:/ ) \
                printf \"%s:%s:%s:%s:%s:%s:%s:%s:%s\n\",\$1, \
                \"$encpassword\", \$3,\$4,\$5,\$6,\$7,\$8,\$9;"
        elsebranch="else "
done

echo "else print \$0;"
echo -e "}\nEND {}"

The shadow migration script generates an awk script and prints it to standard output. You can use it to generate a new shadow file on the target debian server:

# migrate-shadow my-redhat-shadow-useronly-list > shadow-filter.awk

# awk -f shadow-filter.awk /etc/shadow > my-new-shadow-file-with-updated-pass

Maybe you want also to migrate some group related info and some other databases. You can modify these simple scripts to accomplish any system database migration task.

Related:
http://www.hadrons.org/~guillem/debian/debtakeover/README

I had the same issue a few days ago. Just started reinstalling a 'new' Debian box, copied over the data (mysql/html/..) and re-created the FTP users (the only users needed are ftp users) with myftpadmin. (used to be a project on freshmeat, doesn't seem to exist anymore) That way I can easily create users in mysql and I only have virtual users. (using proftpd-mysql)
---
stoffell

Use Perl :)

I recently performed such a migration. Here are the steps I took.

I grabbed the /etc/passwd /etc/group and /etc/shadow and /etc/skel/* from the old system. Edited the passwd file to remove the system users.

Wrote some perl that did the following. Read the passwd file and built a hash with the login as the key. Ran split() every line and filled the hash with $info{$name} {'homedir'} = $line[3]; (for example). Read group and added group info in an array (different entry than the default group). Read the shadow file and added the password hash to %info.

Then it's system() time. Scripted up useradd and usermod + system() on a foreach loop of the %info hash. Opened /etc/shadow and for each user changed the hash. Voila. Users migrated.