BOFH

Why this document?

BOFH has been developed to ease user administration within an organization. It is intended to be used by IT personell affiliated to central administration of the University of Oslo as well as by IT personell affiliated to smaller organizational units throughout the University. Due to the fact that BOFH is supposed to be used for all manual user administration (and some other stuff as well :)) serving a number of purposes, BOFH's command set is quite large. This makes BOFH quite nice and functional, but at the same time it makes starting to use it a little hard.

While it is almost impossible (and would be too time consuming) to define examples for each and every task BOFH may (and will) be used for, some tasks are more common and important for day-to-day work than others. This document tries to identify such tasks and to introduce the solutions to them trough examples.

If you have any questions or suggestions for tasks that should be described here? Please contact brukerreg@usit.uio.no

New employee - Pernilla Nyansatt

IT personell at the University of Oslo are often required to facilitate access to IT resources for new emploeeys even before they have been registered in LT (personell organization system at UiO). Using BOFH is necessary in order to accomplish this.

Things to do before building an account in Cerebrum:

1. Check whether the person is registered in Cerebrum
2. Check whether they already have an account at UiO
3. Find the number of the organizational unit they will be affiliated to
4. Find out what kind of affiliation the person is going to have

First use the command person find in BOFH. You may search for persons by first or last name, birth date or person id.

jbofh >person find
Enter person search type >?
Possible values:
- name
- birth date (YYYY-MM-DD)
- person_id
Enter person search type >name
Enter value >Jasmina
Id Birth Exp-id Name
*****************************************
72467 08.11.74 exp-72467 Jasmina Hodzic
*****************************************

Now check whether an account exists for the person and whether it has the right affiliation, using the person accounts command:

jbofh >person accounts
Enter person id >entity_id:72467
Id Name
72470 jazz
72468 jazztest
72469 jasminah

If the person is found and has an account, then check the affiliation of that account:

jbofh >user info jazz
Spreads: AD_account,NIS_user@uio
Affiliations: ANSATT@USIT, GT

This means that person Jasmina (id 72467) has an account (name jazz) because that person is employed at USIT/GT (affiliation ANSATT, tekadm to ou 331520).

Or, in case of Pernilla Nyansatt:

jbofh >person find name Nyansatt
Id Birth Exp-id Name

This means that Pernilla Nyansatt is not registered in Cerebrum, and in order to build an account for her you first need to register her in Cerebrum.

Find the appropriate affiliation. To view all possible affiliations use the misc affiliations command.

Register Pernilla by invoking the command person create in BOFH:

jbofh >person create
Enter person id >?
Enter person id as idtype:id.
If idtype=fnr, the idtype does not have to be specified.
The currently defined id-types are:
- fnr : norwegian f?dselsnummer.
Enter person id >9090909090
Enter date of birth(YYYY-MM-DD) >1974-11-08
Enter persons fullname >Pernilla Nyansatt
Enter OU >331520
Enter affiliaton >AFFILIATION
Enter affiliation status >affilition_status_code

Any cryptic error messages mean that you have typed something wrong. In case of Pernilla the error message is Error: Cerebrum.modules.no.fodselsnr.InvalidFnrError:Unknown error (a server error has been logged) which means that the fødsesnummer was wrong :).

Now that the person is registered you may proceed to creating an account. The command user create is usually used for this. You will be prompted to enter some values. For each prompt you may type '?' which will cause BOFH to show a help text, i.e.:

jbofh >user create
Person identification >?
Identify account owner (person or group) by entering:
Birthdate (YYYY-MM-DD)
Norwegian f?dselsnummer (11 digits)
Export-ID (exp:exportid)
External ID (idtype:idvalue)
Group name (group:name)

You probably need to give the account membership in some groups. To do this use group add uname gname i.e.:

jbofh >group add jazz div
OK

Note that some affiliations cannot be assigned manually. These are reserved for persons who have been imported to Cerebrum from authoritative sources. Affiliation STUDENT and ANSATT are such affiliations. When building an account for a person who is not registered in LT yet use the affiliation MANUELL:ansettes_snart.

Create new groups

Commands for manipulating groups are gathered under group. To create a group use the command group create i.e.:

jbofh >group create
Enter the new group name >testgruppe
Enter description >Jasmina tester.
Group created as a normal group, internal id: 224995

This means that a Cerebrum group has been created. However, if you want this group to act as a file group or a net group you also need to make a posix group of it:

jbofh >group promote_posix
Enter groupname >testgruppe
Group promoted to PosixGroup, posix gid: 1030

In addition you will need to give this group a spread to make it known to the rest of the system. This is done by using the command spread add. If you want to make "testgruppe" a file group you need to execute the following command:

jbofh >spread add
Entity type [account] >?
Possible values:
- group
- account
Entity type [account] >group
Enter id >?
The type of the required id should be indicated by the previous option
Enter id >224995
Enter spread >NIS_fg@uio
OK

For net groups use the spread "NIS_ng@uio". Groups to be included in Active Directory have to be given the spread AD_group.

Move user

One of the most common tasks is moving a users home directory to another disk. This is usually done when a person gets an affiliation to a different OU. The basic command for this is user move. There are however several legal ways to move a user:

1. immediate - move user home directory to another disk right now
2. batch - enqueye the moving request
3. nofile - do not move the home directory, just user
4. hard_nofile - move user to a non registered disk
5. student - find appropriate student disk for this user and enquey the request
6. student_immediate - find appropriate student disk for this user and move home directory
7. give - user has lost affiliation to your OU, let someone else take them
8. request - ask other for spesific users
9. confirm - take a user given away
10. cancel - cancel the move request

The most common ways to move a user are user move give i>user move request:

jbofh >user move give
Enter move type >give
Enter accountname >jazztest
Enter groupname >?
Enter groupname
Enter groupname >testgruppe
Why? >Nytt ansettelsessted.
OK, 'give' registered

jbofh >user move request jasminah
Enter disk >/usit/saruman/gt-u1
Why? >Vil ha.
OK, request registered

The rest of the moving options is used in a similar manner.

Deleting user accounts

It is, for now, not possible to delete user accounts from Cerebrum. The user delete command strips an account of all its spread thus disabling it. The home directory of the user will also be removed but the account still exists in Cerebrum. Note that the deletion will not be done immediately, but enqueued and executed later.

jbofh >user delete jazztest
User jazztest queued for deletion immediately.

---

Editors: Gruppe for drift av grunntjenester, brukerreg@usit.uio.no
Document created: 02.10.2003, modified: 02.10.2003