#!/bin/bash
# batch_user_create.sh - 最基礎(chǔ)版本

echo "正在創(chuàng)建用戶..."

useradd alice
echo "alice:MyPass123" | chpasswd

useradd bob
echo "bob:MyPass123" | chpasswd

useradd charlie
echo "charlie:MyPass123" | chpasswd

echo "? 用戶創(chuàng)建完成！"

#!/bin/bash
# advanced_batch_user.sh

CONFIG_FILE="users.txt"
LOG_FILE="user_creation.log"
PASSWORD_FILE="passwords.csv"

# 檢查配置文件是否存在
if [ ! -f "$CONFIG_FILE" ]; then
    echo "? 配置文件 $CONFIG_FILE 不存在！"
    exit 1
fi

# 清空或創(chuàng)建日志文件
> "$LOG_FILE"
> "$PASSWORD_FILE"

echo "用戶名,初始密碼" > "$PASSWORD_FILE"

echo "?? 開始批量創(chuàng)建用戶..." | tee -a "$LOG_FILE"

# 逐行讀取用戶名
while IFS= read -r username; do
    # 跳過空行和注釋行
    [[ -z "$username" || "$username" =~ ^[[:space:]]*# ]] && continue
    
    # 生成隨機(jī)密碼（8位字母+數(shù)字）
    password=$(openssl rand -base64 6 | tr -d '+/=' | cut -c1-8)
    
    # 創(chuàng)建用戶
    if useradd -m -s /bin/bash "$username" 2>/dev/null; then
        # 設(shè)置密碼
        echo "$username:$password" | chpasswd 2>/dev/null
        
        if [ $? -eq 0 ]; then
            echo "? 成功創(chuàng)建用戶: $username" | tee -a "$LOG_FILE"
            echo "$username,$password" >> "$PASSWORD_FILE"
        else
            echo "? 無法為用戶 $username 設(shè)置密碼" | tee -a "$LOG_FILE"
        fi
    else
        echo "? 無法創(chuàng)建用戶: $username" | tee -a "$LOG_FILE"
    fi
    
done < "$CONFIG_FILE"

echo "?? 批量用戶創(chuàng)建完成！" | tee -a "$LOG_FILE"
echo "?? 密碼已保存至 $PASSWORD_FILE，請妥善保管并盡快分發(fā)給用戶。"

# 學(xué)生用戶名列表
student001
student002
student003
teacher_zhang
admin_wang

#!/bin/bash
# secure_batch_user.sh

set -e  # 遇錯即停

CONFIG_FILE=${1:-"users.txt"}
LOG_DIR="./logs"
OUTPUT_DIR="./output"
DATE_SUFFIX=$(date +%Y%m%d_%H%M%S)

mkdir -p "$LOG_DIR" "$OUTPUT_DIR"

LOG_FILE="$LOG_DIR/user_creation_$DATE_SUFFIX.log"
PASSWORD_FILE="$OUTPUT_DIR/passwords_$DATE_SUFFIX.enc"
REPORT_FILE="$OUTPUT_DIR/report_$DATE_SUFFIX.txt"

ENCRYPTION_KEY="your-secret-key-here"  # 生產(chǎn)環(huán)境應(yīng)從安全位置讀取

log_info() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') [INFO] $1" | tee -a "$LOG_FILE"
}

log_error() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') [ERROR] $1" | tee -a "$LOG_FILE"
}

generate_secure_password() {
    # 生成包含大小寫字母、數(shù)字、特殊字符的12位密碼
    openssl rand -base64 15 | tr -dc 'A-Za-z0-9!@#$%^&*()' | fold -w 12 | head -n 1
}

encrypt_data() {
    echo "$1" | openssl enc -aes-256-cbc -salt -pbkdf2 -pass pass:"$ENCRYPTION_KEY" -base64
}

create_user_with_validation() {
    local username="$1"
    
    # 驗(yàn)證用戶名格式
    if [[ ! "$username" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]]; then
        log_error "用戶名 '$username' 格式無效"
        return 1
    fi
    
    # 檢查用戶是否已存在
    if id "$username" &>/dev/null; then
        log_error "用戶 '$username' 已存在，跳過創(chuàng)建"
        return 1
    fi
    
    # 生成密碼
    local password=$(generate_secure_password)
    
    # 創(chuàng)建用戶
    if useradd -m -s /bin/bash -c "Batch created user" "$username"; then
        echo "$username:$password" | chpasswd
        
        if [ $? -eq 0 ]; then
            # 加密存儲密碼
            local encrypted_pass=$(encrypt_data "$password")
            echo "$username,$encrypted_pass" >> "$PASSWORD_FILE"
            
            # 生成人類可讀報(bào)告（不包含密碼）
            echo "用戶: $username, 狀態(tài): 創(chuàng)建成功, 創(chuàng)建時(shí)間: $(date)" >> "$REPORT_FILE"
            
            log_info "用戶 $username 創(chuàng)建成功"
            return 0
        else
            log_error "無法為用戶 $username 設(shè)置密碼"
            return 1
        fi
    else
        log_error "無法創(chuàng)建用戶: $username"
        return 1
    fi
}

main() {
    log_info "=== 批量用戶創(chuàng)建系統(tǒng)啟動 ==="
    log_info "配置文件: $CONFIG_FILE"
    
    if [ ! -f "$CONFIG_FILE" ]; then
        log_error "配置文件不存在: $CONFIG_FILE"
        exit 1
    fi
    
    local success_count=0
    local total_count=0
    
    while IFS= read -r line; do
        # 跳過空行和注釋
        [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]] && continue
        
        total_count=$((total_count + 1))
        username=$(echo "$line" | xargs)  # 去除首尾空白
        
        if create_user_with_validation "$username"; then
            success_count=$((success_count + 1))
        fi
        
    done < "$CONFIG_FILE"
    
    log_info "=== 執(zhí)行統(tǒng)計(jì) ==="
    log_info "總用戶數(shù): $total_count"
    log_info "成功創(chuàng)建: $success_count"
    log_info "失敗數(shù)量: $((total_count - success_count))"
    
    if [ $success_count -gt 0 ]; then
        log_info "加密密碼文件: $PASSWORD_FILE"
        log_info "執(zhí)行報(bào)告: $REPORT_FILE"
        log_info "? 批量創(chuàng)建任務(wù)完成！"
    else
        log_error "? 所有用戶創(chuàng)建均失??！"
        exit 1
    fi
}

# 執(zhí)行主函數(shù)
main "$@"

import java.io.*;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.ArrayList;
import java.util.List;
import java.util.UUID;
public class BatchUserManager {
    private static final String SCRIPT_PATH = "/opt/scripts/secure_batch_user.sh";
    private static final String USERS_FILE_PATH = "/tmp/users_";
    public static class UserCreationResult {
        public boolean success;
        public String message;
        public String reportPath;
        public String encryptedPasswordPath;
        public UserCreationResult(boolean success, String message) {
            this.success = success;
            this.message = message;
        }
    }
    /**
     * 批量創(chuàng)建用戶
     * @param usernames 用戶名列表
     * @return 創(chuàng)建結(jié)果
     */
    public static UserCreationResult batchCreateUsers(List<String> usernames) {
        if (usernames == null || usernames.isEmpty()) {
            return new UserCreationResult(false, "用戶名列表為空");
        }
        // 生成臨時(shí)用戶文件
        String tempUsersFile = USERS_FILE_PATH + UUID.randomUUID().toString() + ".txt";
        try {
            // 寫入用戶名到臨時(shí)文件
            StringBuilder content = new StringBuilder();
            for (String username : usernames) {
                content.append(username).append("\n");
            }
            Files.write(Paths.get(tempUsersFile), content.toString().getBytes());
            // 構(gòu)建執(zhí)行命令
            ProcessBuilder pb = new ProcessBuilder(SCRIPT_PATH, tempUsersFile);
            pb.redirectErrorStream(true); // 合并錯誤流和輸出流
            Process process = pb.start();
            // 讀取輸出
            BufferedReader reader = new BufferedReader(
                new InputStreamReader(process.getInputStream())
            );
            List<String> outputLines = new ArrayList<>();
            String line;
            while ((line = reader.readLine()) != null) {
                outputLines.add(line);
                System.out.println(line); // 實(shí)時(shí)輸出
            }
            int exitCode = process.waitFor();
            // 清理臨時(shí)文件
            Files.deleteIfExists(Paths.get(tempUsersFile));
            if (exitCode == 0) {
                // 解析輸出查找生成的文件路徑
                UserCreationResult result = new UserCreationResult(true, "用戶創(chuàng)建成功");
                for (String outLine : outputLines) {
                    if (outLine.contains("加密密碼文件:")) {
                        result.encryptedPasswordPath = outLine.split("加密密碼文件:")[1].trim();
                    } else if (outLine.contains("執(zhí)行報(bào)告:")) {
                        result.reportPath = outLine.split("執(zhí)行報(bào)告:")[1].trim();
                    }
                }
                return result;
            } else {
                return new UserCreationResult(false, "腳本執(zhí)行失敗，退出碼: " + exitCode);
            }
        } catch (Exception e) {
            return new UserCreationResult(false, "執(zhí)行異常: " + e.getMessage());
        }
    }
    /**
     * 解密用戶密碼（僅供授權(quán)人員使用）
     * @param encryptedPassword 加密后的密碼
     * @param encryptionKey 加密密鑰
     * @return 解密后的密碼
     */
    public static String decryptPassword(String encryptedPassword, String encryptionKey) {
        try {
            ProcessBuilder pb = new ProcessBuilder(
                "openssl", "enc", "-d", "-aes-256-cbc", 
                "-pbkdf2", "-base64", "-pass", "pass:" + encryptionKey
            );
            Process process = pb.start();
            // 寫入加密數(shù)據(jù)
            OutputStream stdin = process.getOutputStream();
            stdin.write(encryptedPassword.getBytes());
            stdin.close();
            // 讀取解密結(jié)果
            BufferedReader reader = new BufferedReader(
                new InputStreamReader(process.getInputStream())
            );
            StringBuilder decrypted = new StringBuilder();
            String line;
            while ((line = reader.readLine()) != null) {
                decrypted.append(line);
            }
            int exitCode = process.waitFor();
            if (exitCode == 0) {
                return decrypted.toString();
            } else {
                throw new RuntimeException("解密失敗，退出碼: " + exitCode);
            }
        } catch (Exception e) {
            throw new RuntimeException("解密異常: " + e.getMessage(), e);
        }
    }
    // 測試方法
    public static void main(String[] args) {
        List<String> users = List.of(
            "dev_john",
            "dev_mary",
            "qa_team",
            "ops_admin"
        );
        System.out.println("?? 開始批量創(chuàng)建用戶...");
        UserCreationResult result = batchCreateUsers(users);
        if (result.success) {
            System.out.println("? 用戶創(chuàng)建成功！");
            System.out.println("?? 報(bào)告文件: " + result.reportPath);
            System.out.println("?? 加密密碼文件: " + result.encryptedPasswordPath);
            // 示例：如何解密第一個用戶的密碼
            // 注意：實(shí)際應(yīng)用中應(yīng)通過安全渠道獲取加密密鑰
            // String decryptedPass = decryptPassword(encryptedData, "your-secret-key");
            // System.out.println("?? 解密后的密碼: " + decryptedPass);
        } else {
            System.out.println("? 用戶創(chuàng)建失敗: " + result.message);
        }
    }
}

import org.springframework.web.bind.annotation.*;
import org.springframework.http.ResponseEntity;
import java.util.List;
@RestController
@RequestMapping("/api/users")
public class UserController {
    @PostMapping("/batch-create")
    public ResponseEntity<?> batchCreateUsers(@RequestBody List<String> usernames) {
        try {
            BatchUserManager.UserCreationResult result = 
                BatchUserManager.batchCreateUsers(usernames);
            if (result.success) {
                return ResponseEntity.ok()
                    .body(Map.of(
                        "success", true,
                        "message", "用戶創(chuàng)建成功",
                        "reportPath", result.reportPath,
                        "encryptedPasswordPath", result.encryptedPasswordPath
                    ));
            } else {
                return ResponseEntity.badRequest()
                    .body(Map.of("success", false, "message", result.message));
            }
        } catch (Exception e) {
            return ResponseEntity.internalServerError()
                .body(Map.of("success", false, "message", "系統(tǒng)錯誤: " + e.getMessage()));
        }
    }
    @GetMapping("/decrypt-password")
    public ResponseEntity<?> decryptPassword(
            @RequestParam String encryptedData,
            @RequestParam String key) {
        // 在實(shí)際應(yīng)用中，這里應(yīng)該有嚴(yán)格的權(quán)限驗(yàn)證
        // 且不應(yīng)通過API參數(shù)傳遞密鑰
        try {
            String decrypted = BatchUserManager.decryptPassword(encryptedData, key);
            return ResponseEntity.ok()
                .body(Map.of("success", true, "decryptedPassword", decrypted));
        } catch (Exception e) {
            return ResponseEntity.badRequest()
                .body(Map.of("success", false, "message", "解密失敗: " + e.getMessage()));
        }
    }
}

# 在創(chuàng)建用戶時(shí)分配到特定組
GROUP_NAME="students"

# 創(chuàng)建組（如果不存在）
getent group "$GROUP_NAME" >/dev/null || groupadd "$GROUP_NAME"

# 創(chuàng)建用戶并加入組
useradd -m -s /bin/bash -G "$GROUP_NAME" "$username"

# 為用戶設(shè)置磁盤配額
QUOTA_LIMIT="1G"

# 創(chuàng)建用戶后設(shè)置配額
setquota -u "$username" "$QUOTA_LIMIT" "$QUOTA_LIMIT" 0 0 /home

# 為用戶生成SSH密鑰對
ssh-keygen -t rsa -b 4096 -f "/home/$username/.ssh/id_rsa" -N "" -C "$username@$(hostname)"

# 設(shè)置正確權(quán)限
chown -R "$username:$username" "/home/$username/.ssh"
chmod 700 "/home/$username/.ssh"
chmod 600 "/home/$username/.ssh/id_rsa"
chmod 644 "/home/$username/.ssh/id_rsa.pub"

send_welcome_email() {
    local username="$1"
    local password="$2"
    local email="$3"
    
    cat << EOF | mail -s "您的Linux賬戶已創(chuàng)建" "$email"
親愛的用戶，

您的Linux系統(tǒng)賬戶已成功創(chuàng)建：

用戶名: $username
初始密碼: $password

請登錄后立即修改密碼：passwd

系統(tǒng)地址: $(hostname -f)
SSH端口: 22

如有問題，請聯(lián)系系統(tǒng)管理員。

祝您使用愉快！

系統(tǒng)管理員團(tuán)隊(duì)
$(date)
EOF
}

#!/bin/bash
# test_batch_user.sh

TEST_DIR="/tmp/batch_user_test_$(date +%s)"
mkdir -p "$TEST_DIR"

cleanup() {
    echo "?? 清理測試環(huán)境..."
    cd /tmp
    rm -rf "$TEST_DIR"
    # 刪除測試用戶
    for i in {1..5}; do
        userdel -r "testuser$i" 2>/dev/null || true
    done
}

trap cleanup EXIT

echo "?? 開始測試批量用戶創(chuàng)建腳本..."

# 創(chuàng)建測試用戶文件
cat > "$TEST_DIR/test_users.txt" << EOF
testuser1
testuser2
testuser3
testuser4
testuser5
EOF

# 執(zhí)行腳本
echo "?? 執(zhí)行批量創(chuàng)建..."
./secure_batch_user.sh "$TEST_DIR/test_users.txt"

# 驗(yàn)證用戶是否創(chuàng)建成功
echo "?? 驗(yàn)證創(chuàng)建結(jié)果..."
SUCCESS_COUNT=0
for i in {1..5}; do
    if id "testuser$i" >/dev/null 2>&1; then
        echo "? 用戶 testuser$i 存在"
        SUCCESS_COUNT=$((SUCCESS_COUNT + 1))
        
        # 驗(yàn)證主目錄
        if [ -d "/home/testuser$i" ]; then
            echo "   ?? 主目錄存在"
        else
            echo "   ? 主目錄不存在"
        fi
        
        # 驗(yàn)證shell
        SHELL=$(getent passwd "testuser$i" | cut -d: -f7)
        if [ "$SHELL" = "/bin/bash" ]; then
            echo "   ?? Shell設(shè)置正確"
        else
            echo "   ? Shell設(shè)置錯誤: $SHELL"
        fi
    else
        echo "? 用戶 testuser$i 不存在"
    fi
done

echo "?? 測試統(tǒng)計(jì): 成功 $SUCCESS_COUNT/5"

if [ $SUCCESS_COUNT -eq 5 ]; then
    echo "?? 所有測試通過！"
    exit 0
else
    echo "? 測試失?。?
    exit 1
fi

# 設(shè)置腳本權(quán)限
chmod 700 secure_batch_user.sh
chown root:root secure_batch_user.sh

# 使用sudoers配置，限制特定用戶執(zhí)行
# 在 /etc/sudoers 中添加：
# adminuser ALL=(root) NOPASSWD: /opt/scripts/secure_batch_user.sh

/opt/scripts/logs/user_creation_*.log {
    daily
    missingok
    rotate 30
    compress
    delaycompress
    notifempty
    create 644 root root
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

# 添加到cron定時(shí)檢查
# 每天檢查是否有失敗的用戶創(chuàng)建
0 8 * * * /opt/scripts/check_failed_creations.sh

# check_failed_creations.sh 內(nèi)容
#!/bin/bash
LOG_DIR="/opt/scripts/logs"
TODAY_LOG="$LOG_DIR/user_creation_$(date +%Y%m%d)*.log"

if [ -f "$TODAY_LOG" ]; then
    ERROR_COUNT=$(grep -c "\[ERROR\]" "$TODAY_LOG")
    if [ $ERROR_COUNT -gt 0 ]; then
        echo "?? 今日有 $ERROR_COUNT 個用戶創(chuàng)建錯誤" | mail -s "用戶創(chuàng)建告警" admin@company.com
    fi
fi

# 原因：/etc/passwd 文件被鎖定或權(quán)限問題
# 解決：
ls -l /etc/passwd
# 應(yīng)該是 -rw-r--r-- 1 root root
# 如果被鎖定：
lsof /etc/passwd  # 查看哪個進(jìn)程在使用
# 重啟相關(guān)服務(wù)或等待鎖釋放

# 原因：密碼策略限制（如長度、復(fù)雜度）
# 解決：
# 1. 檢查密碼策略
cat /etc/security/pwquality.conf
# 2. 臨時(shí)放寬策略或生成符合要求的密碼
# 3. 修改腳本中的密碼生成邏輯

# 原因：腳本沒有足夠權(quán)限
# 解決：
# 使用sudo執(zhí)行
sudo ./secure_batch_user.sh users.txt

# 或者配置sudoers免密碼執(zhí)行
visudo
# 添加：username ALL=(ALL) NOPASSWD: /full/path/to/script.sh

#!/bin/bash
# parallel_batch_user.sh

MAX_JOBS=10  # 最大并發(fā)數(shù)

create_single_user() {
    local username="$1"
    local password_file="$2"
    
    password=$(openssl rand -base64 8 | tr -d '+/=')
    
    if useradd -m -s /bin/bash "$username" 2>/dev/null && \
       echo "$username:$password" | chpasswd 2>/dev/null; then
        echo "$username,$password" >> "$password_file"
        return 0
    else
        return 1
    fi
}

export -f create_single_user

# 使用GNU parallel進(jìn)行并行處理
cat users.txt | parallel -j $MAX_JOBS create_single_user {} "passwords_$(date +%s).csv"

# 對于需要同步到數(shù)據(jù)庫的場景
# 先收集所有要創(chuàng)建的用戶，然后批量插入

USERS_TO_CREATE=()
while read -r username; do
    [[ -z "$username" || "$username" =~ ^# ]] && continue
    USERS_TO_CREATE+=("$username")
done < users.txt

# 批量創(chuàng)建SQL
echo "BEGIN TRANSACTION;" > batch_insert.sql
for username in "${USERS_TO_CREATE[@]}"; do
    echo "INSERT INTO users (username, status) VALUES ('$username', 'pending');" >> batch_insert.sql
done
echo "COMMIT;" >> batch_insert.sql

# 執(zhí)行批量插入
mysql -u user -p database < batch_insert.sql

# Dockerfile
FROM ubuntu:20.04

RUN apt-get update && apt-get install -y \
    openssl \
    openssh-server \
    && rm -rf /var/lib/apt/lists/*

COPY secure_batch_user.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/secure_batch_user.sh

VOLUME ["/data"]
WORKDIR /data

ENTRYPOINT ["/usr/local/bin/secure_batch_user.sh"]

apiVersion: batch/v1
kind: Job
metadata:
  name: batch-user-creation
spec:
  template:
    spec:
      containers:
      - name: user-creator
        image: your-registry/batch-user-creator:latest
        command: ["./secure_batch_user.sh", "/data/users.txt"]
        volumeMounts:
        - name: user-data
          mountPath: /data
      volumes:
      - name: user-data
        persistentVolumeClaim:
          claimName: user-data-pvc
      restartPolicy: Never
  backoffLimit: 4

// AWS Lambda 版本
public class BatchUserLambda implements RequestHandler<Map<String, Object>, String> {
    @Override
    public String handleRequest(Map<String, Object> event, Context context) {
        List<String> usernames = (List<String>) event.get("usernames");
        // 調(diào)用EC2實(shí)例上的腳本或直接使用AWS Systems Manager
        AWSSystemsManager ssm = AWSSystemsManagerClientBuilder.defaultClient();
        SendCommandRequest request = new SendCommandRequest()
            .withInstanceIds("i-xxxxxxxxxxxx")
            .withDocumentName("AWS-RunShellScript")
            .withParameters(Collections.singletonMap(
                "commands", Arrays.asList(
                    "cd /opt/scripts",
                    "./secure_batch_user.sh /tmp/dynamic_users.txt"
                )
            ));
        SendCommandResult result = ssm.sendCommand(request);
        return "Command sent: " + result.getCommand().getCommandId();
    }
}