<div dir="ltr">Systemd is pretty good at this.<div><br></div><div>Get FAI to install a unit file to run your thing, and add a unit option like <span style="font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif;font-style:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;font-weight:inherit;white-space:inherit;background-color:rgb(239,240,241);color:rgb(36,39,41);font-size:13px">ConditionPathExists=/foo/bar</span> or <span style="font-size:13px;font-style:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;font-weight:inherit;font-family:Consolas,Menlo,Monaco,"Lucida Console","Liberation Mono","DejaVu Sans Mono","Bitstream Vera Sans Mono","Courier New",monospace,sans-serif;white-space:inherit;background-color:rgb(239,240,241);color:rgb(36,39,41)">ConditionPathExists=!/foo/bar</span><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div class="gmail_signature" data-smartmail="gmail_signature">Then make your thing touch or delete a flag file [ /foo/bar ] if successfully run.</div><div class="gmail_signature" data-smartmail="gmail_signature">There you have it, a service/script that only runs once.</div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><br></div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><br></div>Cheers,<div>Just</div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr">On Thu, 10 Jan 2019 at 17:14, John G Heim <<a href="mailto:jheim@math.wisc.edu">jheim@math.wisc.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Well, it's not really to the point. Maybe my example was bad but there <br>
are lots of other reasons one might want to run a script after the <br>
install is finished. Actually, the reason this came up is that I want <br>
the linux cli screen reader to run on the first boot and then get <br>
disabled. But I just added it to the things my fai setup does after the <br>
first reboot.<br>
<br>
<br>
<br>
<br>
On 1/10/19 6:55 AM, Brian Kroth wrote:<br>
> You can configure the nfsroot with your ldap configs so you can have <br>
> them available during fai. I used this (at another UW department) for <br>
> rescue consoles to support natural logins from admins.<br>
> <br>
> As far as the sudo config, why not just copy a sudoers (.d) snippet down <br>
> that references the user during fai/config management time? It can still <br>
> reference an ldap user without them being available yet. They don't need <br>
> to be in the local sudo group to privelege them. You can also add host <br>
> match restrictions if you want. It's quite customizable.<br>
> <br>
> On Thu, Jan 10, 2019, 00:29 Martin Krämer <<a href="mailto:mk.maddin@gmail.com" target="_blank">mk.maddin@gmail.com</a> <br>
> <mailto:<a href="mailto:mk.maddin@gmail.com" target="_blank">mk.maddin@gmail.com</a>>> wrote:<br>
> <br>
> Hi John,<br>
> <br>
> if you are using LDAP - why not permitting a LDAP group (which<br>
> already exists during install) and then configure sudo via LDAP?<br>
> <br>
> Thats how I solved it for my soho environment.<br>
> <br>
> See: <a href="https://www.sudo.ws/man/1.8.17/sudoers.ldap.man.html" rel="noreferrer" target="_blank">https://www.sudo.ws/man/1.8.17/sudoers.ldap.man.html</a><br>
> <br>
> Kind Regards<br>
> <br>
> Martin<br>
> <br>
> On Wed, Jan 9, 2019, 22:06 John G Heim <<a href="mailto:jheim@math.wisc.edu" target="_blank">jheim@math.wisc.edu</a><br>
> <mailto:<a href="mailto:jheim@math.wisc.edu" target="_blank">jheim@math.wisc.edu</a>> wrote:<br>
> <br>
> So I had this problem. I want to configure certain users to have<br>
> sudo on<br>
> the workstations I manage. Problem we do ldap authenticaition --<br>
> so the<br>
> users don't exist during the install. I can easily write an fai<br>
> script<br>
> to do an adduser but it doesn't work because the user doesn't exist<br>
> during the install. What I needed to do is to run a script once<br>
> after<br>
> the system reboots into the newly installed operating system. I<br>
> thought<br>
> about putting a script on there that would run at boot time and<br>
> delete<br>
> itself. But that's ugly and failure prone. But I came up with a<br>
> solution<br>
> that is much more reliable and flexible.<br>
> <br>
> 1. Create a crontab file to be copied to the target system<br>
> during the<br>
> install. For example, during my fai installs, I create a class<br>
> called<br>
> INSTALL. So I created a crontab file<br>
> /srv/fai/config/files/etc/crontab/INSTALL.<br>
> <br>
> Put a command like this in this file:<br>
> <br>
> @reboot root fai --class/dev/null=POSTINST softupdate<br>
> <br>
> 2. Add an fcopy command to one of your installation scripts to<br>
> copy the<br>
> crontab file:<br>
> <br>
> fcopy -Bi /etc/crontab<br>
> <br>
> 3. Create another, normal crontab file without the above line<br>
> and call<br>
> it POSTINST or whatever you called the class in the first<br>
> crontab. In<br>
> this example, it would be<br>
> /srv/fai/config/files/etc/crontab/POSTINST.<br>
> <br>
> 4. in your fai script space, create a directory called POSTINST<br>
> <br>
> mkdir /srv/fai/config/scripts/POSTINST<br>
> <br>
> 5. Put a script in there to install the normal crontab file<br>
> <br>
> fcopy -Bi /etc/crontab<br>
> <br>
> 6. Put scripts to do whatever else you want into that same<br>
> directory.<br>
> These scripts will be run just once when the system reboots<br>
> after the<br>
> original fai install. The target machine will look completely<br>
> normal and<br>
> there won't be any extra programs/scripts on it (unless you<br>
> count fai<br>
> itself).<br>
> <br>
> Verstehst du?<br>
> <br>
> -- <br>
> --<br>
> John G. Heim; <a href="mailto:jheim@math.wisc.edu" target="_blank">jheim@math.wisc.edu</a> <mailto:<a href="mailto:jheim@math.wisc.edu" target="_blank">jheim@math.wisc.edu</a>>;<br>
> sip://<a href="mailto:jheim@sip.linphone.org" target="_blank">jheim@sip.linphone.org</a> <mailto:<a href="mailto:jheim@sip.linphone.org" target="_blank">jheim@sip.linphone.org</a>><br>
> <br>
</blockquote></div>
<br>
<p style="font-family:Arial,Helvetica,sans-serif;font-size:1.3em;margin:0px;background-color:rgb(255,255,255)"><font color="#aeaaaa" face="Calibri, sans-serif"><span style="font-size:14.6667px">Notice: This email is confidential and may contain copyright material of members of the Ocado Group. Opinions and views expressed in this message may not necessarily reflect the opinions and views of the members of the Ocado Group. </span></font></p><p style="font-family:Arial,Helvetica,sans-serif;font-size:1.3em;margin:0px;background-color:rgb(255,255,255)"><font color="#aeaaaa" face="Calibri, sans-serif"><span style="font-size:14.6667px"> </span></font></p><p style="font-family:Arial,Helvetica,sans-serif;font-size:1.3em;margin:0px;background-color:rgb(255,255,255)"><font color="#aeaaaa" face="Calibri, sans-serif"><span style="font-size:14.6667px">If you are not the intended recipient, please notify us immediately and delete all copies of this message. Please note that it is your responsibility to scan this message for viruses. </span></font></p><p style="font-family:Arial,Helvetica,sans-serif;font-size:1.3em;margin:0px;background-color:rgb(255,255,255)"><font color="#aeaaaa" face="Calibri, sans-serif"><span style="font-size:14.6667px"> </span></font></p><p style="font-family:Arial,Helvetica,sans-serif;font-size:1.3em;margin:0px;background-color:rgb(255,255,255)"><font color="#aeaaaa" face="Calibri, sans-serif"><span style="font-size:14.6667px">Fetch and Sizzle are trading names of Speciality Stores Limited and Fabled is a trading name of Marie Claire Beauty Limited, both members of the Ocado Group.</span></font></p><p style="font-family:Arial,Helvetica,sans-serif;font-size:1.3em;margin:0px;background-color:rgb(255,255,255)"><font color="#aeaaaa" face="Calibri, sans-serif"><span style="font-size:14.6667px"> </span></font></p><p style="margin:0px;background-color:rgb(255,255,255)"><font color="#aeaaaa" face="Calibri, sans-serif" style="font-family:Arial,Helvetica,sans-serif;font-size:1.3em"><span style="font-size:14.6667px">References to the “Ocado Group” are to Ocado Group plc (registered in England and Wales with number 7098618) and its subsidiary undertakings (as that expression is defined in the Companies Act 2006) from time to time. The registered office of Ocado Group plc is </span></font><font color="#aeaaaa" face="calibri, sans-serif"><span style="font-size:14.6667px">Buildings One & Two, Trident Place, Mosquito Way, Hatfield, Hertfordshire, AL10 9UL</span></font><span style="font-family:Arial,Helvetica,sans-serif;font-size:14.6667px;color:rgb(174,170,170)"><font face="Calibri, sans-serif">.</font></span></p>