ad install_check script

gistfile1.txt

#!/bin/bash

# Version 0.5
# Install check for the AD Bind Package.
# This script checks to see if 1. We are bound to AD and if our binding is working.
# If we are not bound, or our binding is broken, lets go ahead and try to rebind
# 
# If we exit this script with 1, then we should _not_ attempt a rebind.
# If we exit this script with 0, then we _SHOULD_ attempt a rebind. 

# Lets save the out put of this to a log file
# Logging stdout and sterr to our log file and also displaying on tty for verbose output while running
LOG_FILE=/tmp/ad_bind_install_check.log
touch $LOG_FILE
LOG_FILE_SIZE=$(du -k $LOG_FILE | awk '{print $1}')  
if [ "$LOG_FILE_SIZE" -gt 1024 ]; then
        # We have a log file, and it is larger than 1Mb
        # Lets kill it and start again
        rm $LOG_FILE
        echo $(date "+%a %b %d %H:%M:%S") "*** Log file rotated ***" >> "$LOG_FILE"
fi   
exec > >(tee -a ${LOG_FILE} )
exec 2> >(tee -a ${LOG_FILE} >&2)

ldap_test="adldap.xxx.xxx.xxx.xx"
test_account="xxxxxxxxxxx"


id_check_test(){
    echo $(date "+%a %b %d %H:%M:%S") " - Final test, looking up test account with the id command"
    id "$test_account" > /dev/null
    id_test_result=$?
    if [ "$id_test_result" != "0" ]; then
        echo $(date "+%a %b %d %H:%M:%S") " [FAIL] - ID test failed! Unable to resolve user account using ID. We need to rebind"
        exit 0
    else
        echo $(date "+%a %b %d %H:%M:%S") " - ID test passed with exit code: $id_test_result. No action to take. Exiting 1 here."
        exit 1
    fi
}

# See if we can ping the adldap wip, if we can't ping it for whatever reason bail out here.
echo $(date "+%a %b %d %H:%M:%S") " - Pinging $ldap_test ..."
ping -qoc2 -t 2 $ldap_test > /dev/null
ping_result=$?
if [ "$ping_result" != "0" ]; then
    echo $(date "+%a %b %d %H:%M:%S") " [FAIL] Ping test failed. Exiting 1 - No action to take. Exiting 1 here."
    exit 1
else
    echo $(date "+%a %b %d %H:%M:%S") " [OK] Ping test exit code: $ping_result"
fi

# Check that our binding is to the domain detnsw.win
echo $(date "+%a %b %d %H:%M:%S") " - Checking for DETNSW.WIN as the domain from dsconfigad -show ..."
if [[ $(dsconfigad -show | awk '/Active Directory Domain/{ print $NF }') == "detnsw.win" ]]; then
    ## See if we have a password for our computer
    security find-generic-password -l "/Active Directory/DETNSW" | grep "Active Directory" >> /dev/null
    security_test=$?
    echo $(date "+%a %b %d %H:%M:%S") " - Security keychain test exit code: $security_test"
    if [ "$security_test" == "0" ]; then
        ## AD keychain file exists, continue
        echo $(date "+%a %b %d %H:%M:%S") " [OK] Security Keychain test passed, next..."
        dscl /Active\ Directory/DETNSW/All\ Domains -read /Users/$test_account >> /dev/null
        dscl_read_test=$?
        echo $(date "+%a %b %d %H:%M:%S") " - dscl read test exit code: $dscl_read_test"
        if [ "$dscl_read_test" == "0" ]; then
            ## Successful lookup of bind account. AD communication is working - no need to rebind
            echo $(date "+%a %b %d %H:%M:%S") " [OK] DSCL read test successful, no need to rebind. Exiting 1 here"
            exit 1
        elif [ "$dscl_read_test" == "56" ]; then
            ## Appears to be bound but unable to communicate with AD - we should rebind
            echo $(date "+%a %b %d %H:%M:%S") " [FAIL] DSCL read test matched error code 56. unable to communicate with AD."
            id_check_test
        else 
            echo $(date "+%a %b %d %H:%M:%S") " [FAIL] dscl read test gave error code: $dscl_read_test"
            id_check_test
        fi
    else
        # No ad keychain found or an error, lets rebind
        echo $(date "+%a %b %d %H:%M:%S") " [FAIL] No AD keychain found!"
        id_check_test
    fi
else
    ## No binding found at all - go ahead and bind
    echo $(date "+%a %b %d %H:%M:%S") " [FAIL] dsconfigad -show isn't matching detnsw.win."
    id_check_test
fi