I have a bunch of batch applications that must run with a local linux user "batchjobs". Our team have AD users (eg: "COMPANY/user") to login to that machine. If we need to change current production state (editing a "batchjobs" script, reading log files, etc), we "sudo su" to that user. I want to find an easier way, specially because the old "root does all" structure worked a lot better (weird, but true).
I'm trying these approaches:
- Manually adding all users to "batchjobs". Works, but it's darn ugly, because there are N servers and M users, and both variables are really "variable"; or
- Map the "batchjobs" local group to "my-team" AD group. This seems to be the best solution, because with newgrp and umask on .bashrc, the team will work with "batchjobs" files without worrying about sudo or chown/chgrp. I don't know if it's possible. I tried with "net groupmap add" without success.
Currently, the only constraint I have is I cannot create AD users or groups. All team members are members of "my-team" AD group.