Look at automember rules.
Verzonden vanaf mijn Samsung-apparaat
-------- Oorspronkelijk bericht --------
Van: Devin Acosta via FreeIPA-users <freeipa-users@lists.fedorahosted.org >
Datum: 02-06-17 20:13 (GMT+01:00)
Aan: Rob Crittenden <rcritten@redhat.com>
Cc: FreeIPA users list <freeipa-users@lists.fedorahosted.org >, Devin Acosta <linuxguru.co@gmail.com>
Onderwerp: [Freeipa-users] Re: FreeIPA (adding all new users to admin group by default?)
Rob,
That is what confuses me, I show that the default users group is "ipausers", however when I added an account which I just tested it added to admins group. Anything else that could be making it add it to the "admin" group?
[root@ipa01 ~]# ipa config-showMaximum username length: 32Home directory base: /homeDefault shell: /bin/bashDefault users group: ipausersDefault e-mail domain: m451.techSearch time limit: 2Search size limit: -1User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,descriptionEnable migration mode: FALSECertificate Subject base: O=M451.TECHPassword Expiration Notification (days): 4Password plugin features: AllowNThashSELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$ unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023Default PAC types: nfs:NONE, MS-PAC
[root@ipa01 ~]# ipa user-add testuser-devinFirst name: DevinLast name: Acosta---------------------------Added user "testuser-devin"---------------------------User login: testuser-devinFirst name: DevinLast name: AcostaFull name: Devin AcostaDisplay name: Devin AcostaInitials: DAHome directory: /home/testuser-devinGECOS: Devin AcostaLogin shell: /bin/bashPrincipal name: testuser-devin@M451.TECHPrincipal alias: testuser-devin@M451.TECHEmail address: testuser-devin@m451.techUID: 34375527GID: 34375527Password: FalseMember of groups: ipausers, adminsRoles: IT Security Specialist, sec_netops2, helpdesk, IT Specialist, User Administrator, Security Architect, ipa_joinIndirect Member of role: ipa_join, helpdesk, IT Security Specialist, sec_netops2, IT Specialist, Security Architect, User AdministratorKerberos keys available: False
On Fri, Jun 2, 2017 at 11:02 AM, Rob Crittenden <rcritten@redhat.com> wrote:
Devin Acosta via FreeIPA-users wrote:
>
> I am hoping to see if someone can tell me what I either need to change
> or update to get it so that FreeIPA doesn't automatically keep adding
> all new users that is created automatically to the admin group. I
> inherited this installation of FreeIPA and so far haven't been able to
> figure out what either got changed or how to disable this behavior? I am
> running the latest FreeIPA 4.4 on CentOS 7.3.
>
> Any help would be greatly appreciated.
Probably the default users group. Try:
$ kinit admin
$ ipa config-show |grep 'Default users group'
Can be changed using:
$ ipa config-mod --defaultgroup ipausers
You can probably do this in the UI as well but I'm a CLI guy.
rob