On 5/11/12 10:22 AM, Stephen Gallagher wrote:
> On Fri, 2012-05-11 at 10:19 -0400, Braden McDaniel wrote:
>> As I mentioned at the top of the thread, I changed the local group GID
>> on the Fedora 16 installation to 989 (from 990) to match the Fedora 17
>> installation. Things appear to be working fine on the Fedora 16
>> installation. (But it occurs to me that if I were to try to join a new
>> group with GID 990 on the Fedora 16 installation, I might see things go
>> squirrelly there, too.)
>> Should I have removed the local mock group on both installations?
> Yes, if you're maintaining it in LDAP, you should remove it locally.
> Otherwise, the client system will never ask LDAP for it. (It always
> checks the local files first, and ignores LDAP if it's found locally).
Okay, does this apply across the board? In particular, what about a
group like "users"? groupdel tells me I can't just delete it because
"games" is a member. Do I need to maintain the "games" user in LDAP
well? Or should I instead be finding a way to force removal of the
local "users" group?
That depends on the order in your nsswitch.conf. If you have files before sss
then yes, every lookup will go to files first and fall back to sss only if the
record is not in files.
Maintaining the "games" user in LDAP, while certainly
strikes me as a little unintuitive since it's not a "regular" user.
My choice would be to delete the group users from LDAP. But this decision is
up to you and depends on whole lot of things I guess. For example on IPA
server there is a group "ipausers" containing all users that are on the
server. Perhaps you should consider similar solution?