On 06/08/2010 11:33 AM, Jeff Schroeder wrote:
On Tue, Jun 8, 2010 at 5:17 AM, Stephen
Gallagher<sgallagh(a)redhat.com> wrote:
> Also update manpage for min_id/max_id to be more clear about how
> it relates to primary GID.
> (
https://bugzilla.redhat.com/show_bug.cgi?id=590513)
>
> We've been seeing a LOT of bug reports where the min_id=1000 default is the
> cause. While it was a well-meaning effort, I think far too many deployments
> are following poor practices with regards to ID ranges, and we can't hope to
> legislate them.
The problem is so many ldap deployments begin by using those
passwd2ldif perl scripts by unknowing admins and inserted into a new
directory.
> So I propose that we change the default min_id to 1 (zero is a reserved
> value equivalent to "use the default" and we don't want to own root in
any
> case)
If this method isn't adopted, I propose setting min_id to what is set
as UID_MIN in /etc/login.defs. Every system running sssd should have
the shadow-utils package installed and hence would have
/etc/login.defs. Then the min would be lower on systems like fedora
(default uid_min=500) and higher on systems like debian/*buntu
(default uid_min=1000). Just some food for thought.
The problem with using UID_MIN is that there are still a lot of (BAD)
deployments out there that are doing things like setting an admin's
primary GID to 10 (wheel) in LDAP so that they're admin on all the
client machines. So even if UID_MIN is 500, we'd still hit filtering
problems.
We're going to opt to make the default case "Let them shoot themselves
in the foot".
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/