On 06/09/2010 02:03 AM, Petter Reinholdtsen wrote:
[Stephen Gallagher]
> The problem with using UID_MIN is that there are still a lot of (BAD)
> deployments out there that are doing things like setting an admin's
> primary GID to 10 (wheel) in LDAP so that they're admin on all the
> client machines. So even if UID_MIN is 500, we'd still hit filtering
> problems.
This could be avoided by providing a separate limit for groups, which
could be lower than the one for users. Minimum group id could be 1
while minimum user id could be 500.
Happy hacking,
Well, the real problem is this: min_id is integrated into our code at a
fairly low-level. Fixing that is definitely out of scope for the
immediate future. However, SSSD 1.2.x is going to be appearing in RHEL
6.0 (and presumably Debian as well) and needs to be supported for a long
time, in a lot of complicated environments.
So we've made the decision to match nss_ldap's functionality here, and
give up on our well-intentioned crusade to keep users from doing stupid
things in LDAP.
Also, it was recently brought to my attention that the root cause of
these problems comes from a tendency of admins to use passwd2ldif tools
to set up their original LDAP environment, without adjusting their ID
ranges. Given that this is a common practice, we really need to
acknowledge it and live with it (even if it's a bad idea).
Furthermore, the problem with trying to enforce a true minimum is that
even if admins WANTED to fix their servers, changing a user's UID has
repercussions throughout their environment that, frankly, no one will
want to deal with.
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/