[SSSD] [PATCH] Change default min_id to 1

Jeff Schroeder jeffschroeder at computer.org
Tue Jun 8 15:33:32 UTC 2010


On Tue, Jun 8, 2010 at 5:17 AM, Stephen Gallagher <sgallagh at redhat.com> wrote:
> Also update manpage for min_id/max_id to be more clear about how
> it relates to primary GID.
> (https://bugzilla.redhat.com/show_bug.cgi?id=590513)
>
> We've been seeing a LOT of bug reports where the min_id=1000 default is the
> cause. While it was a well-meaning effort, I think far too many deployments
> are following poor practices with regards to ID ranges, and we can't hope to
> legislate them.

The problem is so many ldap deployments begin by using those
passwd2ldif perl scripts by unknowing admins and inserted into a new
directory.

> So I propose that we change the default min_id to 1 (zero is a reserved
> value equivalent to "use the default" and we don't want to own root in any
> case)

If this method isn't adopted, I propose setting min_id to what is set
as UID_MIN in /etc/login.defs. Every system running sssd should have
the shadow-utils package installed and hence would have
/etc/login.defs. Then the min would be lower on systems like fedora
(default uid_min=500) and higher on systems like debian/*buntu
(default uid_min=1000). Just some food for thought.

-- 
Jeff Schroeder

Don't drink and derive, alcohol and analysis don't mix.
http://www.digitalprognosis.com



More information about the sssd-devel mailing list