[SSSD] [PATCH] Change default min_id to 1

Stephen Gallagher sgallagh at redhat.com
Wed Jun 9 11:27:23 UTC 2010


On 06/09/2010 02:03 AM, Petter Reinholdtsen wrote:
>
> [Stephen Gallagher]
>> The problem with using UID_MIN is that there are still a lot of (BAD)
>> deployments out there that are doing things like setting an admin's
>> primary GID to 10 (wheel) in LDAP so that they're admin on all the
>> client machines. So even if UID_MIN is 500, we'd still hit filtering
>> problems.
>
> This could be avoided by providing a separate limit for groups, which
> could be lower than the one for users.  Minimum group id could be 1
> while minimum user id could be 500.
>
> Happy hacking,

Well, the real problem is this: min_id is integrated into our code at a 
fairly low-level. Fixing that is definitely out of scope for the 
immediate future. However, SSSD 1.2.x is going to be appearing in RHEL 
6.0 (and presumably Debian as well) and needs to be supported for a long 
time, in a lot of complicated environments.

So we've made the decision to match nss_ldap's functionality here, and 
give up on our well-intentioned crusade to keep users from doing stupid 
things in LDAP.

Also, it was recently brought to my attention that the root cause of 
these problems comes from a tendency of admins to use passwd2ldif tools 
to set up their original LDAP environment, without adjusting their ID 
ranges. Given that this is a common practice, we really need to 
acknowledge it and live with it (even if it's a bad idea).

Furthermore, the problem with trying to enforce a true minimum is that 
even if admins WANTED to fix their servers, changing a user's UID has 
repercussions throughout their environment that, frankly, no one will 
want to deal with.

-- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/



More information about the sssd-devel mailing list