[SSSD] Separate minimum uid and gid filter?
Stephen Gallagher
sgallagh at redhat.com
Thu May 20 13:39:23 UTC 2010
On 05/20/2010 09:09 AM, Petter Reinholdtsen wrote:
>
> After some struggling, I was finally able to get sssd version 1.0.5
> working here at the university. The problem was not related to SSL
> certificates as I first suspected, but related to some surprising
> uid/gid filtering.
>
> My user have a gid value of 300, and users with this gid are silently
> ignored by sssd. I tried to find some configuration setting to
> configure the minimun gid, but found nothing in the manual page for
> sssd.conf. I did on the other hand find the min_id value. But I
> would really like to keep the uid limit at 1000, while I would like to
> lower the gid limit to 1. Is this possible?
No, this is not possible. Using network users and groups with IDs less
than 1000 is a very bad idea, because they can conflict with system
accounts on the client.
Or do you have network accounts that are associated with system-local
groups? In that case, you should really move those groups to the LDAP
server and update your clients. It's a bad central configuration that
relies on client machines all having the same groups.
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
More information about the sssd-devel
mailing list