[SSSD] Separate minimum uid and gid filter?

Stephen Gallagher sgallagh at redhat.com
Thu May 20 13:39:23 UTC 2010


On 05/20/2010 09:09 AM, Petter Reinholdtsen wrote:
>
> After some struggling, I was finally able to get sssd version 1.0.5
> working here at the university.  The problem was not related to SSL
> certificates as I first suspected, but related to some surprising
> uid/gid filtering.
>
> My user have a gid value of 300, and users with this gid are silently
> ignored by sssd.  I tried to find some configuration setting to
> configure the minimun gid, but found nothing in the manual page for
> sssd.conf.  I did on the other hand find the min_id value.  But I
> would really like to keep the uid limit at 1000, while I would like to
> lower the gid limit to 1.  Is this possible?


No, this is not possible. Using network users and groups with IDs less 
than 1000 is a very bad idea, because they can conflict with system 
accounts on the client.

Or do you have network accounts that are associated with system-local 
groups? In that case, you should really move those groups to the LDAP 
server and update your clients. It's a bad central configuration that 
relies on client machines all having the same groups.

-- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/



More information about the sssd-devel mailing list