fun with fc13, ldaps, uids

[Bobby Krupczak]

Hi!

(I subscribed to the list but am not receiving the email yet.  I'm
reading replies via the archive.)
> I'm guessing rdk has a UID < 1000. This is generally a bad idea for
> network accounts, as they're vulnerable to colliding with local
> accounts. It sounds like in your case you actually have control over
> the UID range, so it might be possible for you to change the UID.
> Otherwise, change the min_id setting in sssd.conf to something more
> appropriate for your environment. (We have that there to try to
> protect against network vs. local ID conflicts)

[root@columbia openldap]# id rdk
uid=6169(rdk) gid=100(users) groups=100(users),109(slide),110(www)

My account is old as the hills and so I've kept my uid.  I agree that
standardized numbering ranges is a very good thing.

What are the defaults for sssd for uid ranges?  I see were the options
can be set but dont know what msSFU30UidNumber is.

# ldap_user_uid_number = msSFU30UidNumber
# ldap_user_gid_number = msSFU30GidNumber

Thanks,

Bobby

[Stephen Gallagher]

On 05/26/2010 11:12 AM, Bobby Krupczak wrote:
> Hi!
>
> (I subscribed to the list but am not receiving the email yet.  I'm
> reading replies via the archive.)

Check your junk mail folder. The confirmation email for joining the 
group may have gotten filtered out (or you might have mistyped your address)
> > I'm guessing rdk has a UID<  1000. This is generally a bad idea for
> > network accounts, as they're vulnerable to colliding with local
> > accounts. It sounds like in your case you actually have control over
> > the UID range, so it might be possible for you to change the UID.
> > Otherwise, change the min_id setting in sssd.conf to something more
> > appropriate for your environment. (We have that there to try to
> > protect against network vs. local ID conflicts)
>
> [root@columbia openldap]# id rdk
> uid=6169(rdk) gid=100(users) groups=100(users),109(slide),110(www)
>
> My account is old as the hills and so I've kept my uid.  I agree that
> standardized numbering ranges is a very good thing.

I was close: the problem is your group range, not the userid. Your group 
"users" is 100.  You probably want to set min_id=100. This has the same 
problem as having users in groups much too low. It will conflict with 
system groups in /etc/group
> What are the defaults for sssd for uid ranges?  I see were the options
> can be set but dont know what msSFU30UidNumber is.
>
> # ldap_user_uid_number = msSFU30UidNumber
> # ldap_user_gid_number = msSFU30GidNumber

Those are irrelevant to your current situation. That's where you can 
change the name of the attribute that is used to look up the UID number 
or GID number. The defaults are fine in your configuration.

If you do 'man sssd.conf' you'll see the min_id and max_id options. 
These are what you need. They define the range of users that SSSD will see.
> Thanks,
>
> Bobby
>
> sssd-devel mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/sssd-devel

[Bobby Krupczak]

Hi!
> Check your junk mail folder. The confirmation email for joining the group 
> may have gotten filtered out (or you might have mistyped your address)

I think I fat-fingured my confirm email.  Mutt allows me to go through
email too fast sometimes.  I've been receiving a lot of spam lately
that is getting through SA . .  Sigh.
> I was close: the problem is your group range, not the userid. Your group 
> "users" is 100.  You probably want to set min_id=100. This has the same 
> problem as having users in groups much too low. It will conflict with 
> system groups in /etc/group

Yup, that was it!  Thanks!!
> > # ldap_user_uid_number = msSFU30UidNumber
> > # ldap_user_gid_number = msSFU30GidNumber
>
> Those are irrelevant to your current situation. That's where you can change 
> the name of the attribute that is used to look up the UID number or GID 
> number. The defaults are fine in your configuration.

Yes, realized that after I sent the email.

Thanks!!  Got it working now.

On to configuring clamav, postfix, SA, dovecot, etc.  Fun!

Bobby