filter_users using user id

[Francois Rigault]

Greetings,
we run some podman containers that come with their own local users, such as this one:
ironic-inspector:x:42461:42461::/var/lib/ironic-inspector:/usr/sbin/nologin

when running a top on the server, top tries to resolve the user name for that id and fails, however there is still a BE_REQ_USER request sent:
(2022-12-30 22:42:33): [be[MY.DOMAIN.NET]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][idnumber=42461]

I would hope to get rid of these requests against the domain.
unfortunately in MY.DOMAIN.NET there are uids below and above this number, so I cannot rely on the "min_id" parameter to filter users.
I would like to know if it is possible to support using user ids in the [nss] filter_users to prevent those user requests to the domain, or if anyone has any other suggestion.

I increased the entry_negative_timeout to reduce the number of queries, but filtering them out entirely would be even better.
Thank you!

[Tomas Halman]

This is not exactly what you want, but did you consider changing the uid
used in the container?

Tomas

On Fri, Dec 30, 2022 at 11:56 PM Francois Rigault <
[e-mail]> wrote:
> Greetings,
> we run some podman containers that come with their own local users, such
> as this one:
> ironic-inspector:x:42461:42461::/var/lib/ironic-inspector:/usr/sbin/nologin
>
> when running a top on the server, top tries to resolve the user name for
> that id and fails, however there is still a BE_REQ_USER request sent:
> (2022-12-30 22:42:33): [be[MY.DOMAIN.NET]] [dp_get_account_info_send]
> (0x0200): Got request for [0x1][BE_REQ_USER][idnumber=42461]
>
> I would hope to get rid of these requests against the domain.
> unfortunately in MY.DOMAIN.NET there are uids below and above this
> number, so I cannot rely on the "min_id" parameter to filter users.
> I would like to know if it is possible to support using user ids in the
> [nss] filter_users to prevent those user requests to the domain, or if
> anyone has any other suggestion.
>
> I increased the entry_negative_timeout to reduce the number of queries,
> but filtering them out entirely would be even better.
> Thank you!
> _______________________________________________
> sssd-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail].o...
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue

[François Rigault]

> This is not exactly what you want, but did you consider changing the uid
> used in the container?

so, we run images that are supported and built by the vendor, who recommend against this (ticket: https://bugzilla.redhat.com/show_bug.cgi?id=1565929#c12).

maybe tools like top should not try to resolve user names for processes running within a user namespace to start with.

I poke around and it should nevertheless be quite straightforward (for a prototype at least) to filter users by uid with something like https://github.com/freedge/sssd/commit/576340edf8e041bd1a17da52880fe84695e25...

Thank you!

[Lukas Slebodnik]

On (02/01/23 21:21), François Rigault wrote:
> > This is not exactly what you want, but did you consider changing the uid
> > used in the container?
>
> so, we run images that are supported and built by the vendor, who recommend against this (ticket: https://bugzilla.redhat.com/show_bug.cgi?id=1565929#c12).
>
> maybe tools like top should not try to resolve user names for processes running within a user namespace to start with.
>
> I poke around and it should nevertheless be quite straightforward (for a prototype at least) to filter users by uid with something like https://github.com/freedge/sssd/commit/576340edf8e041bd1a17da52880fe84695e25...

IMHO the new option `filter_uids` would be a bit more clear approach.

But one might still try to use current features for
negative cache of local users.

man sssd.conf -> local_negative_timeout
```
       local_negative_timeout (integer)
           Specifies for how many seconds nss_sss should keep local users and
           groups in negative cache before trying to look it up in the back
           end again. Setting the option to 0 disables this feature.

Default: 14400 (4 hours)
```

One just would need to add dummy user with that UID.

LS
> Thank you!
> _______________________________________________
> sssd-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail].o...
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[François Rigault]

> One just would need to add dummy user with that UID.

note this does not work when using DynamicUser (https://systemd.io/UIDS-GIDS/#special-systemd-uid-ranges)

```
$ systemd-run -p DynamicUser=yes --pipe -- ps -o uid,cmd
Running as unit: run-p20670-i20970.service
  UID CMD
64283 /bin/ps -o uid,cmd

$ grep 64283 /var/log/sssd/sssd_DOM.log
(2025-03-22 11:58:38): [be[DOM]] [dp_get_account_info_send] (0x0200): Got request for [0x1][BE_REQ_USER][idnumber=64283]
(2025-03-22 11:58:39): [be[DOM]] [dp_get_account_info_send] (0x0200): Got request for [0x2][BE_REQ_GROUP][idnumber=64283]
```