filter_users using user id

[Francois Rigault]

Greetings,
we run some podman containers that come with their own local users, such as this one:
ironic-inspector:x:42461:42461::/var/lib/ironic-inspector:/usr/sbin/nologin

when running a top on the server, top tries to resolve the user name for that id and
fails, however there is still a BE_REQ_USER request sent:
(2022-12-30 22:42:33): [be[MY.DOMAIN.NET]] [dp_get_account_info_send] (0x0200): Got
request for [0x1][BE_REQ_USER][idnumber=42461]

I would hope to get rid of these requests against the domain.
unfortunately in MY.DOMAIN.NET there are uids below and above this number, so I cannot
rely on the "min_id" parameter to filter users.
I would like to know if it is possible to support using user ids in the [nss] filter_users
to prevent those user requests to the domain, or if anyone has any other suggestion.

I increased the entry_negative_timeout to reduce the number of queries, but filtering them
out entirely would be even better.
Thank you!

[Tomas Halman]

This is not exactly what you want, but did you consider changing the uid
used in the container?

Tomas


On Fri, Dec 30, 2022 at 11:56 PM Francois Rigault <
rigault.francois(a)gmail.com&gt; wrote:

>  Greetings,
>  we run some podman containers that come with their own local users, such
>  as this one:
>  ironic-inspector:x:42461:42461::/var/lib/ironic-inspector:/usr/sbin/nologin
>
>  when running a top on the server, top tries to resolve the user name for
>  that id and fails, however there is still a BE_REQ_USER request sent:
>  (2022-12-30 22:42:33): [be[MY.DOMAIN.NET]] [dp_get_account_info_send]
>  (0x0200): Got request for [0x1][BE_REQ_USER][idnumber=42461]
>
>  I would hope to get rid of these requests against the domain.
>  unfortunately in MY.DOMAIN.NET there are uids below and above this
>  number, so I cannot rely on the "min_id" parameter to filter users.
>  I would like to know if it is possible to support using user ids in the
>  [nss] filter_users to prevent those user requests to the domain, or if
>  anyone has any other suggestion.
>
>  I increased the entry_negative_timeout to reduce the number of queries,
>  but filtering them out entirely would be even better.
>  Thank you!
>  _______________________________________________
>  sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam, report it:
>  https://pagure.io/fedora-infrastructure/new_issue
>  

-- 
Tomáš Halman

[François Rigault]

>  This is not exactly what you want, but did you consider changing the
> uid
>  used in the container? 
so, we run images that are supported and built by the vendor, who recommend against this
(ticket: https://bugzilla.redhat.com/show_bug.cgi?id=1565929#c12).

maybe tools like top should not try to resolve user names for processes running within a
user namespace to start with.

I poke around and it should nevertheless be quite straightforward (for a prototype at
least) to filter users by uid with something like
https://github.com/freedge/sssd/commit/576340edf8e041bd1a17da52880fe84695...


Thank you!

[Lukas Slebodnik]

On (02/01/23 21:21), François Rigault wrote:
> > This is not exactly what you want, but did you consider changing
> the uid
> > used in the container?
>
> so, we run images that are supported and built by the vendor, who recommend against this
> (ticket: https://bugzilla.redhat.com/show_bug.cgi?id=1565929#c12).
>
> maybe tools like top should not try to resolve user names for processes running within a
> user namespace to start with.
>
> I poke around and it should nevertheless be quite straightforward (for a prototype at
> least) to filter users by uid with something like
> https://github.com/freedge/sssd/commit/576340edf8e041bd1a17da52880fe84695...
>  
IMHO the new option `filter_uids` would be a bit more clear approach.

But one might still try to use current features for
negative cache of local users.

man sssd.conf -> local_negative_timeout
```
       local_negative_timeout (integer)
           Specifies for how many seconds nss_sss should keep local users and
           groups in negative cache before trying to look it up in the back
           end again. Setting the option to 0 disables this feature.

           Default: 14400 (4 hours)
```

One just would need to add dummy user with that UID.

LS

> Thank you!
> _______________________________________________
> sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue