[Fedora-directory-users] posixgroup name lookups

[Rich Megginson]

John A. Sullivan III wrote:
> On Thu, 2008-11-20 at 09:01 -0800, George Holbert wrote:
>   
>> Jonathan Barber wrote:
>>     
>>> On Wed, Nov 19, 2008 at 03:32:28PM -0500, John A. Sullivan III wrote:
>>>   
>>>       
>>>> On Wed, 2008-11-19 at 12:21 -0800, George Holbert wrote:
>>>>     
>>>>         
>>>>> John A. Sullivan III wrote:
>>>>>       
>>>>>           
>>>>>>> John A. Sullivan III wrote:
>>>>>>>           
>>>>>>>               
>>> [snip]
>>>
>>>   
>>>       
>>>> <snip>
>>>> Thanks for the very thoughtful answer.  I'm not only new to LDAP but
>>>> also to Linux based file servers.  I've been in a management role for
>>>> the last decade and before then was doing NDS and NetWare for
>>>> directory/file.
>>>>
>>>> We were planning to use a umask of 007 for standard users and set the
>>>> sgid bit for shared folders.  That's where we thought it would be
>>>> helpful to have a group associated with each user.  In fact, it finally
>>>> made the default setup of creating a group for each user make sense as I
>>>> always wondered why that was done.  I suppose we'll also need to
>>>> activate file system acls for more complex setups as when multiple
>>>> groups need varying access to a shared file system directory.
>>>>     
>>>>         
>>> This arrangement is known (at least by Redhat) as User Private Groups
>>> (UPG):
>>> http://www.redhat.com/docs/manuals/linux/RHL-7.3-Manual/ref-guide/s1-users-groups-private-groups.html
>>>
>>> The primary reason for doing it is that group access to files is managed
>>> via secondary group membership, not primary group membership
>>>
>>> If each of your users has their own group, then adding a posixGroup
>>> objectclass to each user makes perfect sense. You may also want to place
>>> an uniqueness constraint on the gidNumber attribute as well:
>>> http://www.centos.org/docs/5/html/CDS/ag/8.0/Administering_DSPPR-Server_Plug_in_Functionality_Reference.html#Server_Plug_in_Functionality_Reference-UID_Uniqueness_Plug_in
>>>
>>> WRT to linux, the only gotcha I can think of is that you'll have to set
>>> the nss_ldap nss_base_group option in /etc/ldap.conf to an entry that's
>>> the common parent to both your users and groups - otherwise it'll never
>>> find the UPG's.
>>>
>>>   
>>>       
>> Another way would be to omit the addition of the posixGroup on your 
>> account objects, and just modify the filter on nss_base_group to include 
>> posixAccounts.
>> e.g.:
>> nss_base_group  
>> dc=example,dc=com?sub?(|(objectClass=posixGroup)(objectClass=posixAccount))
>>
>> posixAccount already includes the gidNumber and cn attributes, which is 
>> all you're really after here... unless you want to start adding 
>> memberUid attributes to your account objects (which doesn't make any 
>> obvious sense).
>>
>> You will almost certainly have to modify your nss_base_group setting in 
>> either case, as Jonathan suggested.
>>
>>     
> <snip>
> That's what I had first attempted to do but I do not see where to set
> that filter.  I didn't see anything in ldap.conf or nsswitch.conf.
> Where is it set? Thanks - John
>   
/etc/ldap.conf - do man nss_ldap - look for this:
       nss_base_<map> <basedn?scope?filter>
              Specify the search base, scope and filter to be  used  
for  spe-
              cific  maps. (Note that map forms part of the 
configuration file
...
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3258 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/fedora-directory-users/attachments/20081120/317a5ef3/attachment.bin>