[Fedora-directory-users] posixgroup name lookups

Fri Nov 21 00:16:12 UTC 2008

On Thu, 2008-11-20 at 14:43 -0800, George Holbert wrote:
> John A. Sullivan III wrote:
> > On Thu, 2008-11-20 at 09:01 -0800, George Holbert wrote:
> >   
> >> Jonathan Barber wrote:
> >>     
> >>> On Wed, Nov 19, 2008 at 03:32:28PM -0500, John A. Sullivan III wrote:
> >>>   
> >>>       
> >>>> On Wed, 2008-11-19 at 12:21 -0800, George Holbert wrote:
> >>>>     
> >>>>         
> >>>>> John A. Sullivan III wrote:
> >>>>>       
> >>>>>           
> >>>>>>> John A. Sullivan III wrote:
> >>>>>>>           
> >>>>>>>               
> >>> [snip]
> >>>
> >>>   
> >>>       
> >>>> <snip>
> >>>> Thanks for the very thoughtful answer.  I'm not only new to LDAP but
> >>>> also to Linux based file servers.  I've been in a management role for
> >>>> the last decade and before then was doing NDS and NetWare for
> >>>> directory/file.
> >>>>
> >>>> We were planning to use a umask of 007 for standard users and set the
> >>>> sgid bit for shared folders.  That's where we thought it would be
> >>>> helpful to have a group associated with each user.  In fact, it finally
> >>>> made the default setup of creating a group for each user make sense as I
> >>>> always wondered why that was done.  I suppose we'll also need to
> >>>> activate file system acls for more complex setups as when multiple
> >>>> groups need varying access to a shared file system directory.
> >>>>     
> >>>>         
> >>> This arrangement is known (at least by Redhat) as User Private Groups
> >>> (UPG):
> >>> http://www.redhat.com/docs/manuals/linux/RHL-7.3-Manual/ref-guide/s1-users-groups-private-groups.html
> >>>
> >>> The primary reason for doing it is that group access to files is managed
> >>> via secondary group membership, not primary group membership
> >>>
> >>> If each of your users has their own group, then adding a posixGroup
> >>> objectclass to each user makes perfect sense. You may also want to place
> >>> an uniqueness constraint on the gidNumber attribute as well:
> >>> http://www.centos.org/docs/5/html/CDS/ag/8.0/Administering_DSPPR-Server_Plug_in_Functionality_Reference.html#Server_Plug_in_Functionality_Reference-UID_Uniqueness_Plug_in
> >>>
> >>> WRT to linux, the only gotcha I can think of is that you'll have to set
> >>> the nss_ldap nss_base_group option in /etc/ldap.conf to an entry that's
> >>> the common parent to both your users and groups - otherwise it'll never
> >>> find the UPG's.
> >>>
> >>>   
> >>>       
> >> Another way would be to omit the addition of the posixGroup on your 
> >> account objects, and just modify the filter on nss_base_group to include 
> >> posixAccounts.
> >> e.g.:
> >> nss_base_group  
> >> dc=example,dc=com?sub?(|(objectClass=posixGroup)(objectClass=posixAccount))
> >>
> >> posixAccount already includes the gidNumber and cn attributes, which is 
> >> all you're really after here... unless you want to start adding 
> >> memberUid attributes to your account objects (which doesn't make any 
> >> obvious sense).
> >>
> >> You will almost certainly have to modify your nss_base_group setting in 
> >> either case, as Jonathan suggested.
> >>
> >>     
> > <snip>
> > Alas, I'm not sure this is going to work as expected but it could be my
> > ignorance.  I've read the man page and whatever documentation I could
> > find.  It appears it does an & operation with the additional filter
> > whereas I need an |.
> >
> > I gather the default is:
> > &(objectClass=posixgroup)(cn=group_name)
> >
> > I think I need it to be:
> > |((&(objectClass=posixgroup)(cn=group_name))(&(objectClass=posixaccount)(uid=group_name)))
> >
> > If it does an &, I think I get:
> > &((&(objectClass=posixgroup)(cn=group_name))(&(objectClass=posixaccount)(uid=group_name)))
> >
> > Nevertheless, I tried all of the following without success:
> >
> > nss_base_group          dc=X,dc=com,dc=ssiservices,dc=biz?sub?|(objectClass=posixAccount)
> >
> > nss_base_group          dc=X,dc=com,dc=ssiservices,dc=biz?sub?|(&(objectClass=posixAccount)(uid=group_name))
> > this broke the posixgroup filter, too!
> >
> > nss_base_group          dc=X,dc=com,dc=ssiservices,dc=biz?sub?&(objectClass=posixAccount)(uid=group_name)
> > this broke the posixgroup filter, too!
> >
> > nss_base_group          dc=X,dc=com,dc=ssiservices,dc=biz?sub?(objectClass=posixAccount)(uid=group_name)
> > this broke the posixgroup filter, too!
> >
> > nss_base_group          dc=X,dc=com,dc=ssiservices,dc=biz?sub?(objectClass=posixAccount)
> > this broke the posixgroup filter, too!
> >
> > nss_base_group          dc=X,dc=com,dc=ssiservices,dc=biz?sub?&(objectClass=posixAccount)
> >
> > I did flush the nscd group database between each try.  What am I doing
> > wrong? Thanks - John
> >   
> It's not immediately obvious to me where the problem is.
> But, have you tried reviewing your LDAP server's access log?
> That's often a huge help for troubleshooting this kind of thing.
<snip>
Thanks.  I do see what it is doing but I'm still not sure how to
configure the nss_base_group for two reasons which I'll state in a
second.  Here is a query when I do an ls -l on a directory so it needs
to resolve the gidnumber to a group name:

filter="(&(objectClass=posixGroup)(gidNumber=103000)(|(&(objectClass=posixAccount)(gidNumber=group_number))))"

This is what happens if I try to do a chgrp and it thus needs to resolve
a name to a number:

filter="(&(objectClass=posixGroup)(cn=barry.knowles)(|(&(objectClass=posixAccount))))"

The first question is where to find the variables which are replaced by
the actual values.  You can see I guessed at group_number in the first
case and was wrong.  How do I build a filter which will substitute
103000 when I am seeking that particular gidnumber?

The second question is the sought attribute seems to vary depending on
the function.  How do I create the filter to search on gidnumber in the
first case and cn in the second?

Sorry if I'm being dense.  I'm quite new to all this - John
-- 
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan at opensourcedevel.com

http://www.spiritualoutreach.com
Making Christianity intelligible to secular society