Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is a thing that has always bothered me: how am I best to handle Debian standard groups for LDAP users?

Debian has a number of groups defined by default, e.g. plugdev, audio, cdrom and so on. These control access in standard Debian installs.

When I want a user from LDAP to be a member of the `audio' group on all machines they log in to, I've tried a few different things:

  • Adding them to the local group on the machine (this works but is hard to maintain)
  • Creating a group in LDAP with the same name and a different GID then adding the user to that group (breaks reverse / forward GID mapping, doesn't seem to work)
  • Creating a group in LDAP with the same name and same GID and adding the user to that group (doesn't seem to work at all, things don't see the LDAP group members)
  • Creating a group in LDAP with the same name and same GID then removing the local group (this works but upsets Debian's maintenance scripts during upgrades that check for local system sanity)

What's the best practice for this scenario?

share|improve this question

Your third bullet point should resolve this, as I have done the exact same thing before. The key is how /etc/nsswitch.conf is defined for the group lookup type. You would want ldap defined before files as well, so that it searches the LDAP directory first for any group, and thus overrides since it will use the first match and skip remaining defined name services.

Give that a shot or post the group line from /etc/nsswitch.conf.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.