Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is a thing that has always bothered me: how am I best to handle Debian standard groups for LDAP users?

Debian has a number of groups defined by default, e.g. plugdev, audio, cdrom and so on. These control access in standard Debian installs.

When I want a user from LDAP to be a member of the `audio' group on all machines they log in to, I've tried a few different things:

  • Adding them to the local group on the machine (this works but is hard to maintain)
  • Creating a group in LDAP with the same name and a different GID then adding the user to that group (breaks reverse / forward GID mapping, doesn't seem to work)
  • Creating a group in LDAP with the same name and same GID and adding the user to that group (doesn't seem to work at all, things don't see the LDAP group members)
  • Creating a group in LDAP with the same name and same GID then removing the local group (this works but upsets Debian's maintenance scripts during upgrades that check for local system sanity)

What's the best practice for this scenario?

share|improve this question
add comment

1 Answer

Your third bullet point should resolve this, as I have done the exact same thing before. The key is how /etc/nsswitch.conf is defined for the group lookup type. You would want ldap defined before files as well, so that it searches the LDAP directory first for any group, and thus overrides since it will use the first match and skip remaining defined name services.

Give that a shot or post the group line from /etc/nsswitch.conf.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.