2

I'm attempting to add some of our LDAP users to a locally defined group on our RHEL server, however I get an error stating that the LDAP user is not found in /etc/passwd.

What would be the best way to allow LDAP users to be added to local groups?

My feeling is that this must be done manually. I could edit: /etc/group and add the LDAP group to the list. Would that be ideal?

[server]# id apache
uid=409(apache) gid=409(apache) groups=409(apache) context=user_u:system_r:unconfined_t:s0
[server]# id john.doe
uid=11389(john.doe) gid=6097(ABC_Corporate_US) groups=6097(ABC_Corporate_US) context=user_u:system_r:unconfined_t:s0
[server]# /usr/sbin/usermod -a -G apache john.doe
usermod: john.doe not found in /etc/passwd

OS: RHEL (Red Hat Enterprise Linux Server release 5.3 (Tikanga)) Note: Updating the OS on this machine is not an option.

Improve this question
3
  • Why not create an LDAP group?
    – Mei
    Mar 2, 2012 at 18:37
  • @David, that's a pretty generic question, can you clarify?
    – Highway of Life
    Mar 3, 2012 at 1:47
  • There are LDAP schema that support UNIX groups; if you use those, then you don't have to mess with on-system UNIX groups at all.
    – Mei
    Mar 5, 2012 at 15:57

2 Answers 2

Reset to default
4

Your version of usermod doesn't support LDAP. This was fixed in newer versions of RHEL:

http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.5_Technical_Notes/shadow-utils.html

Improve this answer
2
  • That means he could probablu edit /etc/group manually to add the users then?
    – Yanick Girouard
    Mar 2, 2012 at 19:23
  • While this may be true that the current version is out of date, it doesn't really answer the question (which is: How do you get around it in the current version posted?). I may not have permission to update RHEL.
    – Highway of Life
    Mar 3, 2012 at 1:43
3

I discovered that this can be achieved using the gpasswd command.

gpasswd -a john.doe apache
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.