This is a thing that has always bothered me: how am I best to handle Debian standard groups for LDAP users?

Debian has a number of groups defined by default, e.g. plugdev, audio, cdrom and so on. These control access in standard Debian installs.

When I want a user from LDAP to be a member of the `audio' group on all machines they log in to, I've tried a few different things:

  • Adding them to the local group on the machine (this works but is hard to maintain)
  • Creating a group in LDAP with the same name and a different GID then adding the user to that group (breaks reverse / forward GID mapping, doesn't seem to work)
  • Creating a group in LDAP with the same name and same GID and adding the user to that group (doesn't seem to work at all, things don't see the LDAP group members)
  • Creating a group in LDAP with the same name and same GID then removing the local group (this works but upsets Debian's maintenance scripts during upgrades that check for local system sanity)

What's the best practice for this scenario?


Your third bullet point should resolve this, as I have done the exact same thing before. The key is how /etc/nsswitch.conf is defined for the group lookup type. You would want ldap defined before files as well, so that it searches the LDAP directory first for any group, and thus overrides since it will use the first match and skip remaining defined name services.

Give that a shot or post the group line from /etc/nsswitch.conf.

| improve this answer | |

I am not sure about how the things worked in the past, but I'm writing this for someone looking for a solution now and in the future.

In Ubuntu 16.04, with your third bullet point, I did it. The important thing here is, to make ldap entry come AFTER files entry in the group line in /etc/nsswitch.conf.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.