We have an (old and grown) infrastructure of linux machines (mostly debian). For user authentication we use LDAP where we have defined several groups with different access rights. Unluckily one of these groups is called
staff which has become a standard group name in debian. The consequences are that whenever a package is updated that has something to do with groups (e.g.,
passwd) it creates a local group staff on the machine that eclipses the LDAP staff group. The consequences are that logins no longer work, etc.
Since the infrastructure is not new, it would be very laborious to change the group name, since it appears in various config files on different machines.
The question is: how to disable the local group file (forever)? Or is there any other workaround?
Currently we have to delete the local staff group manually from
/etc/groups after each update that creates it.
What has been tried without success:
- Changing the order in the
group: files ldapto
group: ldap files--> Effect: system hangs at boot.