3

Our company has many individual sites that currently each have their own scheme for Linux authentication. We are looking at redesigning to have one unified scheme with the future plan of porting all the accounts to a single LDAP, likely OpenLDAP. As part of this first phase, we would like to redo all the gids to fit at least some sort of standard. We'd like to allocate a range of gids to each site to use as needed. We are looking to start at gid 10000 (to avoid system gids, and any other already established gids at any particular site) and allocate at least 1000 gids each of them to use. This plan puts our highest gid at just under 300000.

The question comes down to whether OpenLDAP can reference a gid that high. It's not a matter of how many gids, as the majority of those sites don't currently need Linux gids. It's simply whether OpenLDAP would have an issue accessing a value at least that high or higher. It's my understanding that what *NIX OSs consider a "gid" is just a value to OpenLDAP, so theoretically, there shouldn't be a limitation on OpenLDAP's side, but I haven't found that stated, or anyone who has successfully used a gid of more than 200000.

Does anyone actually know if using a gid in the 300000 range cause an issue with OpenLDAP?

2

the GidNumber is unlimited.

The GID number is defined as an integer in the schema definitions

attributetype ( 1.3.6.1.1.1.1.1 NAME 'gidNumber'
    DESC 'An integer uniquely identifying a group in an administrative domain'
    EQUALITY integerMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )

According to RFC 4517 LDAP: Syntaxes and Matching Rules

3.3.16. Integer

A value of the Integer syntax is a whole number of unlimited
magnitude.
The LDAP-specific encoding of a value of this syntax is
the optionally signed decimal digit character string representation
of the number (for example, the number 1321 is represented by the
character string "1321"). The encoding is defined by ...

Since it is a character string and not a number you don't have the OS determined maximum size for a signed integer and the GID number in LDAP is unlimited.

On the other hand, your OS support and PAM libraries may be limited to 65534.

  • Excellent! This is exactly the answer I was looking for! Thank you! – F.lugo2000 Dec 11 '14 at 14:56
1

1/ Yes, the gid and uid limit is basically almost unlimited.

2/ I encountered a regression with old tar command (not GNU tar) that could not untar with over ~2000000 as uid/gid. There is no problem with GNU tar. I stay under the limit.

3/ I highly recommand having uid/gid of Ldap over the Unix Uid/Gid range of 65535. When you integrate Ldap with Unix (with sssd/nslcd/openldap-ssh, etc.), you risk a uid/gid collision. I encountered that, the group gets mixed, which breaks and add insecurity.

4/ As an example, FreeIpa Ldap default uid/gid range can be over millions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.