I'm trying to set up a system where a visitor can enter any user name in a form to create a new user and in the end it gets built on LDAP directory and I'm planning that to be mapped as a UNIX account as well (on Ubuntu Linux) by making the system look up for system accounts on the LDAP. Doing so is fine, but I feel that many user names should be avoided, one of the obvious being 'root' and all the other user names taken for daemons etc.

How do you tackle at this problem? Do you make up a list of disallowed user names by checking /etc/passwd? I was thinking that if, internally, the user names could be prepended as 'ldap_' or something, it will avoid any naming conflicts but that seems hard when the LDAP entry name is 'joe' but the system account will look like 'ldap_joe'. Not even sure how that can be achieved.


Well form validation is really your frontline defence and should not be overlooked.

In addition to that, I'd probably also import all current uids into ldap .. therefore anyone trying to re-create them will generate naming conflicts.

That being said, were I in your shoes, I'd go ahead and assign a prefix or generate the user accounts names automatically ( firstname.lastname, lastname$i, etc... ). I don't like the idea of anyone creating any username they want to .. it's just a recipe for a later headache.

For instance, if someone creates a user "www" which my package manager ( or myself ) later decide to apply to a service account, we're going to have a conflict and potentially a security implication. Why risk it ?

I'd rather be cautious and plan for what I havn't thought of yet then get bitten in the ass at a later date.

That being said, it really all depends on your situation and requirements.


The simplest way to be just to do form validation, in other words have your script check if any of these system usernames are entered into the form. If the username entered is on your "list" of disallowed names (probably using the accounts in /etc/passwd as a template), kick back an error message stating that account can not be created for reason foo.

  • That's what I was going to do if there isn't any way to do it better. I'm just collecting bad looking names from /etc/passwd and anything that looks sensitive (like guest, anonymous). – h1d Dec 1 '09 at 4:44

Second on the form validation (frontend). Easiest.

Other options broken out by tier:

  1. Middle tier (roll your own) - Create a pick list as an array and look for bad names as validation before writing to LDAP. You can also have a pick list in a DB if you want. Having it in a DB or in a file externalizes the pick list from code which makes it easier to change while running.
  2. Middle Ruby - I don't know what language you are using but you could create a validation without ActiveRecord to validate the string before writing to LDAP. There's other ways to do this too. Just create a validation class that increases a score when a string doesn't meet your validation rules and check if the score is non-zero.
  3. Backend - Pre-create the users in LDAP and throw an exception when the names conflict. Lock the LDAP accounts with an expired password. Make sure LDAP root is not used before /etc/passwd root (for example in PAM you'd order it passwd first, default iirc).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy