From: Corinna Vinschen <corinna-cygwin@cygwin.com>
To: cygwin-apps@cygwin.com
Subject: Re: HEADSUP: New getent tool to read passwd and group data
Date: Sun, 23 Feb 2014 10:32:00 -0000 [thread overview]
Message-ID: <20140223103204.GI2246@calimero.vinschen.de> (raw)
In-Reply-To: <20140221214200.GH2246@calimero.vinschen.de>
[-- Attachment #1: Type: text/plain, Size: 2542 bytes --]
On Feb 21 22:42, Corinna Vinschen wrote:
> On Feb 21 16:20, Pierre A. Humblet wrote:
> > > From: Corinna Vinschen
> > > > Corinna,
> > > >
> > > > For packages such as exim we need to find the uid of System and of
> > > Administrator, which the user can set any which way in passwd.
> > > > So we lookup the SID (not the username) to get the uid (or gid).
> > > [...]
> > > > Is there an equivalent mechanism using getent ?
> > > > Else, could Cygwin disregard the passwd entries for these 2 users and use
> > > only the fixed values determined by the mapping from Windows?
> > >
> > > You should not have to expect a name change for the SYSTEM and the
> > > Administrators account. It should be entirely sufficient to check for the user
> > > Administrator and the user SYSTEM or +SYSTEM.
> >
> > Is that independent of local language?
>
> SYSTEM, yes, Administrators, no, unfortunately.
>
> > > If you really want to check
> > > by SID, feel free to enumerate all accounts by just omitting the username and
> > > scan for the SID you're looking for:
> >
> > > $ getent passwd | grep ',S-1-5-32-544:'
> > >
> > > $ getent group | grep ':S-1-5-18:'
> >
> > OK, thanks, that will work.
> > We have had cases of people in very large organizations trying to build the password with mkpasswd -d and that ended up taking hours. Won't the above run in the same issue? This needs to run in postinstall.
>
> It depends on the "db_enum" nsswitch.conf settings. Did you read my
> text about the change by any chance? If not, see my latest version
> here: http://cygwin.com/ml/cygwin/2014-02/msg00585.html
>
> Yes, it might take time, even though the LDAP queries should be slightly
> faster than the NetUserEnum call before. Therefore it would make more
> sense to check for the uid/gid values 18 and 544, IMHO.
For the records:
I prepared the Cygwin DLL to allow fetching passwd and group entries by
SID, and I have a new version of getent ready for upload which allows
to fetch passwd and group entries by SID:
$ getent passwd S-1-5-32-544
$ getent group S-1-5-18
This also works with the current file-only based passwd/group handling,
but the change requires at least the upcoming Cygwin 1.7.29.
So, if you want to use getent with SIDs, just wait a couple more days
until we released 1.7.29.
Thanks,
Corinna
--
Corinna Vinschen Please, send mails regarding Cygwin to
Cygwin Maintainer cygwin AT cygwin DOT com
Red Hat
[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]
prev parent reply other threads:[~2014-02-23 10:32 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-02-20 19:38 Corinna Vinschen
[not found] ` <025d01cf2f2d$014b0040$03e100c0$@ieee.org>
2014-02-21 20:27 ` Corinna Vinschen
2014-02-21 21:10 ` Corinna Vinschen
2014-02-21 21:37 ` Corinna Vinschen
2014-02-21 21:21 ` Pierre A. Humblet
2014-02-21 21:42 ` Corinna Vinschen
2014-02-23 10:32 ` Corinna Vinschen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140223103204.GI2246@calimero.vinschen.de \
--to=corinna-cygwin@cygwin.com \
--cc=cygwin-apps@cygwin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).