Howto determine a shared/network source of users and groups is active?

Howto determine a shared/network source of users and groups is active?

[Stef Bon]

Hi all,

I hope you are all doing ok.

I'm working on a service based on SSH connections and SFTP file transfer.
To make the name and/or id translation work I'm looking for a way the
user and group databases are shared between server and client. If so,
it is very easy.
If not I have to create a mapping.

I can write an utility which
scans every line in /etc/nsswitch.conf and test for words like ldap in
the line starting with passwd: and group: (and also for sss).
If found test it's working and also active on the server.
Maybe you see, this is a lot of work, and testing of all kinds of possibilities.
Is there a simpler way to do that? To get an unique id per user/group
database or something like that.

Thanks in advance,

S.J. Bon

Re: Howto determine a shared/network source of users and groups is active?

[Florian Weimer]

* Stef Bon via Libc-help:

> I can write an utility which
> scans every line in /etc/nsswitch.conf and test for words like ldap in
> the line starting with passwd: and group: (and also for sss).
> If found test it's working and also active on the server.
> Maybe you see, this is a lot of work, and testing of all kinds of possibilities.
> Is there a simpler way to do that? To get an unique id per user/group
> database or something like that.

Don't you also want to check that they use the *same* LDAP database?
This seems to be something that needs FreeIPA or perhaps Kerberos
support, so I'd suggest to ask on those lists.

Thanks,
Florian

Re: Howto determine a shared/network source of users and groups is active?

[Stef Bon]

Hi,

Op vr 23 sep. 2022 om 07:14 schreef Florian Weimer <fweimer@redhat.com>:
>
> * Stef Bon via Libc-help:
>

>
> Don't you also want to check that they use the *same* LDAP database?

Yes of course.

> This seems to be something that needs FreeIPA or perhaps Kerberos
> support, so I'd suggest to ask on those lists.

That is an idea, but to begin with is there a way/tool to detect the
sources /databases of the passwd and group in Linux? Other than
scanning the /etc/nsswitch.conf file?

So probably not.

Stef

Re: Howto determine a shared/network source of users and groups is active?

[Florian Weimer]

* Stef Bon:

>> This seems to be something that needs FreeIPA or perhaps Kerberos
>> support, so I'd suggest to ask on those lists.
>
> That is an idea, but to begin with is there a way/tool to detect the
> sources /databases of the passwd and group in Linux? Other than
> scanning the /etc/nsswitch.conf file?
>
> So probably not.

No, I don't think so.  The LDAP integration module probably isn't even
called “ldap”.  For example, in Fedora and downstreams, it's called
“sss”.

Thanks,
Florian

Re: Howto determine a shared/network source of users and groups is active?

[Stef Bon]

Sorry for my late reaction.

It looks like the only way to find out users and groups are shared is
scanning the nsswitch.conf file. And from there check the services
found.

On my system (gentoo) it's also named sss.

Thanks,

Stef Bon