I use NIS to provide login services on my network to all the users and there are conflicts between local system/daemon UIDs and UIDs provided by NIS.
While trying to su over to another user on my workstation (NIS Client), I found that distcc (UID 1000) had the same UID as the user I was trying to su to. I think the fact that the distcc account was created with a UID at or above 1000 is a bug. Here are some reasons why: * NIS includes uid 500 and above in the passwd maps and this allows the potential for non-unique UIDs on NIS Clients, which opens a security risk to users' files. * Commands such as id will not report the correct information. id will combine the information from the local passwd file and NIS, but, it will always report the UID as belonging to distcc. * Environment variables containing the users login name may not get set correctly. * Scripts or programs that read files in a certain path based on the user's name might fail. Most notably X and/or KDE. The fact that a daemon account was created with a UID at or above 1000 extends further than distcc alone. I have 4 machines running Gentoo --- 2 servers and 2 workstations. On my workstation, I also have a q3 (Quake3 dedicated server user) account with a UID 1016, which currently doesn't conflict with a NIS provided login but will conflict with the next user account I create. On my other workstation, the distcc account exists with a UID of 42861, as well as, a privoxy account with a UID of 42860. It is doubtful that on my network I'll add enough user accounts for there to be a conflict here but there is still the potential. It is very likely for some businesses / environments to have predefined UIDs for their employees or users and if this workstation were a part of that environment then conflicts would be more likely. On my firewall box, the distcc account also exists with a UID of 1000, as well as, a privoxy account with a UID of 1001. The firewall box is not a NIS client, however, it is a NFS client for use with portage and distfiles. If I were to allow NIS logins, then both accounts would conflict with 2 different NIS provided logins. I could change the local system/daemon UIDs on 3 of the systems to match the server but I would also have to search all local file systems for files and directories owned by the old UID and change the ownership to the new UID. Now, imagine your the administrator of 30 or more machines. This is fairly trivial to do but becomes administratively difficult to perform and maintain. It would be a nightmare and after a while not worth it. I've briefly dealt with high availability clusters and other distributed environments and if Gentoo were to be used in these scenarios making sure system/daemon UIDs are identical is critical. OK, now what to do about it. I purpose UIDs be assigned to all system/daemon accounts that don't already have an assigned UID using the UID range 100 - 499. Any thoughts / suggestions? -- [EMAIL PROTECTED] mailing list
