anyone running with ngroups increased from 16?

classic Classic list List threaded Threaded
6 messages Options
Reply | Threaded
Open this post in threaded view
|

anyone running with ngroups increased from 16?

Julian Elischer-5
Windows users seem to have an almost unlimited number of groups and
soem places seem to use them a LOT.
This gives Posix systems problems with deciding how to handle them
all. Especially when getting
user credentials from winbindd (samba).

Does anyone know of any work done to either bypass this limit or to at
least expand it?

Thanks

Julian

_______________________________________________
[hidden email] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "[hidden email]"
Reply | Threaded
Open this post in threaded view
|

Re: anyone running with ngroups increased from 16?

Julian Elischer-5
On 16/4/18 6:37 pm, Julian Elischer wrote:
> Windows users seem to have an almost unlimited number of groups and
> soem places seem to use them a LOT.
> This gives Posix systems problems with deciding how to handle them
> all. Especially when getting
> user credentials from winbindd (samba).
>
> Does anyone know of any work done to either bypass this limit or to
> at least expand it?

I mean with the other applications such NFS usages etc.
I know mountd explodes with > 16..  has anyone done a cleaning pass?

>
> Thanks
>
> Julian
>
> _______________________________________________
> [hidden email] mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-current
> To unsubscribe, send any mail to
> "[hidden email]"
>

_______________________________________________
[hidden email] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "[hidden email]"
Reply | Threaded
Open this post in threaded view
|

Re: anyone running with ngroups increased from 16?

Rick Macklem
Julian Elischer wrote:

>On 16/4/18 6:37 pm, Julian Elischer wrote:
>> Windows users seem to have an almost unlimited number of groups and
>> soem places seem to use them a LOT.
>> This gives Posix systems problems with deciding how to handle them
>> all. Especially when getting
>> user credentials from winbindd (samba).
>>
>> Does anyone know of any work done to either bypass this limit or to
>> at least expand it?
>
>I mean with the other applications such NFS usages etc.
>I know mountd explodes with > 16..  has anyone done a cleaning pass?
16 is the limit "on-the-wire" per RFCs for Sun RPC. You can use
nfsuserd --manage-gids (see "man nfsuserd")
on the NFS server so that the daemon uses the group list for the uid in the RPC instead of the list of groups (limited to 16) in the RPC header. Works fine so
long as the server knows the same group list for a uid as the client(s) do.

And, yes, this applies to NFSv3 as well as NFSv4.

rick
_______________________________________________
[hidden email] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "[hidden email]"
Reply | Threaded
Open this post in threaded view
|

Re: anyone running with ngroups increased from 16?

Toomas Soome


> On 16 Apr 2018, at 15:12, Rick Macklem <[hidden email]> wrote:
>
> Julian Elischer wrote:
>> On 16/4/18 6:37 pm, Julian Elischer wrote:
>>> Windows users seem to have an almost unlimited number of groups and
>>> soem places seem to use them a LOT.
>>> This gives Posix systems problems with deciding how to handle them
>>> all. Especially when getting
>>> user credentials from winbindd (samba).
>>>
>>> Does anyone know of any work done to either bypass this limit or to
>>> at least expand it?
>>
>> I mean with the other applications such NFS usages etc.
>> I know mountd explodes with > 16..  has anyone done a cleaning pass?
> 16 is the limit "on-the-wire" per RFCs for Sun RPC. You can use
> nfsuserd --manage-gids (see "man nfsuserd")
> on the NFS server so that the daemon uses the group list for the uid in the RPC instead of the list of groups (limited to 16) in the RPC header. Works fine so
> long as the server knows the same group list for a uid as the client(s) do.
>
> And, yes, this applies to NFSv3 as well as NFSv4.
>

it is not entirely exact. The number of supplemental groups is the limit of AUTH_SYS (aka AUTH_UNIX) authentication mechanism used by ONC+ RPC. So anything using/supporting this auth mechanism, has this limit too.

Therefore, on paper, there is 2 possible ways to overcome the issue - either use alternate authentication mechanism (such as AUTH_GSS), or implement workaround for AUTH_SYS.

rgds,
toomas
_______________________________________________
[hidden email] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "[hidden email]"
Reply | Threaded
Open this post in threaded view
|

Re: anyone running with ngroups increased from 16?

Brooks Davis-2
In reply to this post by Julian Elischer-5
On Mon, Apr 16, 2018 at 06:37:53PM +0800, Julian Elischer wrote:
> Windows users seem to have an almost unlimited number of groups and
> soem places seem to use them a LOT.
> This gives Posix systems problems with deciding how to handle them
> all. Especially when getting
> user credentials from winbindd (samba).
>
> Does anyone know of any work done to either bypass this limit or to at
> least expand it?

I fixed this in 2009 for everything but NFS AUTH_SYS.  NGROUPS_MAX is
1023.  IIRC the usual hack employed in storage systems is to ignore the
groups provided by AUTH_SYS and get them from winbindd.  I don't know of
a public implementation of that.

-- Brooks

signature.asc (465 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: anyone running with ngroups increased from 16?

Rick Macklem
In reply to this post by Julian Elischer-5
Brooks Davis wrote:

>On Mon, Apr 16, 2018 at 06:37:53PM +0800, Julian Elischer wrote:
>> Windows users seem to have an almost unlimited number of groups and=20
>> soem places seem to use them a LOT.
>> This gives Posix systems problems with deciding how to handle them=20
>> all. Especially when getting
>> user credentials from winbindd (samba).
>>=20
>> Does anyone know of any work done to either bypass this limit or to at=20
>> least expand it?
>
>I fixed this in 2009 for everything but NFS AUTH_SYS.  NGROUPS_MAX is
>1023.  IIRC the usual hack employed in storage systems is to ignore the
>groups provided by AUTH_SYS and get them from winbindd.  I don't know of
>a public implementation of that.
If winbindd gets the information from LDAP, then you can get the same effect
from "nfsuserd -manage-gids" for AUTH_SYS (or as Toomas Soome noted, the gssd
does the same thing for Kerberized mounts).

Both of these utilities use getgrouplist() on the NFS server to acquire the list
of groups for the user. As such, anything configured for the library call, such
as LDAP, will provide the list of groups.

rick
_______________________________________________
[hidden email] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "[hidden email]"