Using the plugin with root user about libnss-ato

[vmspike]

See libnss_ato.c:

/* for security reasons */
#define MIN_UID_NUMBER   500
#define MIN_GID_NUMBER   500

So if you want to use it with root, you have to decrease that values to 0, or remove the check for MIN_*_NUMBER's as I understand.

[vmspike]

This issue is already referred in #11.
For APT it can be better to create file /etc/apt/apt.conf.d/00libnss-ato with the content like

DPkg::Pre-Invoke  {"/bin/ln -sf /etc/nsswitch.conf.noato /etc/nsswitch.conf";};
DPkg::Post-Invoke {"/bin/ln -sf /etc/nsswitch.conf.ato   /etc/nsswitch.conf";};

and separate files /etc/nsswitch.conf.noato and /etc/nsswitch.conf.ato, to temporary disable libnss-ato for packages installation.
If it's a way to limit libnss-ato for use with ssh only would like to know it too.

[mikomarrache]

I tried that but I got side effects. At least the mysql user disappeared for some reason. It looks like the plugin is used for more than just SSH/login.

[donapieppo]

I tried to comment in libnss_ato.c the lines that check MIN and MAX uid numbers

        /*
        if ( conf->pw_uid < MIN_UID_NUMBER )
                conf->pw_uid = MIN_UID_NUMBER;

        if ( conf->pw_gid < MIN_GID_NUMBER )
                conf->pw_gid = MIN_GID_NUMBER;
        */

and the command id works:

# id pippo
uid=0(root) gid=0(root) groups=0(root)

Can you describe what doesn't work for you so I can replicate your system?

[mikomarrache]

Yes I also tried and it works but then the plugin becomes problematic since other applications that depend on NSS would get the wrong user. Just as an example, installing mysql after the plugin is configured is problematic since the mysql user (27) will not be created. One of the forks added some checks so that the plugin is used only for SSH. Le jeu. 27 sept. 2018 à 15:01, Donapieppo <[email protected]> a écrit :

…

I tried to comment in libnss_ato.c the lines that checks MIN and MAX uid number /* if ( conf->pw_uid < MIN_UID_NUMBER ) conf->pw_uid = MIN_UID_NUMBER; if ( conf->pw_gid < MIN_GID_NUMBER ) conf->pw_gid = MIN_GID_NUMBER; */ and the command id works: # id pippo uid=0(root) gid=0(root) groups=0(root) Can you describe what doesn't work for you so I can replicate your system? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#14 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AIF1I_vj6DFxfQriJmo1s7Mpy9v6i7L4ks5ufL4sgaJpZM4WsQ09> .

[donapieppo]

I think that every system operation like, for example, creating new users (I think that mysql package checks the existence of mysql user and, as MIN_UID_NUMBER = 0, it finds it and does not create it)
has that problem.

I suggest that you create a file like /etc/nsswitch.conf.ato (with passwd: files ato)
and /etc/nsswitch.conf.noato (with passwd: files)

Then to install packages:

cp /etc/nsswitch.conf.noato /etc/nsswitch.conf
apt-get install  mysql-server
cp /etc/nsswitch.conf.ato /etc/nsswitch.conf

[donapieppo]

Cool solution (Pre- Post - Invoke) for apt!!!