samba - Nov 1999 - Getting around 16 unix group limitation

Has anyone worked out a way around the 1+16 group limit imposed on
Solaris in regards to samba.

Our situation is that users only see the Solaris 2.6 server via Samba -
ie. no user has telnet or general unix access to the server. Is there a
way using Samba to allow users to belong to more than 16 secondary
groups (ie. bypassing the underlying unix group limitation). I am aware
that you can increase the number of groups in Solaris to 32 by kernel
parameters but because we also use NIS and NFS this is not a feasible
solution.

Ideally there should not be a limit to the number of groups a user can
belong to. Currently we are forced to use Solaris ACLs when users reach
the maximum number of groups - unfortunately this is a very messy
solution.

Surely many people have come across this problem. What have been the
workarounds - if any???


--
 Carey Sinclair
 IT Project Engineer
 Tait Electronics Ltd, Christchurch, New Zealand
 Email: carey.sinclair@tait.co.nz   Phone: +64 (03) 3583399

You wrote:
| Our situation is that users only see the Solaris 2.6 server via
Samba -
| i.e.. no user has telnet or general unix access to the server. Is
there a
| way using Samba to allow users to belong to more than 16 secondary
| groups (i.e. bypassing the underlying unix group limitation). I am
aware
| that you can increase the number of groups in Solaris to 32 by
kernel
| parameters but because we also use NIS and NFS this is not a
feasible
| solution.

	Hmmn, if this is an nfs server, you're out of luck...

	If it's just a samba server, and the nis master, you
	can apply the 32-groups hack, and the samba users (only)
	will get the benefit.


	Formally, the groups mechanism isn't sufficient for 
	general access control: Multics needed groups AND
	acls to do the job.  Unix removed the complex stuff,
	including the acls, and extended the groups mechanism
	to add back some of what was lost.

	This means that you're effectively stuck with controlling
	access with acls.  Acls, alas, are ugly and hard to understand.
	Even Multics acls were immensely confusing to me...

	Perhaps we might think about providing a better interface
	for the command line: I can make sense of the acls when
	I look at them via File manager File->Properties->
	Show Access List->Add so there's no reason why it shouldn't be 
	as easy to do as a command.  or, since this is the Samba
	list, via a web page reachable from SWAT (;-))

--dave
-- 
David Collier-Brown,  | Always do right. This will gratify some people
185 Ellerslie Ave.,   | and astonish the rest.        -- Mark Twain
Willowdale, Ontario   | http://java.science.yorku.ca/~davecb
Work: (905) 415-2849 Home: (416) 223-8968 Email: davecb@canada.sun.com