Buchan Milne
2003-Aug-18 11:26 UTC
[Samba] Repost: group membership limitations and Linux kernel
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1> Message: 5 > Date: 15 Aug 2003 08:14:58 -0500 > From: "Azelton Sean (RBNA/CIT1)" <sean.azelton@us.bosch.com> > Subject: [Samba] Repost: group membership limitations and Linux kernel > To: samba@lists.samba.org > Message-ID: <1060953297.1972.1.camel@sbdgecko.sbd.us.bosch.com> > Content-Type: text/plain > > Does anyone have any information with regard to this issue? > > Thank you, > > Sean > > On Wed, 2003-08-13 at 09:17, Azelton Sean (RBNA/CIT1) wrote: > >>> Hi all, >>> >>> I was hoping someone here would be willing to clear up some confusion >>> we're having about group membership limits and linux. >>> >>> While trying to use a file server solution in an AD environment using >>> OpenLDAP / sasl / Samba 2.2.x, we ran into the issue that when trying >>> to import/re-create group membership, we reach a limit at 32 groups. >>> It is my understanding that this is a limitation in the number of >>> groups that a given user can be in because of some hard-coded values >>> in the linux kernel. >>> >>> I'm wondering if we abandon the OpenLDAP idea and went to Samba 3 with >>> direct AD authentication - would we run into this limitation again (on >>> Linux)? If so - does this limitation exist on other platforms >>> (FreeBSD for example) or even on other architectures (Solaris/SPARC)? >>> >>> If someone can point me to more information on this issue I'd greatly >>> appreciate it, as we have the majority of our AD users (10s of >>> thousands) with 150+ groups per user (we have a global AD forest). >>> I'm not sure exactly how this limit would manifest itself using Samba >>> 3 - if at all.$ grep GROUPS /usr/src/linux/include/linux/limits.h #define NGROUPS_MAX 32 /* supplemental group IDs are available */ Looks like you will have to try compiling a new kernel for your linux boxen. This issue will affect both OpenLDAP and Winbind/AD (and any other mechanism for enumerating groups for that matter). Also note that NFS has some limitations on the number of groups that can be used for permissions over NFS, typically 15 (AFAIK). Regards, Buchan - -- |--------------Another happy Mandrake Club member--------------| Buchan Milne Mechanical Engineer, Network Manager Cellphone * Work +27 82 472 2231 * +27 21 8828820x202 Stellenbosch Automotive Engineering http://www.cae.co.za GPG Key http://ranger.dnsalias.com/bgmilne.asc 1024D/60D204A7 2919 E232 5610 A038 87B1 72D6 AC92 BA50 60D2 04A7 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQE/QLfbrJK6UGDSBKcRAraTAKCcXQwEwGZTpUG1GSKmuC2Q65IzZQCfXCqn ReAh2cNd0DQxP9beE1WsAZE=T0KX -----END PGP SIGNATURE----- ****************************************************************** Please click on http://www.cae.co.za/disclaimer.htm to read our e-mail disclaimer or send an e-mail to info@cae.co.za for a copy. ******************************************************************
Azelton Sean (RBNA/CIT1)
2003-Aug-19 14:16 UTC
[Samba] Repost: group membership limitations and Linux kernel
On Mon, 2003-08-18 at 06:26, Buchan Milne wrote:> $ grep GROUPS /usr/src/linux/include/linux/limits.h > #define NGROUPS_MAX 32 /* supplemental group IDs are > available */ > > Looks like you will have to try compiling a new kernel for your linux > boxen.Thanks for your reply. Yes - it seems that would be the direction necessary - although it opens an entire can of worms I'm not prepared to deal with right now. I have been in contact with Tim Hockin @ Sun who has been attempting for some time to get a patch for this issue into the linux kernel. He unfortunately has yet to be successful, and it looks to me like linux-2.6.0-test3 has this same value (32).> This issue will affect both OpenLDAP and Winbind/AD (and any other > mechanism for enumerating groups for that matter).This is what I'm afraid of if I change it.> Also note that NFS has some limitations on the number of groups that > can be used for permissions over NFS, typically 15 (AFAIK).Unfortunately, it seems to me the solution to this problem might be to use Windows 2003 Storage Server, in order to have >32 group support. That is a shame. Sean -- ###################### Sean Azelton, RHCE, MCSE Robert Bosch Corporation (RBNA/CIT1) http://www.boschusa.com ###################### Computer Information Technology Office 401 N. Bendix Drive - South Bend, IN 46628 Phone: 574-237-3837 Fax: 574-237-3105