samba - Sep 2023 - FILE:/tmp/krb5cc_500 naming conventions

On Mon, 11 Sep 2023 08:11:00 +1200
Andrew Bartlett <abartlet at samba.org> wrote:
> On Fri, 2023-09-08 at 07:12 +0100, Rowland Penny via samba wrote:
> > I think you may be missing my point. The OP runs kinit to get a
> > ticket
> > 
> > for Administrator:
> > 
> > 
> > 
> > [
> > user at dc.aaa.bbb
> >  ~]$  kinit administrator
> > 
> > 
> > 
> > Presumably the 'dc' in dc.aaa.bbb' means they are doing
this on a
> > Samba
> > 
> > AD DC
> > 
> > 
> > 
> > The ticket is created here:
> > 
> > 
> > 
> > Ticket cache: FILE:/tmp/krb5cc_500
> > 
> > 
> > 
> > Now, as this a DC, I would not expect to see 500, but a number in
> > the
> > 
> > '3000000' range, unless the OP has given their user a
uidNumber, in
> > 
> > which case, why use '500' ? A number that just happens to be
> > 
> > Administrators RID.
> 
> The 500 is the local unix id of the kinit process, nothing to do with
> AD.   It is named to avoid clashes.  If MIT Kerberos was being built
> today, it would have been a totally random string and would not be in
> /tmp, but that is what was done at the time this software was built.
> 
> Andrew Bartlett
> 
> 
Please do not get upset about this Andrew, but I think you are talking
a lot of rubbish about the '500'. Yes, it probably would be done
differently now, but that isn't what we are talking about, we are
talking about, why would any user on a DC have the Unix ID '500'.

If I (the user rowland) run 'kinit Administrator' on a DC with
'idmap_ldb:use rfc2307 = yes' turned off, I get a kerberos ticket
'/tmp/krb5cc_3000020' (note the Unix ID '3000020'). The only way
that a
user can get the Unix ID '500' on a DC, is if 'idmap_ldb:use rfc2307
yes' is set in smb.conf and the user has the uidNumber attribute set to
500, which as I already said is also the RID for Administrator.

Why would anyone give a normal user the ID '500' ?

Rowland

On Sun, 2023-09-10 at 21:51 +0100, Rowland Penny wrote:
> Yes, it probably would be donedifferently now, but that isn't what we
> are talking about, we aretalking about, why would any user on a DC
> have the Unix ID '500'.
500 was (and is likely on some distributions) the UID assigned in
/etc/passwd to the first local user.
Other systems start at 1000, to give more room for system services. 
This explains it well:https://serverfault.com/a/362946
> If I (the user rowland) run 'kinit Administrator' on a DC
> with'idmap_ldb:use rfc2307 = yes' turned off, I get a kerberos
> ticket'/tmp/krb5cc_3000020' (note the Unix ID '3000020').
The only
> way that auser can get the Unix ID '500' on a DC, is if
> 'idmap_ldb:use rfc2307  =yes' is set in smb.conf and the user has
the
> uidNumber attribute set to500, which as I already said is also the
> RID for Administrator.
> Why would anyone give a normal user the ID '500' ?
The installer does, for the first system user.
Andrew Bartlett

-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/Samba Team Member
(since 2001) https://samba.orgSamba Team Lead               
https://catalyst.net.nz/services/sambaCatalyst.Net Ltd
Proudly developing Samba for Catalyst.Net Ltd - a Catalyst IT group
company
Samba Development and Support: https://catalyst.net.nz/services/samba
Catalyst IT - Expert Open Source Solutions

10.09.2023 23:51, Rowland Penny via samba wrote:
..
> Why would anyone give a normal user the ID '500' ?
how about a trivial

   grep :500: /etc/passwd

?

/mjt