search for: ngroups_max

Currently samba (2.0.6) relies on the NGROUPS_MAX define. This makes the number of allowed simultaneous (per-user) secondary groups a compile-time decision. $ find . -name \*.c | xargs grep NGROUPS ./source/lib/system.c: if (setlen > NGROUPS_MAX) { ./source/lib/replace.c: gid_t grouplst[NGROUPS_MAX]; ./source/lib/replace.c: while (i <...

Currently openssh (3.4p1) relies on the NGROUPS_MAX define. This makes the number of allowed simultaneous (per-user) secondary groups a compile-time decision. $ find . -name \*.c | xargs grep NGROUPS_MAX ./groupaccess.c:static char *groups_byname[NGROUPS_MAX + 1]; /* +1 for base/primary group */ ./groupaccess.c: gid_t groups_bygid[NGROUPS...

http://bugzilla.mindrot.org/show_bug.cgi?id=787 Summary: Minor security problem due to use of deprecated NGROUPS_MAX in uidswap.c (sshd) Product: Portable OpenSSH Version: 3.7.1p2 Platform: All OS/Version: All Status: NEW Severity: normal Priority: P2 Component: sshd AssignedTo: openssh-bugs at mindrot.org ReportedBy:...

Linux has just raised the NGROUPS_MAX limit from 32 to 64k. In doing an audit of various tools, openssh turned up as having incorrect groups handling. Almost no user-space apps really care about NGROUPS_MAX. A proposed patch (untested, since the CVS build won't compile on my RH box.. :-/) : What think? Index: uidswap.c ======...

...extstep.h Sun Feb 4 00:19:09 2001 > *************** > *** 48,52 **** > --- 48,56 ---- > speed_t cfgetispeed(const struct termios *t); > int cfsetospeed(struct termios *t, int speed); > int cfsetispeed(struct termios *t, int speed); > + > + /* LIMITS */ > + #define NGROUPS_MAX 16 > + Hey, Steve.. since you put together the group access patch to OpenBSD. Do you recomend a better place or a better value for NGROUPS_MAX? It's not defined within the NeXTStep headers. Otherwise I'd perfer to put it in defines.h as a fall back incase NGROUPS_MAX is not foun...

...tem/passwd.h --- /root/work/samba-3.2.8/source/lib/replace/system/passwd.h 2009-02-03 17:10:07.000000000 +0100 +++ /usr/ports/net/samba32/work/samba-3.2.8/source/lib/replace/system/passwd.h 2009-03-15 12:12:52.000000000 +0100 @@ -76,6 +76,7 @@ #endif #endif +#include <sys/param.h> #ifndef NGROUPS_MAX #define NGROUPS_MAX 32 /* Guess... */ #endif diff -ruN /root/work/samba-3.2.8/source/lib/system_smbd.c /usr/ports/net/samba32/work/samba-3.2.8/source/lib/system_smbd.c --- /root/work/samba-3.2.8/source/lib/system_smbd.c 2009-02-03 17:10:07.000000000 +0100 +++ /usr/ports/net/samba32/work/samba-3.2...

# cat /proc/sys/kernel/ngroups_max 65536 # sysctl kernel.ngroups_max kernel.ngroups_max = 65536 Is there a way to change/look at AUTH_SYS? Seems I have 28 groups now as my user I tried created a test user with much less groups but it turns out it is on all those other groups. As such I tried winbind nested groups=no but this does...

What is NGROUPS_MAX : - is the nuber of groups than a user can have (32 groups per user) - or is the max number of groups on the system (32 groups) Bertil Starck a ?crit : >Hi! > >Anyone experienced the limitation of "NGROUPS_MAX 32" in the kernel when >running Samba/Winbind or solved the &qu...

http://bugzilla.mindrot.org/show_bug.cgi?id=787 ------- Additional Comments From openssh_bugzilla at hockin.org 2004-02-20 13:01 ------- Created an attachment (id=548) --> (http://bugzilla.mindrot.org/attachment.cgi?id=548&action=view) NGROUPS patch ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee.

..._WITH_SETEUID +/* Saved effective uid. */ +static uid_t saved_euid = 0; +static gid_t saved_egid = 0; +#endif + /* Saved effective uid. */ static int privileged = 0; static int temporarily_use_uid_effective = 0; -static uid_t saved_euid = 0; -static gid_t saved_egid; static gid_t saved_egroups[NGROUPS_MAX], user_groups[NGROUPS_MAX]; static int saved_egroupslen = -1, user_groupslen = -1; - + /* * Temporarily changes to the given uid. If the effective user * id is not root, this does nothing. This call cannot be nested. @@ -44,42 +48,57 @@ void temporarily_use_uid(struct passwd *pw) { - /*...

...tt > > > ------------------------------ > *From:* Jeff Sadowski <jeff.sadowski at gmail.com> > *Sent:* Wednesday, December 9, 2015 10:08 AM > > *To:* Mattias Zhabinskiy; samba > *Subject:* Re: [Samba] Adding an AD group to /etc/sudoers? > > # cat /proc/sys/kernel/ngroups_max > 65536 > # sysctl kernel.ngroups_max > kernel.ngroups_max = 65536 > > Is there a way to change/look at AUTH_SYS? > Seems I have 28 groups now as my user > I tried created a test user with much less groups > but it turns out it is on all those other groups. > As such I tr...

Hi, I'm trying to create a new Samba server to share files. We currently have an instance of Samba 3.6 on another server which we are using but need to retire that server. I recently set up a new AD domain on Samba 4.3.11 on Ubuntu 16.04. There are two domain controllers. Most of the PCs are joined to this AD domain. Our user accounts and group memberships are maintained in an LDAP

...g on with the users groups membership. Regards, Matt ________________________________ From: Jeff Sadowski <jeff.sadowski at gmail.com> Sent: Wednesday, December 9, 2015 10:08 AM To: Mattias Zhabinskiy; samba Subject: Re: [Samba] Adding an AD group to /etc/sudoers? # cat /proc/sys/kernel/ngroups_max 65536 # sysctl kernel.ngroups_max kernel.ngroups_max = 65536 Is there a way to change/look at AUTH_SYS? Seems I have 28 groups now as my user I tried created a test user with much less groups but it turns out it is on all those other groups. As such I tried winbind nested groups=no but this does...

...Windows. > > > > Anyways, when I connect it seems work when I authenticate but then > > it bails on sys_setgroups. > > > > Not sure what to look for now. What information should I provide > > for help? > Samba may panic when user is a member of more then NGROUPS_MAX Active > Directory groups. > > set ngroups_max to at least the maximum number of groups a Active > Directory user belongs to. > > As an example, the following line in /etc/system will set ngroups_max > to 128: > > set ngroups_max = 128 > > (a reboot is required...

...n Unix. We don't assign permissions using Windows. > > Anyways, when I connect it seems work when I authenticate but then it bails on sys_setgroups. > > Not sure what to look for now. What information should I provide for help? Samba may panic when user is a member of more then NGROUPS_MAX Active Directory groups. set ngroups_max to at least the maximum number of groups a Active Directory user belongs to. As an example, the following line in /etc/system will set ngroups_max to 128: set ngroups_max = 128 (a reboot is required after changing /etc/system). > > # > # sm...

...12:23:30, 0] auth/auth_util.c:get_user_groups(695) get_user_groups: failed to get the unix group list [2004/05/04 12:23:30, 0] auth/auth_sam.c:check_sam_security(260) check_sam_security: make_server_info_sam() failed with 'NT_STATUS_NO_SUCH_USER' I tried increasing the kernel parameter ngroups_max from 16 to 32. I was able to map drives, but this breaks NFS. Any idea what has changed from 3.0.2a to 3.0.3? Is it a know bug? Michael -- Michael Keightley <Michael.Keightley@quadstone.com> Tel: +44 131 240 3137 Systems Manager, Quadstone Limited, Fax: +44 131 2...

# id username|sed "s/,/\n/g"|wc -l 155 # id|sed "s/,/\n/g"|wc -l 28 On Tue, Dec 8, 2015 at 2:56 PM, Jeff Sadowski <jeff.sadowski at gmail.com> wrote: > wbinfo -r username > shows the gid of it > and a bunch of -1's id guess for groups without gid's > my user belongs to 155 groups is there a problem with that many groups? > > On Tue, Dec 8,

...share which have read permissions for "group1". If user account is modified and "group1" becomes users primary group, then he can access shares. If user is member of only 16 groups, then permissions work as expected regardless of users primary group. Operating systems "ngroups_max" is set to 1024. I tested with local user and was able to add user to 1024 local groups. -- MMM

...indows. > > > > Anyways, when I connect it seems work when I authenticate but then > > it bails on sys_setgroups. > > > > Not sure what to look for now. What information should I provide > > for help? > Samba may panic when user is a member of more then NGROUPS_MAX Active > Directory groups. > > set ngroups_max to at least the maximum number of groups a Active > Directory user belongs to. > > As an example, the following line in /etc/system will set ngroups_max > to 128: > > set ngroups_max = 128 > > (a reboot is re...

Just a heads-up, because this bug took me absolutely ages to chase down, and I want to save others the same pain. Samba is perhaps the most prominent reason why you might find a user in more than 16 groups on a Unix system, and so this bug may at first appear to be a 'Samba issue' (that certainly is why it found it's way to my attention :-) https://www.illumos.org/issues/3691 In