Posts in category privileges

Removed silly limitations on system groups with LDAP backend enabled

Responding to changeset 279 and explaining the reasons of changeset 304, there is now no more limitations when creating system groups.

If the LDAP backend is enabled, the newly created system group will go into the LDAP backend.

This makes NFS works perfectly on LDAP-enabled clients, which now see all groups when listings ACLs and standard posix perms.

Now, the licorn-ldap-server debian package tries to move every important pre-existing system group (acl, licorn-wmi) from the Unix backend to the LDAP one. This will implicitly install them network-wide and avoid the need to create them on every ALT®. Finally this will help propagate admin privileges on every client.

New set of commands for privileges

If you know about privileges, you know you can manipulate them only via the configuration object, like this: 

get config privs
sudo add group licorn-wmi --system
sudo mod config --add-privileges licorn-wmi
sudo add group remote-ssh --system
sudo mod config --add-privileges remotessh
sudo mod config --del-privileges licorn-wmi,remotessh
get config privileges

Now you can handle them kind of "directly", like this: 

get privs
sudo add group licorn-wmi --system
sudo add priv licorn-wmi
sudo add group remote-ssh --system
sudo add priv remotessh
sudo del privs licorn-wmi,remotessh
get privileges

Which is quite simpler, and - I think - more logical or consistent with the rest of the command set. The code lies in changeset 310.