You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Using the server.Users fact (and related, such as server.Groups) does not respect the configuration of /etc/nsswitch.conf, e.g. when LDAP is configured.
To Reproduce
Configure e.g. LDAP/sssd in /etc/nsswitch.conf or libnss_systemd for the passwd database and attempt to query a user from that source using the server.Users fact.
Since the server.Users and server.Groups fact only looks at /etc/passwd and /etc/groups instead of using e.g. libnss these user entries are not returned.
If necessary, I can provide a more detailed example, but I believe the main point comes across.
Expected behavior
Enumerate and return users/groups according to the /etc/nsswitch.conf configuration.
Meta
--> Support information:
If you are having issues with pyinfra or wish to make feature requests, please
check out the GitHub issues at https://github.com/Fizzadar/pyinfra/issues .
When adding an issue, be sure to include the following:
System: Linux
Platform: Linux-6.1.0-9-amd64-x86_64-with-glibc2.37
Release: 6.1.0-9-amd64
Machine: x86_64
pyinfra: v2.7
Executable: /opt/venv/bin/pyinfra
Python: 3.11.4 (CPython, GCC 12.2.0)
Suggested Solution
Use getent to query the passwd and groups database, but fall back to /etc/passwd and /etc/group in the unlikely case that getent is not provided, e.g. on a busybox system.
Some additional ideas:
If getent is used, it could also be helpful to allow the user to provide the --service argument to getent.
Perhaps the server.User fact could be extended to not just return the name of the current user, but to also include the same information as server.Users provides and to allow specifying a different user to return information about.
And add a new fact server.Group that does the same.
The Name Service Switch has a few other database that might be interesting to implement, e.g. aliases, ethers, hosts, initgroups, networks, protocols, rpc, services and some special cases sudoers, subid.
If such a change would be welcome, I could look into implementing these suggestions.
Thanks for this awesome tool ❤️
The text was updated successfully, but these errors were encountered:
This would definitely be a welcome change @bauen1! An area of Linux I am not too familiar with have never used getent or LDAP before. PRs very welcome :)
Describe the bug
Using the
server.Users
fact (and related, such asserver.Groups
) does not respect the configuration of/etc/nsswitch.conf
, e.g. when LDAP is configured.To Reproduce
Configure e.g. LDAP/sssd in
/etc/nsswitch.conf
orlibnss_systemd
for thepasswd
database and attempt to query a user from that source using theserver.Users
fact.Since the
server.Users
andserver.Groups
fact only looks at/etc/passwd
and/etc/groups
instead of using e.g. libnss these user entries are not returned.If necessary, I can provide a more detailed example, but I believe the main point comes across.
Expected behavior
Enumerate and return users/groups according to the
/etc/nsswitch.conf
configuration.Meta
Suggested Solution
Use
getent
to query thepasswd
andgroups
database, but fall back to/etc/passwd
and/etc/group
in the unlikely case thatgetent
is not provided, e.g. on a busybox system.Some additional ideas:
If
getent
is used, it could also be helpful to allow the user to provide the--service
argument togetent
.Perhaps the
server.User
fact could be extended to not just return the name of the current user, but to also include the same information asserver.Users
provides and to allow specifying a different user to return information about.And add a new fact
server.Group
that does the same.The Name Service Switch has a few other database that might be interesting to implement, e.g.
aliases
,ethers
,hosts
,initgroups
,networks
,protocols
,rpc
,services
and some special casessudoers
,subid
.If such a change would be welcome, I could look into implementing these suggestions.
Thanks for this awesome tool ❤️
The text was updated successfully, but these errors were encountered: