Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

server.Users and related does not respect nsswitch.conf #1008

Open
bauen1 opened this issue Aug 28, 2023 · 1 comment · May be fixed by #1221
Open

server.Users and related does not respect nsswitch.conf #1008

bauen1 opened this issue Aug 28, 2023 · 1 comment · May be fixed by #1221
Labels
bug Label for all kind of bugs.

Comments

@bauen1
Copy link
Contributor

bauen1 commented Aug 28, 2023

Describe the bug

Using the server.Users fact (and related, such as server.Groups) does not respect the configuration of /etc/nsswitch.conf, e.g. when LDAP is configured.

To Reproduce

Configure e.g. LDAP/sssd in /etc/nsswitch.conf or libnss_systemd for the passwd database and attempt to query a user from that source using the server.Users fact.
Since the server.Users and server.Groups fact only looks at /etc/passwd and /etc/groups instead of using e.g. libnss these user entries are not returned.

If necessary, I can provide a more detailed example, but I believe the main point comes across.

Expected behavior

Enumerate and return users/groups according to the /etc/nsswitch.conf configuration.

Meta

--> Support information:

    If you are having issues with pyinfra or wish to make feature requests, please
    check out the GitHub issues at https://github.com/Fizzadar/pyinfra/issues .
    When adding an issue, be sure to include the following:

    System: Linux
      Platform: Linux-6.1.0-9-amd64-x86_64-with-glibc2.37
      Release: 6.1.0-9-amd64
      Machine: x86_64
    pyinfra: v2.7
    Executable: /opt/venv/bin/pyinfra
    Python: 3.11.4 (CPython, GCC 12.2.0)

Suggested Solution

Use getent to query the passwd and groups database, but fall back to /etc/passwd and /etc/group in the unlikely case that getent is not provided, e.g. on a busybox system.

Some additional ideas:

If getent is used, it could also be helpful to allow the user to provide the --service argument to getent.

Perhaps the server.User fact could be extended to not just return the name of the current user, but to also include the same information as server.Users provides and to allow specifying a different user to return information about.
And add a new fact server.Group that does the same.

The Name Service Switch has a few other database that might be interesting to implement, e.g. aliases, ethers, hosts, initgroups, networks, protocols, rpc, services and some special cases sudoers, subid.

If such a change would be welcome, I could look into implementing these suggestions.

Thanks for this awesome tool ❤️

@bauen1 bauen1 added the bug Label for all kind of bugs. label Aug 28, 2023
@Fizzadar
Copy link
Member

This would definitely be a welcome change @bauen1! An area of Linux I am not too familiar with have never used getent or LDAP before. PRs very welcome :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Label for all kind of bugs.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants