Re: libpam-sshauth and libnss-sshsock

>
> I think Gadi's idea was to start using the nss_sshsock library right away,
> to simplify some of the localapps code.  We'll need to test this fairly
> thoughoghly to make sure there aren't any race conditions in the nss code.
>

Localapps and fat clients are definitely the target for this type of
module for LTSP. There is one "feature" of our current mangling code
that we would have to find a better way of doing with this new nss
module. That is, namely, system group memberships.

Ubuntu uses system group memberships to govern lots of permissions.
When we wrote our mangling code, we asked such questions as, "What if
the xyz system group in the chroot has a different gid than the xyz
system group on the server?" A very possible problem, as many packages
simply create a system group with the "next available gid" at the time
of install.  So, we basically loop through all the group names and add
the *server users* who are members of *server system groups* to the
*client system groups* with the same *names*. Ugly, yes, but
desirable.

Now, I figure there are a few options available to us to address this.
Either we could:

1. Introduce similar code (maybe activated by a flag of some sort) to
do the same thing in our nss module. That is, the nss module could
mange the gid's of the *server system group* to match those of the
*client system group* and return those groups with the *server system
group membership*.

2. We could use a different pam module, like pam_group that
automatically adds users as members to system groups, and simply
modify that module's configuration (even via lts.conf).

Thoughts?

-Gadi

------------------------------------------------------------------------------
RSA(R) Conference 2012
Save $700 by Nov 18
Register now
http://p.sf.net/sfu/rsa-sfdev2dev1
_____________________________________________________________________
Ltsp-developer mailing list.   To un-subscribe, or change prefs, goto:
      https://lists.sourceforge.net/lists/listinfo/ltsp-developer
For additional LTSP help,   try #ltsp channel on irc.freenode.net