Re: groups wrong on NIS clients

On Wed, Apr 23, 2003 at 05:19:15PM -0500, Glenn Johnson wrote:
> > How are you logging in?
> 
> I was using ssh.  After reading your message, I went down the hall and
> logged in via the console.  The groups are set correctly when logging in
> via the console.

> > Whatever login process you are using is responsible for setting your
> > group list correctly.  It has not done so.
> 
> As a note, the groups were set correctly via ssh before I updated to the
> latest sources today.  My previous -current was from April 15, 2003.

Do you have UsePrivilegeSeperation turned on?  (Not that this should
make a difference ... `works here'.)  Do you have anything different
from the default configuration?

The only thing I can think of that might give you different results
when logging in via the console versus via sshd is if the latter
cannot contact the NIS server for some reason.  Do you see (e.g. with
tcpdump) any NIS queries when you attempt to login via ssh?

If you want to dig deeper, you should arrange for sshd to spit out the
group list.  Something like the following.

*** session.c	26 Feb 2003 15:59:04 -0000	1.6
--- session.c	24 Apr 2003 02:07:34 -0000
***************
*** 1267,1272 ****
--- 1267,1283 ----
  # ifdef __bsdi__
  		setpgid(0, 0);
  # endif
+ 		{
+ 		struct group *gr;
+ 		int groups[NGROUPS], ngroups, i;
+ 		ngroups = NGROUPS;
+ 		getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups);
+ 		for (i = 0; i < ngroups; i++) {
+ 			gr = getgrgid(groups[i]);
+ 			debug("XXX group[%d]=%d,%s", i, groups[i],
+ 			    gr == NULL ?  "<not found>" : gr->gr_name);
+ 		}
+ 		}
  		if (setusercontext(lc, pw, pw->pw_uid,
  		    (LOGIN_SETALL & ~LOGIN_SETPATH)) < 0) {
  			perror("unable to set user context");


Cheers,
-- 
Jacques A. Vidrine <nectar_at_celabo.org>          http://www.celabo.org/
NTT/Verio SME          .     FreeBSD UNIX     .       Heimdal Kerberos
jvidrine_at_verio.net     .  nectar_at_FreeBSD.org  .          nectar_at_kth.se