Unix group cleanup

On departmental Linux systems, many Unix groups have been added locally, to facilitate groups of users jointly editing files. Use the shell command "id" to see which groups you are a member of. To avoid malfunctions, we now need to clean up older groups with gid value below 500. This requires your help.

There are two sources of groups:

• the ones defined by the operating-system distribution in /etc/group
• the ones added centrally via the departmental LDAP server.

Each group is represented by an integer. The problem: the integer ranges used by both sources overlap. There are many instances where an LDAP group uses the same number as an /etc/group entry, but with a completely different name. As a result, you may see the wrong group name displayed with "id" or "ls -l", and some people or processes may have unintended access to other people's files.

The relevant standard (LSB) recommends that group identifiers below 500 are reserved for the operating-system distribution, whereas numbers of 500 and higher are available for local use. Therefore, we aim to ensure now that

• our LDAP servers do not define group numbers below 500
• our file server does not have files belonging to groups with identifiers below 500

This will ensure that Linux machines can use our LDAP servers and filer without risking collisions with groups defined in /etc/group.

If you are still a member of an LDAP-announced Unix group with an integer identifier below 500, you will soon be notified by email. If so, please consider first whether you still need these groups today.

If not, then please

• identify your files on the filer that still belong to this group (see below)
• chgrp all these files to a more appropriate group
• check (after 10 minutes) the file /a/elmer-vol0/quota_report to see if there more
• notify sys-admin that the group can now be deleted

If you still need the group, please contact sys-admin to arrange for your group to be reassigned a number above 500, and that all files on the filer belonging to that group are chgrp-ed accordingly.

Some useful shell commands:

Show all files under the current directory that belong to a group with a number below 500:

find . -name .snapshot -prune -o \( -gid -500 -print0 \) | xargs -0r ls -ld

Change all my files under the current directory with gid=20 to my personal group:

find . -name .snapshot -prune -o \( -user $USER -gid 20 -print0 \) | xargs -0r chgrp $USER

In addition to your $HOME, also check your research-group and project directories.

Some historic generic group numbers that you may encounter in old files:

19=private: until recently, all filer files created from Windows (via CIFS) were in that group
20=users: until a few years ago, this was the primary group of every user

Please chgrp all your files in group 20 to your personal group (CRSId). You can do the same with files in group 19, unless you rely on the file to have a Windows-style access control list (which would be overwritten by the Linux chgrp commands).

(We will soon also need a similar campaign for users with uid below 1000.)