Security Identifier (SID) to User Identifier (uid) ResolutionSystem

[Stephen Langasek]

On Sat, 1 Jan 2000, Leslie M. Barstow III wrote:

> > This is a very bad hack.  It's fine if individual sites choose to use
> > something like this, but it's not the sort of thing that should be
> > *recommended* by the Samba team.  There could be all kinds of information that
> > the existing Unix infrastructure *requires* be stored in the GECOS field,
> > making this a non-option for them (or at least a very painful option).

> > And then, imagine what happens if an admin forgets to lock down 'chfn', or any
> > of a handful of other utilities that let a user change his/her own GECOS
> > entry.  Whoops..

> Actually, I was referring to this in terms of winbind only.  Since winbind
> would have complete control over all of this, the hack isn't quite as bad
> as it seems.  But I agree, it is pretty bad.  I was just suggesting it
> because the requirements of retaining SIDs within the current style
> framework was requested.

Well, winbind, as I've seen it proposed here, is a backend for nsswitch,
which is configurable.  You will almost certainly want other modules besides
winbind being used for lookups, and you will almost certainly want these
other modules to have precedence.  Which means any user with an account on
the local system, with access to chfn, can royally screw over any program
which assumes an SID found in the passwd entry is correct.

-Steve Langasek
postmodern programmer