On Thu, Jan 13, 2005 at 10:19:51PM -0700, Robert LeBlanc wrote: > Unless your users are Admins which I doubt since they can not debug, > they will not have sufficient permission to execute the add group > command. Using a start-up script runs the script with system privileges. > Now with Active Directory which we use, we can set-up OUs to have > policies that such and such a person can have rights to a computer > depending on where it is placed in the directory tree because it is > configured using group policy. As far as the group remaining after > reboots, yes it would unless you create a policy that creates exclusive > groups which would wipe them out every policy refresh, but they would be > re added after a reboot. If someone accidentally removed the group it > would also be restored. You can easily add new computers to the OU > without having to remember to set-up the group, etc. >
Alright, that makes a lot more sense, I wasn't aware you were using Active Directory, thanks. > > Yes, I try to take the approach of deny all and then allow who need it, > no telling what accounts are set-up with very unsecure passwords who > won't need it. Since you are not using groups (Samba issue? Or company > decision?) I don't think you have much of a choice. I do believe that > members of the debuggers group have certain admin rights. > The reason we can't do what you do is that Samba can't emulate Active Directory (the dirty hack[1] that it is). Because of this, doing this sort of thing is done very differently. From what I can tell (from you and other things I've read) while Samba does most of the features of a PDC, the administration is completely different. Our not using groups is a Samba issue (not that Samba can't do them, but our setup prevents us), and if we could, we would still have to map the group to debugger users at least once on the machine. (It's actually a bit more fun, in Samba group mapping goes like this: unix group -> domain group -> local group) I had a discussion a while ago about the fact that you have to add users to the debugger group in windows, while linux is setup in such a fashion that such things are unneccesary (without security problems due to it either). Really makes you wonder about the under-lying design of windows. Thanks for answering my questions though, always find it interesting to see how other departments have their systems set up. [1] This is in reference to something John Tresptra said at a meeting last year, when discussing why emulating Active Directory is so hard. It more less is the fact Microsoft took a couple open standards (LDAP, Kerberos, etc), and added to them, breaking compatability, and forcing anyone wanting to emulate or interface to reverse engineer. I consider what Microsoft did a dirty hack because of this -- Scott Paul Robertson http://spr.mahonri5.net GnuPG FingerPrint: 09ab 64b5 edc0 903e 93ce edb9 3bcc f8fb dc5d 7601
pgpQLmfy99CYr.pgp
Description: PGP signature
-------------------- BYU Unix Users Group http://uug.byu.edu/ The opinions expressed in this message are the responsibility of their author. They are not endorsed by BYU, the BYU CS Department or BYU-UUG. ___________________________________________________________________ List Info: http://uug.byu.edu/cgi-bin/mailman/listinfo/uug-list
