make uid_min and gid_min of login.defs configurable #62
Conversation
| @@ -109,14 +109,14 @@ PASS_MIN_DAYS <%= @password_min_age.to_s %> | |||
| PASS_WARN_AGE 7 | |||
|
|
|||
| # Min/max values for automatic uid selection in useradd | |||
| UID_MIN 1000 | |||
| UID_MIN <%= @uid_min.to_s %> | |||
| UID_MAX 60000 | |||
There was a problem hiding this comment.
if we start to make min configurable, why not max?
There was a problem hiding this comment.
Lazyness as a virtue - I just did not need that for my usecase ;-)
The lower limit of 1000 is much more often a problem, for instance if you create your admins at uid 2300+ with fixed uids. The next automatic install might add a user with uid 2305, and when you add the next admin user, it will conflict on that system. I can't envision a similar thing happening because of wrong max settings.
But feel free to add them, if you do ;-)
|
@bkw great work. |
| @@ -29,7 +29,7 @@ | |||
| supports 'redhat', '>= 6.4' | |||
| supports 'oracle', '>= 6.4' | |||
|
|
|||
| depends 'sysctl', '>= 0.3.0' | |||
| depends 'sysctl', '>= 0.6.0' | |||
There was a problem hiding this comment.
@bkw: any reason, why we require a bump here? i am not sure if this breaks existing usage
There was a problem hiding this comment.
It was because of /your/ commit: 0310465
:-)
There was a problem hiding this comment.
I just double checked. I missed
https://github.com/TelekomLabs/chef-os-hardening/blob/master/recipes/sysctl.rb#L24
We support version greater 0.3.0, but will drop support lt 0.6.0 in our next major release
There was a problem hiding this comment.
Ok, should I remove the bump commit from this pr then?
|
force-pushed a new version without the sysctl-0.6.0 dependency bump. |
|
thanks @bkw |
make uid_min and gid_min of login.defs configurable
fixes dev-sec#62 Signed-off-by: Dominik Richter <[email protected]>
This PR lets UID_MIN and GID_MIN in login.defs come from attributes/default.rb, defaulting to same values as before. In order to achieve that, I fixed some minor issues along the way:
Tell me if you want me to split these into smaller PRs.