1

My version of usermod does not seem to support LDAP, so when I run

usermod -g <group> <username>

I get an error that the user name does not exist. Is there a different way to switch my primary group?

2 Answers 2

1

Unless you've got the proper tooling set up, you won't be able to change a user's primary GID from an LDAP client. You will need to make the change on the LDAP server itself by modifying the gid attribute (or whatever attribute your schema uses to store primary GIDs) on the user object.

-1

Yes, you have to change attribute gidNumber in the user's LDAP entry like user jayhendren said.

But I hope there is decent access control on the LDAP server so users cannot change their primary GID themselves.

Otherwise users could add themselves to any group gaining permissions on the Linux systems, effectively circumventing security controls.

My recommendation is to either...

  • assign a single GID to all users and advice everybody to never assign any rights/permissions to it or...
  • set user-only GIDs not used anywhere else
2
  • I believe that the question is really asking ‘‘How can the administrator switch the primary group of a user?’’  Can you answer that? Jul 20, 2018 at 23:54
  • Basically I wanted to augment the other posters's answer with a word of caution. Jul 21, 2018 at 11:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .