2

I've done a fair amount of research but either I'm having trouble formulating the context to create relevant results or the information is hard to find.

I have a production ubuntu 16.04 server attached to a domain with SSSD. When a cronjob runs in a user's crontab it creates the output file with the the correct username but with the incorrect group. The output is created with group owner "Domain Group" instead of the folder's gid set with chgrp chgrp "correct domain group" /foldername. Files that are manually created and automatically created by manually invoking the script /bin/bash /path/to/script.sh create the file output with the correct user and group owners.

The desired outcome is to have the file created with the correct group owner without having to sort of hack together chmod after the output is created.

  • Can you run id --groups both from an interactive bash and from cron and see if there are any differences in its output? – Mark Plotnick Aug 31 '18 at 15:37
  • When I run id -g the result is the "Domain Users" group instead of the desired group. I also re-ran the test bash script but deposited the test file in the work product directory and it created it with "Domain Users" despite the group owner of the directory being different. I think it might be creating files based off the primary AD group membership. Edit: I should probably note that when I touch test.file from this user it does create it with the correct group owner. – apln Aug 31 '18 at 15:56
1

I got it figured out. While reviewing the SSSD documentation (https://linux.die.net/man/5/sssd.conf) I found override_gid and added it to /etc/sssd/sssd.conf under the domain config settings.

Here is a bit of the process:

su - user

id --groups

Get the desired gid

sudo vi /etc/sssd/sssd.conf

Add the correct gid under [domain]

override_gid = [desired gid]

Log out and log back in, run id -g and the result should be the desired gid. You must reboot for the changes to take place across the system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.