Question 222038 in Ubuntu Question posted in
The official Ubuntu documentation can be found here.

Rename local user group on Debian/Ubuntu with Puppet

Via Samba with idmap_rid, users and groups from LDAP are available on the Ubuntu systems. However, a collision occurs for the user group name staff with Debian/Ubuntu’s own local user group staff (GID: 50).

Therefore I would like to rename the local user group staff to debian-staff.

I tried to implement this via Puppet, which unfortunately did not work. Puppet seems to always try a groupadd instead of groupmod, although the local GID 50 already exists.

group { 'debian-staff':
    ensure => present,
    gid => 50,
    forcelocal => true,
}

Error: Could not create group debian-staff: Execution of ‘/usr/sbin/groupadd -g 50 debian-staff’ returned 4: groupadd: GID ’50’ already exists

How can I rename a local user group with Puppet?

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    The most useful way I have found to rename groups via Puppet is:

    exec { 'rename local group staff to debian-staff':
    command => 'groupmod --new-name debian-staff staff',
    path    => '/usr/sbin:/usr/bin:/sbin:/bin',
    onlyif  => "grep /etc/group -e '^staff:x:50:'",
}

    The groupmod command is used to rename, but only if the staff group with ID 50 is found in /etc/group.

    The group resource type can only identify groups by name, not by number, and does not provide for renaming.


  2. 0

    How can I rename a local user group with Puppet?

    You cannot do that with the built in Group resource type, because the group name is the namevar of that type. That is, its unique identifier. A Group with a different name is necessarily a different group.

    In principle, you could remove the Group and then add a different one, but that might still present an issue both initially (if the system attempts to manage the LDAP group instead of the local one) and afterward (because even if the LDAP group was not selected for modification before, it stands a good chance of being selected on subsequent runs, after the conflict is resolved). Additionally, that might lose information you care about, such as users who have the local staff group as a secondary group.

    One quick and dirty way to genuinely change a group name would be something like this:

      exec { 'rename local "staff" group':
    command => [
      '/bin/bash',
      '-c',
      'for f in /etc/{shadow,gshadow}; do /bin/sed --in-place s/^staff:/debian-staff:/ "$f"; done'
      ],
    onlyif  => 'grep -q ^staff: /etc/group'
  }
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search