Skip to Content.
Sympa Menu

grouper-users - Re: [grouper-users] Modeling NIS netgroup?

Subject: Grouper Users - Open Discussion List

List archive

Re: [grouper-users] Modeling NIS netgroup?

Chronological Thread 
  • From: Tom Barton <>
  • To:
  • Subject: Re: [grouper-users] Modeling NIS netgroup?
  • Date: Wed, 28 Dec 2016 11:21:22 -0600
  • Ironport-phdr: 9a23:0Qqs2BO+4QEXU5xRBjUl6mtUPXoX/o7sNwtQ0KIMzox0Lf/8rarrMEGX3/hxlliBBdydsKMYzbKM+Pm4ASQp2tWoiDg6aptCVhsI2409vjcLJ4q7M3D9N+PgdCcgHc5PBxdP9nC/NlVJSo6lPwWB6nK94iQPFRrhKAF7Ovr6GpLIj8Swyuu+54Dfbx9GiTe5br5+Ngm6oRveusULnYduNrs6xwfUrHdPZ+lY335jK0iJnxb76Mew/Zpj/DpVtvk86cNOUrj0crohQ7BAAzsoL2465MvwtRneVgSP/WcTUn8XkhVTHQfI6gzxU4rrvSv7sup93zSaPdHzQLspVzmu87tnRRn1gyoBKjU38nzYitZogaxGvhyhqRxxzY3abo6bO/VxfL/ScMgVRWZdRMlcSzBND428YoYJEuEPPfxYr474p1YWsxW+AgysD/7yxzBSnH/2wao60+I8GgzBwAwvBMgBsG7IrNXyMqcfSv21w7XIzTXCc/xZwzj96I/Sfh8/vP6MQKt9fMzMwkcsDwPIlkicpZLmMj+Py+gAvWiW4/B9We+ui2MrsQN8rzepy8wxkIfGnJgVxUrB9ShhwIY6O9m4SEljbNG+DZtQqyGaN5BzQsM+W2FkpCg3xqcbuZGnfCgKyYgoyATQa/yAaYSH/A/sVPuJLTd5gnJqZq6/ig6v/US+yeDwTNS43VhKoyZfj9XBt3AA2wbR58WIUvd9+12u2TeL1wDd8OFEJkU0mLLHK5E62LEwjIYTsUPFHiLthUX5kK+WdkQ49eey5OTnZa/qqYGBOI9pkg3+KLghmtSjAeQkNQgDR2eb+f671L3+5U32Xq9KguQrkqnCrp/aP98bq7W9Aw9UyYYj9w2/Aym83NQZm3kHMExKeAiBj4f3J1HCPur0AumijFSxw39XwKXJJLr8GpjXa2XYna36Vbd790NGzgcvl5ZS648HJKsGJafPXUq5ntXCEhg/e1ioye/9FNJ7/p4VWWOEC6Cedq7erAnbtaoUP+CQadpN637GIP8/6qu2gA==

Hi Tom P,

Our design at UChicago for managing privileged access to systems uses a combination of several things, and I wondered if it might help you to think about the role grouper should play in that.

Grouper groups that contain system or application admins are managed by each team's supervisor/lead. These groups are used to limit user access either to a bastion host or "jump server" with local config that limits to which servers it can connect, or to an admin vpn on which a policy similarly limits the set of servers that users in each group can connect to. Either way, as the server populations change some firewall-ish changes are made on these privileged access devices, and as the sys/app admin population changes the grouper groups are updated. This approach also has some other benefits such as enforcing 2FA and closer monitoring and other security measures for privileged access to systems.

Tom B

On 12/28/2016 10:50 AM, Hyzer, Chris wrote:
You could model this in grouper permissions.

The people would be groups.
The servers would be resources (and can be hierarchical).
Do something with actions? Maybe the group name is the action? Or maybe just use

To get them into LDAP maybe have a loader job that reads the permissions and
sets up groups for you (then the pspng will take it from there). This could
run hourly or however often.

This would be pretty straightforward to setup if you need help let me know.


-----Original Message-----

On Behalf Of Tom Poage
Sent: Tuesday, December 27, 2016 4:45 PM

Subject: Re: [grouper-users] Modeling NIS netgroup?

Hi, Michael.

That'd be close.

Something tells me to add one level of indirection, though that may be
because I don't completely understand Grouper capabilities yet.

E.g. let's say I want to restrict ssh access to SIS servers to the set of
sysadmins. Somewhere in there I might want to model a group containing the
pool of servers which come and go over time, and another group of individuals
belonging to the sysadmin group, likewise who come and go.

Maybe the simple thing to do is forget the servers and simply push (CFEngine, Puppet,
...) the "plussed" NIS group to /etc/password on subject servers with e.g.


making 'sysadmin' membership dynamic (say, Grouper-fed LDAP), and leave it at
that. Not pretty, but perhaps functional.


On Dec 27, 2016, at 1:02 PM, Michael R. Gettes

Hi Tom,

Would the name of the group having the hostname and the group itself being
the population do the trick? or something else to your liking? The resulting
group could, of course, be the by product of other reference groups and
include/exclude compositing to support allow/deny scenarios.


On Dec 27, 2016, at 11:22, Tom Poage


Grouper newbie.

Anyone gone to the effort of modeling NIS netgroups in Grouper? I.e.

name (user,machine,domain) (user,machine,domain) ...

I think we could do without the domain, so it'd basically be the intersection
of groups of machines and groups of users.

If so, what did the model look like, and did you build an adapter to create
the NIS map directly, or e.g. push to LDAP?

Of course, there are several other ways to accomplish authZ for shell access,
such as SSSD w/ PAM, ....


Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

Archive powered by MHonArc 2.6.19.

Top of Page