Menu
▾
▴
#708 ACL uid/gid ranges are not applied.
When a gid range ACL is applied to a Webmin user in the
users & groups module, ALL groups appear in the
Secondary Groups combo select box. A "account admin"
type user can add users to ANY secondary group.
Additionally, when a Webmin user inherits his ACL via
membership in a Webmin Group (rather than a specific
User ACL assignment), ALL groups appear in the
Secondary Groups combo (same as above), and the user
selection pop-ups show ALL users.
Even if the Webmin User is not in the allowed uid/gid
range, he could add himself to the root, disk, bin,
etc. groups.
Applies to v1.020 with post-release patches applied (
*_group & *_user .cgi's dated 10/07/2002).
Logged In: YES
user_id=129364
The 'Unix groups who can be edited' section does not control
which groups
you can assign a unix user to. For that, you need to fill in
the 'Allowed
groups for new or modifed users' field, which takes just a
list of group names.
Does that solve the problem?
Logged In: NO
That would be OK if my groups were relatively static, but my
situation is that I must allow user admins to create new
users, and administer groups.
Let's say my user admin person has a gid ACL range
restriction of 500-1000. When he creates a new user he can
add that user to any group on the system (root, wheel, etc)
because they're all listed in the Secondary Groups combo
box. He -should- only be able to add the user to gids in the
500-1000 range.
Perhaps a neat solution would be to replace the secondary
group combo with the 'my_group_chooser.cgi' pop-up? That
cgi does correctly filter groups according to the gid range
restriction.
I guess the Webmin Group -> Webmin User inheritance problem
would be a separate issue. I'm not using Webmin groups
because of that problem. I was hoping to have a User Admins
group, assign the ACLs to it, then just add Webmin users to
the group and have the ACLs applied. It doesn't seem to be
working like that, so I must do ACLs for each Webmin user
admin. Not a major pain - there's only a handful.
Otherwise, this is a great package for what I need to do -
which is replace a bunch of NT servers with Linux!