topic Re: Forgotten uid basics in Operating System - HP-UX

Forgotten uid basics

Ralph Grothe — Wed, 09 Jan 2008 14:34:32 GMT

Hello Folks,

I need to refresh my memory.
I have a couple of hpux servers where I need to create a user for a mere service (no login required).
I think to recall that the uids < 100 were for special purposes under hpux.
But having studied the passwd manpages I haven't found such mention.
Theses servers have several thousands entries in passwd with all uids contiguously used starting from 101.
I wouldn't want to give my daemon some free uid at the tail.
There are a few uids unused yet between 10-100,
as can be seen:

# sort -t: -k 3n,3 /etc/passwd|awk -F: 'NR<17{printf"%10s %3u\n",$1,$3}'
nobody 4294967294
root 0
daemon 1
bin 2
sys 3
adm 4
uucp 5
lp 9
nuucp 11
hpdb 27
www 30
webadmin 40
informix 101
mysql 102
iwww 103
owww 104

Well if www got 30, I cannot see why my service shouldn't get e.g. 99?
Or, I could userdel the mysql account, which we will most likely never use (for this is an Informix server), and assign its free uid to my new user.
So is there really some founded reason why one shouldn't use uids 1-100, or did my memory serve me incorrectly?

Regards
Ralph

Re: Forgotten uid basics

Pete Randall — Wed, 09 Jan 2008 14:50:30 GMT

Ralph,

There's no hard and fast rule that I'm aware of. It's customary to use UIDs less than 100 for system accounts and SAM follows this custom - that's probably why your password file looks as it does. As far as your service is concerned, I see no reason at all why you shouldn't give it any UID you wish.

Pete

Re: Forgotten uid basics

James R. Ferguson — Wed, 09 Jan 2008 15:00:29 GMT

Hi Ralph:

Uid values less than 100 are "reserved" for HP as documented in the manpages:

http://docs.hp.com/en/B3921-60631/useradd.1M.html

Regards!

...JRF...

Re: Forgotten uid basics

Tim Nelson — Wed, 09 Jan 2008 15:28:00 GMT

A note to add to JRFs.. The reserved HP < 100 ids are just that. If HP would need a service account for an app they will typically add it in the < 100 range. If you create one using < 100 it would not fail nor does it have any special privelage ( other than if you were to use 0 ). Using a UID < 100 may just cause some conflict down the road if HP decides to use your number.

Otherwise the organization of UIDs is in your control.

I typically do the following.

101-499 service accounts ( i.e. admin logins like oracle and such )

Regular uses 1000 +

Make up what you wish and stick to it. It makes audit reporting alot simpler if you can run the reports against a range for audit an such.

Re: Forgotten uid basics

Tim Nelson — Wed, 09 Jan 2008 15:28:22 GMT

A note to add to JRFs.. The reserved HP < 100 ids are just that. If HP would need a service account for an app they will typically add it in the < 100 range. If you create one using < 100 it would not fail nor does it have any special privelage ( other than if you were to use 0 ). Using a UID < 100 may just cause some conflict down the road if HP decides to use your number.

Otherwise the organization of UIDs is in your control.

I typically do the following.

200-499 service accounts ( i.e. admin logins like oracle and such )

Regular uses 1000 +

Make up what you wish and stick to it. It makes audit reporting alot simpler if you can run the reports against a range for audit an such.

Re: Forgotten uid basics

Ralph Grothe — Wed, 09 Jan 2008 16:30:56 GMT

Thanks JRF,
don't know why this escaped my notice?
But then it doesn't say what it had been reserved for:

-u uid Specifies the UID for the new user. uid must be a
non-negative decimal integer less than MAXUID as
it is defined in the header file. uid
defaults to the next available unique number above
the maximum currently assigned number. UIDs from
0-99 are reserved.

But thanks to Tim we have an explanation.

Well, I hadn't much choice because the user accounts on this box were created following other peoples' scheme.
I understand that my decision may not comply with HP policies and may later clash with some OS upgrade.
Anyway, I selected the free uid 99 for my munin-node.
Thanks for your clarification.

Re: Forgotten uid basics

Ralph Grothe — Wed, 09 Jan 2008 16:32:10 GMT

No further help in this matter needed.