topic Re: 20 group limit for users in Operating System - HP-UX

20 group limit for users

bfrench — Wed, 16 Jan 2008 15:21:58 GMT

Is there a work around for the 20 group limit per user on HP-UX? Has anyone used any other options when faced with this problem?

Re: 20 group limit for users

Steven E. Protter — Wed, 16 Jan 2008 15:28:01 GMT

Shalom,

You don't state your version of HP-UX.

I've checked 11.11 and 11.00 and 11.23.

As far as I can tell this limit can not be changed.

I have only encountered this via the ITRC forums which I have actively participated in for 4.5 years.

SEP

Re: 20 group limit for users

bfrench — Wed, 16 Jan 2008 15:32:18 GMT

My OS is HP-UX 11.23 U ia64

Does HP have plans to change this limitation?

Re: 20 group limit for users

Pete Randall — Wed, 16 Jan 2008 15:45:28 GMT

I find it interesting that NGROUPS_MAX in limits.h claims to be 20+. See the limits man page. Could this be an indication of some flexibility??

Pete

Re: 20 group limit for users

bfrench — Wed, 16 Jan 2008 16:00:48 GMT

Yes that is interesting.

I will test this on my dev system and let you know.

Re: 20 group limit for users

Duncan Edmonstone — Wed, 16 Jan 2008 16:33:36 GMT

nope its still at 20 and will remain so on 11.23.

Possibly this will be increased on 11.31 sometime in the 2nd half of this year...

HTH

Duncan

Re: 20 group limit for users

TwoProc — Wed, 16 Jan 2008 20:38:00 GMT

ON HPux 11.11, I've gotten way more via a bug of sorts. I've gotten users in up to 28 groups by using NIS+. And... lost that ability as soon as I converted to ldap. Don't know why, according to HP, I never had it in the first place. But, there it was, the 800 gorilla in the room that allowed us to have users in many more groups than was "possible." I really, really this is a HUGE oversight on HP's part to limit to such a small amount. Since a file can't get multiple permissions to multiple users, the only way to work around this ugliness is groups, and running out at 21 is very limiting.

Re: 20 group limit for users

Autocross.US — Wed, 16 Jan 2008 21:00:36 GMT

How about access control lists (ACLs) as another work around? You can assign multiple user permissions to files all day with the setacl command. I use this in a relatively small environment often. Not sure if it would work for yours.

Re: 20 group limit for users

bfrench — Wed, 16 Jan 2008 21:26:13 GMT

We are using (ACL) access control lists. But that's why we have all the groups. Our environment puts users in groups and gives the group access rights to the directory structure for different projects. We now have over 50 projects so we have to remove users from projects they are not doing as much work on. It's always nice when a project is completed because that opens a new space for everyone on the project. By the way, this is the Pharma Industry. So that should clear up the need for all the projects.
Thanks for all the help. I made the change to limits.h and rebooted the dev host. They are testing it now. I bumped it to 30 groups.

Re: 20 group limit for users

Dennis Handly — Thu, 17 Jan 2008 02:37:49 GMT

>I made the change to limits.h and rebooted the dev host. I bumped it to 30 groups.

This can't possibly make a difference. Since you didn't recompile anything, nobody is looking at your change. Kernel regens also don't look at .

You should put the file back ASAP.

Re: 20 group limit for users

bfrench — Thu, 17 Jan 2008 12:00:00 GMT

My reboot did not work. I guess we will have to wait for HP to fix this. Thanks for everyones thoughts add suggestions. You were all very helpfull