/etc/group reached it's limits

[Kurtkarl]

Hi,

We have one machine here which has 600+ users accounts. We changed this machine from untrusted to trusted for security reasone.
But when our users tries to logon after trusted where made they could'nt get into our Informix server database and system says that /etc/group already reached it's limits. But when we tried to "un-trusted" this machine again everything works fine.

Have any idea or workaround on this?
Regards
Joey

[harry d brown jr · Accepted solution]

How many "groups" do these users belong to? Somewhere I remember some funky limit of 15. What OS do you have and does the machine have the latest patches?

live free or die
harry

[Alan Riggs]

You may also be running into a limit on the line length of a particular group entry. LINE_MAX is 2048 and no single group entry may legally exceed that limit.

[S.K. Chan]

On 11.0, the limit is ..
20 groups per user
2048 chars per line in /etc/group

[Bill Hassell]

/etc/group should have only secondary groups listed, NOT the primary group listed in /etc/passwd. So if you have very long lines with user logins listing their primary group, you can remove all of the logins and just leave the empty group line as in:

users::20:

Now if dozens or hundreds of users also have secondary groups, this can still be made to work OK. Just list a few user logins per line and then start a new line. The group name may be repeated an unlimited number of times as in:

group2::105:a,b,c,d,e,f,g,h,i
group2::105:j,k,l,m,n,o,p
group2::105:q
group2::105:r,s,t,u,v,ww,xxx,yyy,zzzz

In other words, you can easily accomodate hundreds of users in a single group by listing a few (or even just one) per line.

NOTE: If you are running 10.20 or earlier, you need to link the logingroup and group files together so that users have access rights to all of their member groups at the same time:

ln -s /etc/group /etc/logingroup

At 11.0, this is implied and no longer necessary. Verify multiple group membership with the id command:

$ id
uid=102(blh) gid=20(users) groups=16(sitemail),21(www),22(vsifax)