Forgotten uid basics

[Ralph Grothe]

Hello Folks,

I need to refresh my memory.
I have a couple of hpux servers where I need to create a user for a mere service (no login required).
I think to recall that the uids < 100 were for special purposes under hpux.
But having studied the passwd manpages I haven't found such mention.
Theses servers have several thousands entries in passwd with all uids contiguously used starting from 101.
I wouldn't want to give my daemon some free uid at the tail.
There are a few uids unused yet between 10-100,
as can be seen:

# sort -t: -k 3n,3 /etc/passwd|awk -F: 'NR<17{printf"%10s %3u\n",$1,$3}'
nobody 4294967294
root 0
daemon 1
bin 2
sys 3
adm 4
uucp 5
lp 9
nuucp 11
hpdb 27
www 30
webadmin 40
informix 101
mysql 102
iwww 103
owww 104



Well if www got 30, I cannot see why my service shouldn't get e.g. 99?
Or, I could userdel the mysql account, which we will most likely never use (for this is an Informix server), and assign its free uid to my new user.
So is there really some founded reason why one shouldn't use uids 1-100, or did my memory serve me incorrectly?

Regards
Ralph

[Pete Randall]

Ralph,

There's no hard and fast rule that I'm aware of. It's customary to use UIDs less than 100 for system accounts and SAM follows this custom - that's probably why your password file looks as it does. As far as your service is concerned, I see no reason at all why you shouldn't give it any UID you wish.


Pete

[James R. Ferguson · Accepted solution]

Hi Ralph:

Uid values less than 100 are "reserved" for HP as documented in the manpages:

http://docs.hp.com/en/B3921-60631/useradd.1M.html

Regards!

...JRF...

[Tim Nelson]

A note to add to JRFs.. The reserved HP < 100 ids are just that. If HP would need a service account for an app they will typically add it in the < 100 range. If you create one using < 100 it would not fail nor does it have any special privelage ( other than if you were to use 0 ). Using a UID < 100 may just cause some conflict down the road if HP decides to use your number.

Otherwise the organization of UIDs is in your control.

I typically do the following.

101-499 service accounts ( i.e. admin logins like oracle and such )

Regular uses 1000 +

Make up what you wish and stick to it. It makes audit reporting alot simpler if you can run the reports against a range for audit an such.

[Tim Nelson]

A note to add to JRFs.. The reserved HP < 100 ids are just that. If HP would need a service account for an app they will typically add it in the < 100 range. If you create one using < 100 it would not fail nor does it have any special privelage ( other than if you were to use 0 ). Using a UID < 100 may just cause some conflict down the road if HP decides to use your number.

Otherwise the organization of UIDs is in your control.

I typically do the following.

200-499 service accounts ( i.e. admin logins like oracle and such )

Regular uses 1000 +

Make up what you wish and stick to it. It makes audit reporting alot simpler if you can run the reports against a range for audit an such.

[Ralph Grothe]

Thanks JRF,
don't know why this escaped my notice?
But then it doesn't say what it had been reserved for:

-u uid Specifies the UID for the new user. uid must be a
non-negative decimal integer less than MAXUID as
it is defined in the header file. uid
defaults to the next available unique number above
the maximum currently assigned number. UIDs from
0-99 are reserved.



But thanks to Tim we have an explanation.

Well, I hadn't much choice because the user accounts on this box were created following other peoples' scheme.
I understand that my decision may not comply with HP policies and may later clash with some OS upgrade.
Anyway, I selected the free uid 99 for my munin-node.
Thanks for your clarification.

[Ralph Grothe]

No further help in this matter needed.