HPUX group limit for each user

[Alex Chau]

In HPUX, how do I change the number of groups that a user belongs to. I have a user that belongs to 23 groups. (A maximum of 20 groups are allowed for each user.)

[A. Clay Stephenson]

You don't; it's a hard limit.

[Alex Chau]

Thanks for the quick response. Is there a work around available?

[Kent Ostby]

No. There is no workaround at this time.

See this document for more details:

KBRC00017206

If you'd like to see the number increased and you have a support contract with HP, you could place a call and ask for an Enhancement Request to be considered.

Best regards,

Oz

[Jeff Schussele]

Hi Alex,

None directly.
You could think about giving the user a "secondary" account that he could su to & then split up his groups between the 2 accounts.

Rgds,
Jeff

[John Dvorchak]

I wonder if you can't put the user in a group by him/her self and then put that group into the 23 goups. Example user1 belongs to user1a group and user1a group is a member in all 23 other goups.

[Gary L. Paveza, Jr.]

I opened this as an issue with HP on 5/27/04. Here is the response:

The Enhancement Request for NGROUPS to be increased is JAGaf08926. This enhancement request has been investigated recently by the labs.
Conclusions: - We cannot patch an increased number of groups into any existing release without breaking both application binary compatibility and kernel intrusive application binary compatibility. - Under investigation for 11.31 or later but without commitment.
- If they are using NFS or any applications utilizing ONC RPC they would still be restricted to 16 groups based on Solaris ONC code limit of 16, even if OS NGROUPS limit was changed to greater then 20.
Alternative:
1) What has been described below can be accomplished using the ACL's available in HP-UX. They can put the administrators in a common group (admin) and modify the ACL's on all of the application files to allow "admin" to have group access. ACL's are also available on Solaris, AIX and Linux.

[Alex Chau]

Thanks for all the comments. I will do some house cleaning on the system to bring the number of groups down for each user. Thanks again.

[TwoProc]

I've found that you can go higher at times (in 11.11 at least), but it matters how you verify your groups. I've gotten a user in 24 groups (working fine) but only IF you avoid using NIS for distributing your group info. But it works great if the groups are defined in /etc/group (that is, locally), or via ldap.
I did see that when we distributed the group file via NIS (in days gone past), the hard limit was there at 20. Of course, now that I've "said it", HP will probably "fix" it, and then I'll be back down to 20.