Subject: Bug#3189: nvi over-cautious about .exrc?

From: [email-masked] (Bruce Perens)
Date: Mon, 3 Jun 96 15:48 PDT

> At the very least, let's not enforce creating a new user account before
> dselect is run.  This would at least make it possible for the user to
> edit /etc/adduser.conf first and turn off USERGROUPS if they wish so.

We really do have to create a new user account as soon as the system is
brought up, because until we do that we have no good destination for
root and postmaster mail, and we _don't_ want that user to spend a lot
of time logged in as root for obvious reasons. After dselect runs,
there are a number of system accounts and one user account, and a user
who is concerned with this can edit /etc/passwd and /etc/group and
change the group of that one account without much trouble at all.

As a policy, I would prefer to make the most general case work very
well, and make the more esoteric cases do-able with some amount of user
effort. I think that's where we are now - all users are set up with a
useful group that they can use to provide access to their own files to
selected others. To make group quotas work more effectively, you might
consider adding a script to the quota package that the user could run
to convert the entire system so that users (not system accounts) all
had the same primary GID. The script would also have to change the GIDs
on files belonging to the converted users.

	Thanks

	Bruce
--
Pixar's Toy Story: Over 1/3 Billion dollars world box office so far.

Bruce Perens AB6YM          [email-masked]            http://www.hams.com/

---

From: Marek Michalkiewicz <[email-masked]>
Date: Tue, 4 Jun 1996 01:55:24 +0200 (MET DST)

> of time logged in as root for obvious reasons. After dselect runs,

Yes, I know.  But if you know what you're doing...  Let's not try to be
more clever than the user is - it's not Win95 installation after all.

> change the group of that one account without much trouble at all.

Not much trouble if it is just one machine.  Some time ago I had to
install 10 machines as X workstations which don't need to handle mail
at all, and need no user accounts (NIS).  I had to answer all these
questions about user names and passwords only to delete these accounts
later.  I don't want to do unnecessary work, lazy me :-).  FYI, when
I installed SCO OpenServer 5, it asked me for root password (Debian
does it too, good), but didn't require that I create a new user account
immediately.

How about a compromise:

 It is highly recommended to create a new user account now.  It will be
 used as the destination for root and postmaster mail, and it is generally
 a good idea to avoid using the root account unless absolutely necessary.
 Unless you know what you're doing, please answer "y" to the following
 question.

 Do you want to create a new user account now? [y]

> useful group that they can use to provide access to their own files to

Hmm.  I can't chgrp my own files to any group I am not a member of (it
results in the "Operation not permitted" error).  I guess we need to
wait for Access Control Lists (expected in Linux 2.1.x - I saw a posting
from Remy Card saying that he is working on it) to be able to do that...

Marek

---

From: Richard Kaszeta <[email-masked]>
Date: Mon, 3 Jun 1996 20:39:34 -0500

>effort.

I'd say this is a good policy.  Although at times I've been aggravated
by some of the debian packages and install scripts holding my hand
(no, I *don't* need deliver for sendmail to work, etc.), but then I
have to admit that the typical debian user isn't integrating their
machine into an existing NIS, automount, etc environment, and if they
are they are capable of cleaning up a few places where the Debian
scripts assumed a little too much.

As far as adding an initial user goes, it isn't to hard to clean this
up quickly.

--
Richard W Kaszeta 			Graduate Student/Sysadmin
[email-masked]			University of MN, ME Dept
http://www.me.umn.edu/0h/home/kaszeta/www.html
--
Sleep is a symptom of caffeine deprivation