Newgrp fails on only 1 group

UNIX Solaris
1

I have a handful of users who can't 'newgrp' to one specific group from Solaris 9 and 10 nodes and always get this prompt:

newgrp: Password:

We never get prompted by 20+ other groups and this group never prompts for a password from Red Hat Linux nodes. Authentication comes from AD and there's password set there.

<cardinal-root># adquery group|grep dg.azsd01.clearcase.mpp
dg.azsd01.clearcase.mpp:x:387698:
2

Perhaps the group has more members than newgrp can take?
Or the users are members of more than 16 groups?

3

Also, the group id is quite high, perhaps that could play a role somehow? Or do the other groups also use gids that high?

Using Large User IDs and Group IDs (System Administration Guide, Volume 1)

4

Thanks for the input. We know that newgrp only works for the first 16 groups which are output by the groups command (sans this one problem group). The GID is in fact over 60000, but we have working groups in the 6-figure range above this group.
This problem group has a huge number of members. Can someone point me to a doc which covers the max members that Solaris can handle in a group? As I mentioned, Red Hat is fine with this group. THX

5

I think the problem is the limit in /usr/include/

nss_dbdefs.h:#define    NSS_BUFSIZ              1024
nss_dbdefs.h:#define    NSS_LINELEN_GROUP       ((NSS_BUFSIZ) * 8)
nss_dbdefs.h:#define    NSS_BUFLEN_GROUP        NSS_LINELEN_GROUP

So I guess the text line of one group line cannot exceed 8191 characters.
Workarounds:

  1. You can split the group. Two group names with the same GID, and distribute the users on them.
  2. You can download the newgrp.c from Opensolaris, it seems to not adhere to this limit, instead uses malloc() to store even the biggest lines.
1 Like