Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Josh Cooper commented on PUP-1153 Re: Incorrect ordering of group and user resource purging To watchers on this ticket. The root cause for this issue was due to (PUP-1963) generated resources not having any relationships added to them, which could cause things to be executed in incorrect order. This caused issues for any provider using Provider#generate or Provider#eval_generate to generate new resources at catalog application time. Jesse Hathaway in situations were we need to force behavior, we generally add a force parameter to the type and default it to false. For example, when deleting a directory with recurse true. I think that approach might work here, if you want to force group deletion. Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.21655.1387320781000.40124.1560187201462%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Jesse Hathaway commented on PUP-1153 Re: Incorrect ordering of group and user resource purging Josh Cooper You are correct that forcing group deletion is not necessary if I use the resources resource. That methodology should be sufficient for my use case, so I will go ahead and close my pull request. I maintain that this is a relatively innocuous change which improves usability and eliminates a difference between Linux and platforms such as FreeBSD, but evidently you disagree on the importance of those factors. Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.21655.1387320781000.38699.1559935681135%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title
Josh Cooper commented on PUP-1153
Re: Incorrect ordering of group and user resource purging
Jesse Hathaway if you manage all users including system users and groups, then I would expect the following to just work:
user { 'root':
ensure => present,
password => ...,
require => Group['wheel'],
}
# other users here
group { 'wheel':
ensure =>present,
}
# other groups here
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Robert August Vincent II commented on PUP-1153 Re: Incorrect ordering of group and user resource purging Note that the accounts module now adds groups before users, and deletes users before groups. Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-bugs/JIRA.21655.1387320781000.31660.1559582581306%40Atlassian.JIRA. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title
Jesse Hathaway commented on PUP-1153
Re: Incorrect ordering of group and user resource purging
Josh Cooper We manage all our users, including system users, with puppet so your suggestion would not help our use case. We have been running a version of my PR for three years with no ill effects. I am not sure what the concerns are with "dangling pointers" the affected user can still login and even access any files, they just can't resolve their GID into a name. You are correct that through proper ordering you can delete the user before the group, but there are a couple of issues with that approach:
This behavior is inconsistent between platforms, for example FreeBSD or DragonflyBSD will happily delete a group when there still exists a user who has that group set as their GID. This inconsistency makes it harder to use cross platform modules on the forge.
You have to change your puppet ordering anytime you delete a user, since on creation you want the group created before the user and upon deletion you want the user deleted before the group:
# Creation
group { 'butter':
ensure => present,
gid => 555,
}
user { 'butter':
ensure => present,
uid => 555,
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title
Josh Cooper commented on PUP-1153
Re: Incorrect ordering of group and user resource purging
There are a few different issues filed in this ticket: 1. Can't guarantee the order of user and group deletion. The original issue was filed when puppet did not support manifest ordering. Adding explicit dependencies to ensure resources were deleted in the correct order, didn't work due to PUP-2451. However, Puppet defaults to manifest ordering, so you can easily delete users before groups. 2. USERGROUPS_ENAB=yes/no. If the setting is yes, then ensuring the user and group are absent works correctly (as of 5.5.13) because the group provider determines whether the resource is insync after it's been deleted. So the provider sees that the group doesn't exist and nothing needs to be done:
root@fzt1mvzv8hybr6g:~# cat create.pp
group { 'foo':
ensure => 'present',
}
user { 'foo':
ensure => 'present',
groups => 'foo',
}
root@fzt1mvzv8hybr6g:~# puppet apply create.pp
Notice: Compiled catalog for fzt1mvzv8hybr6g.delivery.puppetlabs.net in environment production in 0.01 seconds
Notice: /Stage[main]/Main/Group[foo]/ensure: created
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Branan Riley updated an issue Puppet / PUP-1153 Incorrect ordering of group and user resource purging Change By: Branan Riley Labels: autorequire group redmine triaged type_and_provider user Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Branan Riley updated an issue Puppet / PUP-1153 Incorrect ordering of group and user resource purging Change By: Branan Riley Labels: manage-user- autorequire group redmine type_and_provider user Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Geoff Nichols updated an issue Puppet / PUP-1153 Incorrect ordering of group and user resource purging Change By: Geoff Nichols Labels: linux manage-user-group redmine type_and_provider Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Geoff Nichols updated an issue Puppet / PUP-1153 Incorrect ordering of group and user resource purging Change By: Geoff Nichols Labels: linux manage-user-group redmine type_and_provider Add Comment This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Moses Mendoza updated an issue Puppet / PUP-1153 Incorrect ordering of group and user resource purging Change By: Moses Mendoza Labels: manage-user-group redmine triaged Add Comment This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title John Duarte updated an issue Puppet / PUP-1153 Incorrect ordering of group and user resource purging Change By: John Duarte Labels: manage-user-group redmine triaged Add Comment This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Franz Skale commented on PUP-1153 Re: Incorrect ordering of group and user resource purging Hi Jamie, perhaps i can help you. Setting "USERGROUPS_ENAB no" in file /etc/login.defs worked out for me. But USERGROUPS_ENAB yes is default for all distributions. So IMHO puppet has to take care about setting it to "no" when managing user/groups. There are pros and cons about this particular setting. If you want to manager user/groups locally you have to take care to issue a groupdel after userdel if using the setting "USERGROUPS_ENAB no". Rgds. Franz Add Comment This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Moses Mendoza updated an issue Puppet / PUP-1153 Incorrect ordering of group and user resource purging Change By: Moses Mendoza Labels: redmine manage- user-group -management redmine Add Comment This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Moses Mendoza updated an issue Puppet / PUP-1153 Incorrect ordering of group and user resource purging Change By: Moses Mendoza Labels: redmine user-group-management Add Comment This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Jamie Campbell commented on PUP-1153 Re: Incorrect ordering of group and user resource purging This is an annoying issue that in my opinion has been unresolved for too long. I am having to manually remove users from nodes. One way to accomplish that without having to log into each server is via a salt command. If I am going to start using salt to clean up what Puppet can't do properly, well... You see where I'm headed with that? Add Comment This message was sent by Atlassian JIRA (v6.4.13#64028-sha1:b7939e9) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Franz Skale updated an issue Puppet / PUP-1153 Incorrect ordering of group and user resource purging Change By: Franz Skale Comment: When setting USERGROUPS_ENAB=no, the secondary groups get removed but the primary group will be left.When creating a user and set the require option, the user will not be created because the user will be created before the group.Jul 15 08:57:55 69-host puppet-agent[25767]: Could not create user testuser: Execution of '/usr/sbin/useradd -g 10004 -G ftpadmins -d /nonexistent -p ! -s /bin/false -u 10004 testuser' returned 6: useradd: group '10004' does not existJul 15 08:57:55 69-host puppet-agent[25767]: (/Stage[main]/User/User[testuser]/ensure) change from absent to present failed: Could not create user testuser: Execution of '/usr/sbin/useradd -g 10004 -G ftpadmins -d /nonexistent -p ! -s /bin/false -u 10004 testuser' returned 6: useradd: group '10004' does not existHow can i distiguish between add (ensure=present) and delete (ensure=absent) in a defined type ? Add Comment This message was sent by Atlassian JIRA (v6.4.13#64028-sha1:b7939e9) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Franz Skale commented on PUP-1153 Re: Incorrect ordering of group and user resource purging When setting USERGROUPS_ENAB=no, the secondary groups get removed but the primary group will be left. When creating a user and set the require option, the user will not be created because the user will be created before the group. Jul 15 08:57:55 69-host puppet-agent[25767]: Could not create user testuser: Execution of '/usr/sbin/useradd -g 10004 -G ftpadmins -d /nonexistent -p ! -s /bin/false -u 10004 testuser' returned 6: useradd: group '10004' does not exist Jul 15 08:57:55 69-host puppet-agent[25767]: (/Stage[main]/User/User[testuser]/ensure) change from absent to present failed: Could not create user testuser: Execution of '/usr/sbin/useradd -g 10004 -G ftpadmins -d /nonexistent -p ! -s /bin/false -u 10004 testuser' returned 6: useradd: group '10004' does not exist How can i distiguish between add (ensure=present) and delete (ensure=absent) in a defined type ? Add Comment This message was sent by Atlassian JIRA (v6.4.13#64028-sha1:b7939e9) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title
Franz Skale commented on PUP-1153
Re: Incorrect ordering of group and user resource purging
Kylo Ginsberg: We own a enterprise license and ran into the same problem. This is so annyoing, because it's a fact that prior deleting the primary group, you've to delete the user first. That BUG is stopping our prododuction env.. The next problem is, when the exitvalue of userdel != 0 the user will not be removed from the secondary groups he's in. We use hiera and my setup is as follows: Debian 8 Agents PE 2016.2.0
E.g. Group: "testgroup" : { "ensure" : "present", "gid" : 10005, "require" : "User[testuser]" }
User: "testuser" : { "shell" : "/bin/false", "comment" : "", "home" : "/home/testuser", "password" : "!", "groups": ["ftpadmins", "webadmins"], "uid" : "10005", "gid" : "10005", "password_max_age" : "9", "password_min_age" : "0" }
Delete the user via ensure = absent. What happens
Jul 15 08:14:47 69-host puppet-agent[17425]: Could not delete group testgroup: Execution of '/usr/sbin/groupdel testgroup' returned 8: groupdel: cannot remove the primary group of user 'testuser'
What is weird is, that the primary group has been removed leaving the secondary group membership debris alive.
So, what has to be done to get things working ?
Do i have to write my own class ? Do i have to patch the commands in puppet ruby classes ?
Right now i have to manually remove the debris.
Add Comment
This message was sent by Atlassian JIRA (v6.4.13#64028-sha1:b7939e9)
--
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com.
To post to this group, send email to puppet-bugs@googlegroups.com.
Visit this group at
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Stephen Gelman commented on PUP-1153 Re: Incorrect ordering of group and user resource purging Kylo Ginsberg: We just upgraded to puppet 4.5.2 and the issue is now worse. Before, the group removal errored but the user removal succeeded so the issue went away on subsequent puppet runs. Now, the group removal failing causes cascading dependency failures and the user removal gets skipped. This means the only way we are able to remove users on the box is doing so by hand. Is it possible for this to be prioritized more now that it is a huge breaking issue for us, and presumably anyone recursively managing users and groups in debian/ubuntu? Add Comment This message was sent by Atlassian JIRA (v6.4.13#64028-sha1:b7939e9) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Stephen Gelman commented on PUP-1153 Re: Incorrect ordering of group and user resource purging Well it now has 2 votes. Looking at PUP-1963 my gut feeling is that it is not the issue however I am going to test out the PR. I'll report back my findings. Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Kylo Ginsberg commented on PUP-1153 Re: Incorrect ordering of group and user resource purging Stephen Gelman: first, apologies for not responding to your ping earlier this summer. But, better late than never Second, re priorities, we generally pull in tickets that have lots of votes (or are implied by other tickets). This has just one vote, which is why it hasn't climbed high in our backlog. There isn't a magic threshold on votes, btw, but it's definitely something we look at. But, and this is speculation, I'm wondering if this has the same root cause as PUP-1963, which we are currently working on. Again, that's speculation, but they seem related in that resources are generated, and several of the iterations above are trying to set dependencies that apparently aren't being honored. So if you can repro this running from source, you could try the PR for that ticket, or you could try once we release the fix for that (probably a few weeks out). Hope some of that helps! Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Stephen Gelman commented on PUP-1153 Re: Incorrect ordering of group and user resource purging Kylo Ginsberg: this ticket has been open since 2013 and affects us daily. Any chance of it getting prioritized to be fixed? AFAIK it would affect anyone running debian or ubuntu. Add Comment This message was sent by Atlassian JIRA (v6.4.11#64026-sha1:78f6ec4) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Stephen Gelman commented on PUP-1153 Re: Incorrect ordering of group and user resource purging Kylo Ginsberg: any update on this? Add Comment This message was sent by Atlassian JIRA (v6.3.15#6346-sha1:dbc023d) -- You received this message because you are subscribed to the Google Groups Puppet Bugs group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Charlie Sharpsteen updated an issue Puppet / PUP-1153 Incorrect ordering of group and user resource purging Change By: Charlie Sharpsteen Scrum Team: ClientPlatform Add Comment This message was sent by Atlassian JIRA (v6.3.15#6346-sha1:dbc023d) -- You received this message because you are subscribed to the Google Groups Puppet Bugs group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Stephen Gelman commented on PUP-1153 Re: Incorrect ordering of group and user resource purging Kylo Ginsberg what is the hold up on this getting fixed? It's not necessarily a breaking issue but it does consistently cause errors in our puppet runs... Add Comment This message was sent by Atlassian JIRA (v6.3.15#6346-sha1:dbc023d) -- You received this message because you are subscribed to the Google Groups Puppet Bugs group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Stephen Gelman commented on PUP-1153 Re: Incorrect ordering of group and user resource purging Kylo Ginsberg, sorry, I should have given more detail. The reason it doesn't work is that the problem in puppet is different from the problem that USERGROUPS_ENAB is intended to solve. The purpose of USERGROUPS_ENAB=no is that when a user is deleted their primary group is deleted also (if it had no other members). The problem in puppet is that it tries to delete the group before the user. This fails because groupdel does not allow a user's primary group to be deleted. From its man page: You may not remove the primary group of any existing user. You must remove the user before you remove the group. I believe the solution here is that puppet should always delete users before deleting groups. I don't think it necessarily makes a difference but we are running Debian wheezy. Add Comment This message was sent by Atlassian JIRA (v6.3.15#6346-sha1:dbc023d) -- You received this message because you are subscribed to the Google Groups Puppet Bugs group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Kylo Ginsberg commented on PUP-1153 Re: Incorrect ordering of group and user resource purging In terms of general approach to the issue, I agree with the comment above to the effect that puppet shouldn't try to override /etc/login.defs. Stephen Gelman can you say more about setting USERGROUPS_ENAB to no: 1) does it do what the man pages says it does? E.g. if you run the commands standalone outside of puppet? 2) does a puppet snippet like those given above still cause the group to be deleted when the last user is deleted? Also can you report what distro you're trying this on? (Maybe there's some distro variance at play here as well ...) If (1) is a yes, and (2) is a no, that will be weird (since puppet wraps those user* commands) but it will be some guidance on this issue. Add Comment This message was sent by Atlassian JIRA (v6.3.15#6346-sha1:dbc023d) -- You received this message because you are subscribed to the Google Groups Puppet Bugs group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Stephen Gelman commented on PUP-1153 Re: Incorrect ordering of group and user resource purging We are running into this exact problem. It seems like the status is Needs Information but I'm not sure what that information is. If someone could point me in the right direction I'd be happy to try and find the required information to get the ball rolling on fixing this. Add Comment This message was sent by Atlassian JIRA (v6.3.10#6340-sha1:7ea293a) -- You received this message because you are subscribed to the Google Groups Puppet Bugs group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Eric Sorenson commented on an issue Re: Incorrect ordering of group and user resource purging IMO if that's happening because of login.defs, that's how the system works and we should not try to second-guess it. I agree it's surprising, maybe a special note in the type reference is warranted...? Add Comment Puppet / PUP-1153 Incorrect ordering of group and user resource purging I am using the following below code to purge/remove all unmanaged (to Puppet) users and groups on a system so that only OS groups and users I allow can exist. I receive errors in my log though because Puppet will attempt to remove a (primary) group before it removes the corresponding user. Although a subsequent run has no errors (the user was eventual... This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups Puppet Bugs group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Charlie Sharpsteen updated an issue Puppet / PUP-1153 Incorrect ordering of group and user resource purging Change By: Charlie Sharpsteen Component/s: CatalogApplication Add Comment This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups Puppet Bugs group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/groups/opt_out.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Charlie Sharpsteen updated an issue Puppet / PUP-1153 Incorrect ordering of group and user resource purging Kylo Ginsberg, moving this one over to Catalog Application since it concerns the behavior of the agent. Change By: Charlie Sharpsteen Assignee: EricSorenson KyloGinsberg Add Comment This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups Puppet Bugs group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/groups/opt_out.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title
Charlie Sharpsteen commented on an issue
Re: Incorrect ordering of group and user resource purging
I agree with Daniel's assement: removing a user that is the sole member of a group cascades into removing the group as well — if the user and group share the same name. This behavior can also be reproduced using the puppet resource tool to add a group and user:
# puppet resource group foo ensure=present
notice: /Group[foo]/ensure: created
group { 'foo':
ensure = 'present',
}
# puppet resource user foo ensure=present gid=foo
notice: /User[foo]/ensure: created
user { 'foo':
ensure = 'present',
gid= '503',
}
Then, if we remove the user:
# puppet resource user foo ensure=absent
notice: /User[foo]/ensure: removed
user { 'foo':
ensure = 'absent',
}
We can see that the group was also removed by querying its status:
# puppet resource group foo
group { 'foo':
ensure = 'absent',
}
The behavior is explained in the caveats section of the userdel manpage:
If USERGROUPS_ENAB is defined to yes in /etc/login.defs, userdel will delete the group with the same name as the user. To avoid inconsistencies in the passwd and group databases, userdel will check that this group is not used as a primary group for another user, and will just warn without deleting the group otherwise. The -f option can force the deletion of this group.
This clash between Puppet behavior and /etc/login.defs has come up before with CREATE_HOME.
Looks like we need to decide whether or not the default behavior in these cases should be enforced by /etc/login.defs or Puppet. Eric Sorenson, any thoughts?
Add Comment
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Charlie Sharpsteen updated an issue Puppet / PUP-1153 Incorrect ordering of group and user resource purging Change By: Charlie Sharpsteen Assignee: CharlieSharpsteen EricSorenson Add Comment This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups Puppet Bugs group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/groups/opt_out.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title
Daniel Dreier updated an issue
Puppet / PUP-1153
Incorrect ordering of group and user resource purging
Change By:
Daniel Dreier
Iamusingthefollowingbelowcodetopurge/removeallunmanaged(toPuppet)usersandgroupsonasystemsothatonlyOSgroupsandusersIallowcanexist.IreceiveerrorsinmylogthoughbecausePuppetwillattempttoremovea(primary)groupbeforeitremovesthecorrespondinguser.Althoughasubsequentrunhasnoerrors(theuserwaseventuallypurged)IamleftwithundesiredgroupsuntilIrunPuppetagain.ThecurrentworkaroundistorunPuppetmultipletimesandmodifymonitoringscriptstoignorethegroupdeletionerrors.Attemptsatusingbefore,require,-,etc.notationdonotcausethedesiredorder(purgeusersthengroups).I'dproposethatPuppetbemodifiedsuchthatiteitherhonorsthespecifiedorderingorasarulealwaysprocessesuserremoval/purgingbeforeitprocessesanygroupremoval/purging.Errorinlog: = {noformat}Error:/Group[vagrant]/ensure:changefrompresenttoabsentfailed:Couldnotdeletegroupvagrant:Executionof'/usr/sbin/groupdelvagrant'returned8:groupdel:cannotremovetheprimarygroupofuser'vagrant'{noformat}(notethatvagrantwasnotloggedin)(ThiswasonanUbuntu12.04server)Iteration#1(failed): === {noformat}resources{'user':purge=true,unless_system_user=false,}resources{'group':purge=true,unless_system_user=false,}{noformat}Iteration#2(failed): === {noformat}resources{'user':purge=true,unless_system_user=false,before =Resources['group'],}resources{'group':purge=true,unless_system_user=false,}{noformat}Iteration#3(failed): === {noformat}resources{'user':purge=true,unless_system_user=false,}resources{'group':purge=true,unless_system_user=false,require =Resources['user'],}{noformat}Iteration#4(failed): === {noformat}resources{'user':purge=true,unless_system_user=false,before =Resources['group'],}resources{'group':purge=true,unless_system_user=false,require =Resources['user'],}{noformat}Iteration#5(failed): === {noformat}resources{'user':purge=true,unless_system_user=false,}resources{'group':purge=true,unless_system_user=false,}Resources['user']-Resources['group']{noformat}Iteration#6(failed): === {noformat}resources{'user':purge=true,unless_system_user=false,before =Resources['group'],}resources{'group':purge=true,unless_system_user=false,require =Resources['user'],}Resources['user']-Resources['group']{noformat}
Add Comment
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title
Daniel Dreier updated an issue
Puppet / PUP-1153
Incorrect ordering of group and user resource purging
Change By:
Daniel Dreier
Iamusingthefollowingbelowcodetopurge/removeallunmanaged(toPuppet)usersandgroupsonasystemsothatonlyOSgroupsandusersIallowcanexist.IreceiveerrorsinmylogthoughbecausePuppetwillattempttoremovea(primary)groupbeforeitremovesthecorrespondinguser.Althoughasubsequentrunhasnoerrors(theuserwaseventuallypurged)IamleftwithundesiredgroupsuntilIrunPuppetagain.ThecurrentworkaroundistorunPuppetmultipletimesandmodifymonitoringscriptstoignorethegroupdeletionerrors.Attemptsatusingbefore,require,-,etc.notationdonotcausethedesiredorder(purgeusersthengroups).I'dproposethatPuppetbemodifiedsuchthatiteitherhonorsthespecifiedorderingorasarulealwaysprocessesuserremoval/purgingbeforeitprocessesanygroupremoval/purging.Errorinlog:= precode {noformat} Error:/Group[vagrant]/ensure:changefrompresenttoabsentfailed:Couldnotdeletegroupvagrant:Executionof'/usr/sbin/groupdelvagrant'returned8:groupdel:cannotremovetheprimarygroupofuser'vagrant' /pre/code {noformat} (notethatvagrantwasnotloggedin)(ThiswasonanUbuntu12.04server)Iteration#1(failed):=== precode {noformat} resources{'user':purge=true,unless_system_user=false,}resources{'group':purge=true,unless_system_user=false,} /code/pre {noformat} Iteration#2(failed):=== precode {noformat} resources{'user':purge=true,unless_system_user=false,before =Resources['group'],}resources{'group':purge=true,unless_system_user=false,} /code/pre {noformat} Iteration#3(failed):=== precode {noformat} resources{'user':purge=true,unless_system_user=false,}resources{'group':purge=true,unless_system_user=false,require =Resources['user'],} /code/pre {noformat} Iteration#4(failed):=== precode {noformat} resources{'user':purge=true,unless_system_user=false,before =Resources['group'],}resources{'group':purge=true,unless_system_user=false,require =Resources['user'],} /code/pre {noformat} Iteration#5(failed):=== precode {noformat} resources{'user':purge=true,unless_system_user=false,}resources{'group':purge=true,unless_system_user=false,}Resources['user']-Resources['group'] /code/pre {noformat} Iteration#6(failed):=== precode {noformat} resources{'user':purge=true,unless_system_user=false,before =Resources['group'],}resources{'group':purge=true,unless_system_user=false,require =Resources['user'],}Resources['user']-Resources['group'] /code/pre {noformat}
Add Comment
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Daniel Dreier commented on an issue Re: Incorrect ordering of group and user resource purging Using the puppetlabs ubuntu 12.04 vagrant box, I'm able to run the iteration 1 manifest from the issue description, with puppet 3.4.2. The only areas where it fails is when it produces the cannot remove the primary group of user error is when the user couldn't be deleted because it was logged in or had running processes. Purging all system users will cause this issue because some of those system users typically have a process running. Note that attempting to purge all system users typically renders the system unusable. Can you provide a more complete puppet manifest that reproduces the incorrect ordering issue you described, ideally with a vagrant config to reproduce the environment in which it occurs? Add Comment Puppet / PUP-1153 Incorrect ordering of group and user resource purging I am using the following below code to purge/remove all unmanaged (to Puppet) users and groups on a system so that only OS groups and users I allow can exist. I receive errors in my log though because Puppet will attempt to remove a (primary) group before it removes the corresponding user. Although a subsequent run has no errors (the user was eventual... This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede)
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title
Daniel Dreier commented on an issue
Re: Incorrect ordering of group and user resource purging
I did further testing and identified what appears to be a provider issue. This may be a different issue from the reported ordering issue, which I cannot reproduce.
The correct way to do what the original reporter intended to do is to generate a list of users and groups via the puppet resource user and puppet resource group commands, add that to your manifest, then remove the users and groups you don't want. The manifest below is an example. However, solving the problem that way produces incorrect error messages.
Using the puppetlabs ubuntu 12.04 vagrant box and the following manifest, errors like the below are produced even though those groups and users are purged correctly. {noformat] Error: /Stage[main]/Main/Group[proxy]/ensure: change from present to absent failed: Could not delete group proxy: Execution of '/usr/sbin/groupdel proxy' returned 8: groupdel: cannot remove the primary group of user 'proxy'
Below is a manifest that defines most but not all users and groups that are included with ubuntu 12.04 out of the box. The expected behavior is that the mail, irc, sync, backup, gnats, news, uucp, www-data, games, list, proxy, and lp users are removed, as well as the dialout, voice, fuse, floopy, fax, news, mail, irc, sync, backup, gnats, news, uucp, www-data, games, list, proxy, and lp groups.
I suspect that the issue is that userdel on ubuntu (and I think centos) will delete a user's primary group if no other users belong to the group. When the users are purged, the groups are implicitly purged as well but no output is displayed to show that to be the case. The groups are then purged with groupdel and errors result when groupdel tries to remove the groups previously implicitly removed by userdel.
testcase.pp resources { 'user': purge = true, unless_system_user = false, }
resources { 'group': purge = true, unless_system_user = false, }
user { 'bin': ensure = 'present', comment = 'bin', gid = '2', home = '/bin', password = '*', password_max_age = '9', password_min_age = '0', shell = '/bin/sh', uid = '2', }
user { 'daemon': ensure = 'present', comment = 'daemon', gid = '1', home = '/usr/sbin', password = '*', password_max_age = '9', password_min_age = '0', shell = '/bin/sh', uid = '1', }
user { 'libuuid': ensure = 'present', gid = '101', home = '/var/lib/libuuid', password = '!', password_max_age = '9', password_min_age = '0', shell = '/bin/sh', uid = '100', }
user { 'man': ensure = 'present', comment = 'man', gid = '12', home = '/var/cache/man', password = '*', password_max_age = '9', password_min_age = '0', shell = '/bin/sh', uid = '6', }
user { 'messagebus': ensure = 'present', gid = '105', home = '/var/run/dbus', password = '*', password_max_age = '9', password_min_age = '0', shell = '/bin/false', uid = '102', }
user { 'nobody': ensure = 'present', comment = 'nobody', gid = '65534', home = '/nonexistent', password = '*', password_max_age = '9',
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title Charlie Sharpsteen assigned an issue to Charlie Sharpsteen Puppet / PUP-1153 Incorrect ordering of group and user resource purging Change By: Charlie Sharpsteen Assignee: CharlieSharpsteen Add Comment This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups Puppet Bugs group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/groups/opt_out.
Jira (PUP-1153) Incorrect ordering of group and user resource purging
Title: Message Title
redmine.exporter created an issue
Puppet / PUP-1153
Incorrect ordering of group and user resource purging
Issue Type:
Bug
Assignee:
Unassigned
Created:
17/Dec/13 2:53 PM
Labels:
redmine
Priority:
Normal
Reporter:
redmine.exporter
I am using the following below code to purge/remove all unmanaged (to Puppet) users and groups on a system so that only OS groups and users I allow can exist.
I receive errors in my log though because Puppet will attempt to remove a (primary) group before it removes the corresponding user. Although a subsequent run has no errors (the user was eventually purged) I am left with undesired groups until I run Puppet again. The current work around is to run Puppet multiple times and modify monitoring scripts to ignore the group deletion errors.
Attempts at using before, require, -, etc. notation do not cause the desired order (purge users then groups).
I'd propose that Puppet be modified such that it either honors the specified ordering or as a rule always processes user removal/purging before it processes any group removal/purging.
Error in log: = precodeError: /Group[vagrant]/ensure: change from present to absent failed: Could not delete group vagrant: Execution of '/usr/sbin/groupdel vagrant' returned 8: groupdel: cannot remove the primary group of user 'vagrant'/pre/code
(note that vagrant was not logged in) (This was on an Ubuntu 12.04 server)
Iteration # 1 (failed): === precode resources { 'user': purge =
