Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

How to remove a self created daemon user named '_denyhosts' from group 1025(workgroup), 403(com.apple.sharepoint.group.2), 404(com.apple.sharepoint.group.3) and 405(com.apple.sharepoint.group.4) using Lion Terminal?

Background

To create a reduced privileged daemon user account, to run denyhosts.py using launchd, the example on http://www.minecraftwiki.net/wiki/Tutorials/Create_a_Mac_OS_X_startup_daemon has been helpful.

However the created Lion daemon user account "_denyhosts" seems to have to many groups assigned:

$ id _denyhosts
uid=300(_denyhosts) gid=300(_denyhosts) groups=300(_denyhosts),1025(workgroup),12(everyone),61(localaccounts),403(com.apple.sharepoint.group.2),404(com.apple.sharepoint.group.3),405(com.apple.sharepoint.group.4) 

In my opinion the groups membership of:

  1. 1025(workgroup)
  2. 403(com.apple.sharepoint.group.2)
  3. 404(com.apple.sharepoint.group.3)
  4. 405(com.apple.sharepoint.group.4)

can be removed.

I have been trying to accomplish to remove the user its groups memberships using:

$ dscl . -delete /Groups/workgroup GroupMembership _denyhosts
delete: Invalid Path
<dscl_cmd> DS Error: -14009 (eDSUnknownNodeName)

$ dscl . -delete /groups/workgroup GroupMembership _denyhosts
delete: Invalid Path
<dscl_cmd> DS Error: -14009 (eDSUnknownNodeName)

$ sudo dscl . delete /Groups/workgroup GroupMembership _denyhosts
delete: Invalid Path
<dscl_cmd> DS Error: -14009 (eDSUnknownNodeName)

$ sudo dseditgroup -o edit -d _denyhosts -t user workgroup
Username and password must be provided.

I guess that these commands fail because group "workgroup" is not located in a local directory but an LDAP directory:

$ dseditgroup -o -read workgroup | grep AppleMetaNode -A 1
dsAttrTypeStandard:AppleMetaNodeLocation -
        /LDAPv3/127.0.0.1

But that is not all, because com.apple.sharepoint.group groups are /Local/Default, there $ sudo dseditgroup -o edit -d _denyhosts -t user com.apple.sharepoint.group.2 doesn't output an error, but also doesn't remove the _denyhosts user from the group:

$ id _denyhosts
uid=300(_denyhosts) gid=300(_denyhosts) groups=300(_denyhosts),1025(workgroup),12(everyone),61(localaccounts),403(com.apple.sharepoint.group.2),404(com.apple.sharepoint.group.3),405(com.apple.sharepoint.group.4)

http://superuser.com/questions/279891/list-all-members-of-a-group-mac-os-x helped to know that group membership can also be assigned by inheritance. Guess is that such inherited membership is what happens here.

$ dscl . -read /Groups/com.apple.sharepoint.group.2 | grep NestedGroupsNestedGroups
NestedGroupsNestedGroups: ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000050 ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000C
share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.