Each time nxserver-freenx gets remerged it re-creates the nx user record. This imposes 2 problems: 1. A secure ssh setup assumes that all users which allowed remote ssh access are added to a dedicated group (or groups) and ssh access (through sshd_config.conf) is limited to this group(s) only. Thus nx user most belong to such a group. Each time nxserver-freenx is remerged a system administrator needs manually restore nx user membership. 2. Re-creating nx user could migrate this user from one database to another (e.g. from /etc/passwd to LDAP) which is usually a wrong thing to do. Even worse, it may get unnoticed by a system administrator. IMO, a better solution would be to take alone the nx user if it already exists and belongs to the nx group. Please consider this problem. Thank you in advance. Reproducible: Always Steps to Reproduce: 1. emerge net-misc/nxserver-freenx Actual Results: [timestamp] [host] usermod[pid]: delete 'nx' from group [group] [timestamp] [host] usermod[pid]: delete 'nx' from shadow group '[group]' emerge --info Portage 2.1.6.7 (default/linux/amd64/2008.0, gcc-4.1.2, glibc-2.9_p20081201-r2, 2.6.28.7-alb x86_64) ================================================================= System uname: Linux-2.6.28.7-alb-x86_64-Dual_Core_AMD_Opteron-tm-_Processor_285-with-glibc2.2.5 Timestamp of tree: Sat, 14 Mar 2009 19:45:01 +0000 app-shells/bash: 3.2_p39 dev-java/java-config: 1.3.7-r1, 2.1.7 dev-lang/python: 2.5.2-r7 dev-util/cmake: 2.6.2-r1 sys-apps/baselayout: 1.12.11.1 sys-apps/sandbox: 1.2.18.1-r2 sys-devel/autoconf: 2.13, 2.63 sys-devel/automake: 1.4_p6, 1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.2 sys-devel/binutils: 2.18-r3 sys-devel/gcc-config: 1.4.0-r4 sys-devel/libtool: 1.5.26 virtual/os-headers: 2.6.28-r1 ACCEPT_KEYWORDS="amd64" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-combine -march=opteron -momit-leaf-frame-pointer -Os -pipe -fomit-frame-pointer -finline-functions-called-once -ftree-vectorize" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /var/lib/hsqldb" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/splash /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c /etc/udev/rules.d" CXXFLAGS="-combine -march=opteron -momit-leaf-frame-pointer -Os -pipe -fomit-frame-pointer -finline-functions-called-once -ftree-vectorize" DISTDIR="/usr/portage/distfiles" FEATURES="distlocks fixpackages parallel-fetch protect-owned sandbox sfperms strict unmerge-orphans userfetch" GENTOO_MIRRORS="http://mirror.yandex.ru/gentoo-distfiles/ http://trumpetti.atm.tut.fi/gentoo/ http://mirror.qubenet.net/mirror/gentoo/ ftp://mirror.yandex.ru/gentoo-distfiles/" LANG="en_US.utf8" LC_ALL="" LDFLAGS="-Wl,-O1" LINGUAS="en ru" MAKEOPTS="-j8" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage" SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage" USE="3dnow 3dnowext X acl acpi alsa amd64 bash-completion berkdb bidi bzip2 caps cdr cjk cli cracklib crypt cscope cups dbus djvu dri dvd dvdr dvdread fortran gdbm gif gnome gpm gtk hal hardened iconv ieee1394 isdnlog jpeg jpeg2k kerberos lcms ldap ldapsam lm_sensors loop-aes midi mmap mmx mudflap multilib ncurses nls nptl nptlonly nsplugin opengl openmp pam pcre perl png pppd python readline reflection samba session spl sse sse2 ssl sysfs tcpd threads tiff truetype unicode usb winbind xorg xulrunner zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="keyboard mouse joystick vmmouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en ru" USERLAND="GNU" VIDEO_CARDS="nvidia fbdev vesa vga" Unset: CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
In fact the nx user is not re-created if it already exists (that's the behaviour of enewuser) However some time ago I added the following usermod command in pkg_postint: "usermod -G utmp nx" which indeed resets the additional groups! I've changed it to "usermod -a -G utmp nx" so it only appends the additional group if missing. Fixed in net-misc/nxserver-freenx-0.7.3_p102 ebuild in CVS, thanks for the report!
