UID

reserved UIDs & GIDs

This is most likely not the desired state yet, but just starting out with the current situation on fenari tin. Should be edited to reflect the desired situation, being equal on all servers.

• (table columns are sortable)

UID	GID	user name
33	33	www-data
48	48	apache
107	112	puppet
110	115	nagios
111	116	mwdeploy
444	444	gerrit2
10002	10002	l10nupdate

permission/security hierarchy

the security hierarchy looks as follows as decribed by TimStarling:

• root > wikidev > mwdeploy > www-data
  • root can own wikidev but wikidev can't own root
  • wikidev can own mwdeploy but mwdeploy can't own wikidev
  • scripts owned by mwdeploy can only be run by www-data
  • everything has to su to www-data before running maintenance scripts

also see: task T79786