capacity = (SUB_GID_MAX - SUB_GID_MIN) / SUB_GID_COUNT

        SUB_GID_COUNT  4096
        SUB_GID_MIN    100000
        SUB_GID_MAX    10000000

Only effective when SUB_GID_DETERMINISTIC is set to yes.

When set to yes (WRAP MODE), allows the deterministic range calculation to wrap around using modulo arithmetic when a UID would overflow the configured subordinate ID space. The subordinate ID space is treated as a ring buffer.

WARNING: Range overlaps can lead to container escapes and privilege escalation. For example, with SUB_GID_MIN=100000, SUB_GID_MAX=200000, SUB_GID_COUNT=65536, User A (UID 1000) gets range [100000, 165535] and User B (UID 1001) wraps and overlaps with User A. User B's container can now access files from User A's containers.

Use only in development, testing, or tightly constrained lab environments.

When set to no (default), any arithmetic overflow or range exceeding SUB_GID_MAX is a hard error. This guarantees non-overlapping, monotonic allocation.

The default value for UNSAFE_SUB_GID_DETERMINISTIC_WRAP is no.

The default values for SUB_UID_MIN, SUB_UID_MAX, SUB_UID_COUNT are respectively 100000, 600100000 and 65536.

      start = SUB_UID_MIN + ((UID - UID_MIN) * SUB_UID_COUNT)
      end   = start + SUB_UID_COUNT - 1

This ensures the same UID always receives the same subordinate UID range on every system, making it suitable for environments with centralized user management (LDAP, NIS, etc.) or synchronized UIDs across systems.

If SUB_UID_DETERMINISTIC is enabled, you can use usermod --add-subuids -S to produce deterministic subuids.

WARNING: Because UID_MIN is used to calculate the ranges, any change of UID_MIN will change the ranges calculated. SUB_UID_COUNT is used to calculate the ranges, any change of SUB_UID_COUNT will change the ranges calculated. Users with identities less than UID_MIN are incompatible with SUB_UID_DETERMINISTIC, but can still be set manually.

WARNING: Do not mix deterministic and linear (default) allocation on the same system or across systems sharing /etc/subuid via network storage (NFS, etc.). Mixing allocation methods will cause subordinate ID range conflicts and overlaps .

The default value for SUB_UID_DETERMINISTIC is no.

      capacity = (SUB_UID_MAX - SUB_UID_MIN) / SUB_UID_COUNT

        SUB_UID_COUNT  4096
        SUB_UID_MIN    100000
        SUB_UID_MAX    10000000

Only effective when SUB_UID_DETERMINISTIC is set to yes.

When set to yes (WRAP MODE), allows the deterministic range calculation to wrap around using modulo arithmetic when a UID would overflow the configured subordinate ID space. The subordinate ID space is treated as a ring buffer.

WARNING: Range overlaps can lead to container escapes and privilege escalation. For example, with SUB_UID_MIN=100000, SUB_UID_MAX=200000, SUB_UID_COUNT=65536, User A (UID 1000) gets range [100000, 165535] and User B (UID 1001) wraps and overlaps with User A. User B's container can now access files from User A's containers.

Use only in development, testing, or tightly constrained lab environments.

When set to no (default), any arithmetic overflow or range exceeding SUB_UID_MAX is a hard error. This guarantees non-overlapping, monotonic allocation.

The default value for UNSAFE_SUB_UID_DETERMINISTIC_WRAP is no.

The default value for SYS_GID_MIN (resp. SYS_GID_MAX) is 101 (resp. GID_MIN-1).

The default value for SYS_UID_MIN (resp. SYS_UID_MAX) is 101 (resp. UID_MIN-1).

TTYGROUP can be either the name of a group or a numeric group identifier.

If TTYGROUP is not defined, then the group ownership of the terminal is set to the user's primary group. If TTYPERM is not defined, then the permissions are set to 0600.

If you have a write program which is "setgid" to a special group which owns the terminals, define TTYGROUP to the group number and TTYPERM to 0620. Otherwise leave TTYGROUP commented out and assign TTYPERM to either 622 or 600.

The default value for UID_MIN (resp. UID_MAX) is 1000 (resp. 60000).

useradd and newusers use this mask to set the mode of the home directory they create if HOME_MODE is not set.

It is also used by pam_umask as the default umask value.

The return code of the script is not taken into account.

Here is an example script, which removes the user's cron, at and print jobs:

#! /bin/sh
# Check for the required argument.
if [ $# != 1 ]; then
	echo "Usage: $0 username"
	exit 1
fi
# Remove cron jobs.
crontab -r -u $1
# Remove at jobs.
# Note that it will remove any jobs owned by the same UID,
# even if it was shared by a different username.
AT_SPOOL_DIR=/var/spool/cron/atjobs
find $AT_SPOOL_DIR -name "[^.]*" -type f -user $1 -delete \;
# Remove print jobs.
lprm $1
# All done.
exit 0

With a high cost factor, it is more difficult to brute force the password. But note also that more CPU resources will be needed to authenticate users.

The value must be inside the 1-11 range.

Note: this only affect the generation of group passwords. The generation of user passwords is done by PAM and subject to the PAM configuration. It is recommended to set this variable consistently with the PAM configuration.