diff --git a/continuousintegration/docker/ctafrontend/cc7/config/ctaeos/etc/xrd.cf.mgm b/continuousintegration/docker/ctafrontend/cc7/config/ctaeos/etc/xrd.cf.mgm
index c6ef4c0d1ca9f10f3a8bb9f6d2ecba64dcd2d2b0..1700b6da301e12c64639fae150de08e58ed88cc2 100644
--- a/continuousintegration/docker/ctafrontend/cc7/config/ctaeos/etc/xrd.cf.mgm
+++ b/continuousintegration/docker/ctafrontend/cc7/config/ctaeos/etc/xrd.cf.mgm
@@ -21,9 +21,13 @@ sec.protocol sss -c /etc/eos.keytab -s /etc/eos.keytab
 #sec.protocol krb5 host/<host>@CERN.CH
 sec.protocol krb5 /etc/eos.krb5.keytab eos/eos-server@TEST.CTA
 
-sec.protbind localhost.localdomain unix sss
-sec.protbind localhost unix sss
-sec.protbind * only sss unix krb5
+#sec.protbind localhost.localdomain unix sss
+#sec.protbind localhost unix sss
+# wrong order: can only get empty files owned by the correct user or 
+# files with data belonging to nobody...
+#sec.protbind * only sss unix krb5
+# krb5 first then the rest and I believe that we do not need unix
+sec.protbind * only krb5 sss
 ###########################################################
 mgmofs.fs /
 mgmofs.targetport 1095