Locally deny login to users authenticated via LDAP

Question

I have a RedHat Linux server that are is use for more than 1000 users

Users names are coming to the server via LDAP protocol, so login authentication is from the LDAP

My question: is it possible to block user login on the local machine, while users names come from LDAP?

yep I use LDAP , and I see that from the /var/log/secure and LDAP files -:) — maihabunash, Feb 24, 2015 at 15:41

jmp242 · Accepted Answer · 2015-02-24 15:49:17Z

2

answered Feb 24, 2015 at 15:49

jmp242

6883 silver badges16 bronze badges

may I need to restart the sshd service after config?
– maihabunash
Feb 24, 2015 at 16:23
what is the diff between group name to user name - or maybe they are the same ? , because I want to block username
– maihabunash
Feb 24, 2015 at 16:27
If you follow the suggestion to man pam_listfile, you'll see: apply=username is how to limit to a specific user...
– jmp242
Feb 24, 2015 at 18:24

Add a comment |

c4f4t0r · Accepted Answer · 2015-02-24 16:03:16Z

0

you can use DenyUsers or if you want to deny a group DenyGroups in /etc/ssh/sshd_config

answered Feb 24, 2015 at 16:03

c4f4t0r

5,4113 gold badges32 silver badges44 bronze badges

can you advice how? or give example?
– maihabunash
Feb 24, 2015 at 16:12
DenyUsers user01 in and after you edit /etc/ssh/sshd_config reload the ssh service
– c4f4t0r
Feb 24, 2015 at 16:36

Add a comment |

Mansur Ul Hasan · Accepted Answer · 2016-09-29 17:41:19Z

0

You can follow below steps

This can be done per servers using PAM module.

root@test-login:~# vim /etc/ssh/sshd_config

add below line

DenyUsers ldapuser1 ldapuser2 ldapuser3

DenyGroups ldapgroup1 ldapgroup2

Save the file and restart ssh services

root@test-login:~# service ssh restart

And try now

answered Sep 29, 2016 at 17:41

Mansur Ul Hasan

2723 silver badges9 bronze badges

1

Yes, there are PAM modules that allow for this behavior, but sshd is not pam module.
– 84104
Sep 29, 2016 at 19:03

Add a comment |

3 Answers 3