This is every SysAdmin's nightmare of things to do. Basically we want to control who has access to which hosts. As simple it may sound, the problem is to find a scalable and low maintenance(mgmt. overhead) solution. We use bcfg2 for Config Mgmt much like Cfengine & puppet.
Netgroups is very scalable but comes with a huge mgmt overhead. Maintaining hosts, group of hosts, user netgroups(separate from ldpa groups) seems like a very big burden, but is doable.
ldap.conf (go to the post by jmozdzen on 1st July) and LDAp based access control. We could template the ldap.conf for each host and create a group with hostname and members as users. But the downside is you cannot specify ldap group(team of users) for access but only individually.
sshd_config restriction. But that doesn't work if the users log in natively.
Host attribute check. By un-commenting pam_check_host_attr in ldap.conf and add the hostname to each user works well, but automation is not easy.
Anybody has a different approach to this problem and that scales well and automated?