How to allow a certain group of useres to only login via LDAP while others can use LDAP or local login?

Question

I managed to set up my system to use either LDAP or the local password (by adding "password sufficient pam_ldap.so" to PAM and calling "pam_unix2.so" afterwards). However I would like to restrict a certain group of users to be able to only use LDAP and not have the fallback of pam_unix2.so. Is there way of doing this?

Answer 1

Create a group called ldaponly and put all of your LDAP-only users into it. Then, in your PAM configuration, use the pam_succeed_if module to skip the pam_unix2 module when the user is in the ldaponly group.

Answer 2

umm... perhaps this is too simple, but put the users in LDAP & don't put them in your local password file?

In my environment only root and service/daemon accounts are in the local passwd file, and only user login accounts are in LDAP -- Works beautifully.

Answer 3

The easiest way I can think of right now is to set the local passwords for the "LDAP only" users to something completely weird and not tell them. However, once they have logged in, they would be able to change it (if your PAM setup allows them to do so).

A much more sophisticated way would be to write your own PAM plugin (which is apparently not all that difficult to do) which could perform a lookup into a "LDAP only" list and then return either true or false. This could then be used in the PAM config files to decide the next step, i.e. allow login or not.

Answer 4

Iv ran into this Situation Before with an ldap server i had setup.The best way i can advice(which worked for me)would be to use the /etc/security/access.conf and allowing certain users and groups access. eg.

- : ALL EXCEPT root Group1 Group2: 127.0.0.1

This Will Deny Everyone access except for root and Everyone who belongs to Group1 and Group2 trying to login localy/using 127.0.0.1 interface.

you might need to enable pam_access.so module in ur pam files.

Hope this Works for you.