Linux authentication via ADS — allowing only specific groups in PAM

Question

I'm taking the samba / winbind / PAM route to authenticate users on our linux servers from our Active Directory domain.

Everything works, but I want to limit what AD groups are allowed to authenticate. Winbind / PAM currently allows any enabled user account in the active directory, and pam_winbind.so doesn't seem to heed the require_membership_of=MYDOMAIN\\mygroup parameter. Doesn't matter if I set it in the /etc/pam.d/system-auth or /etc/security/pam_winbind.conf files.

How can I force winbind to honor the require_membership_of setting? Using CentOS 5.5 with up-to-date packages.

Update: turns out that PAM always allows root to pass through auth, by virtue of the fact that it's root. So as long as the account exists, root will pass auth. Any other account is subjected to the auth constraints.

Update 2: require_membership_of seems to be working, except for when the requesting user has the root uid. In that case, the login succeeds regardless of the require_membership_of setting. This is not an issue for any other account. How can I configure PAM to force the require_membership_of check even when the current user is root?

Current PAM config is below:

auth sufficient pam_winbind.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so

account sufficient pam_winbind.so
account sufficient pam_localuser.so
account required pam_unix.so broken_shadow

password ..... (excluded for brevity)

session required pam_winbind.so
session required pam_mkhomedir.so skel=/etc/skel umask=0077
session required pam_limits.so
session required pam_unix.so

require_memebership_of is currently set in the /etc/security/pam_winbind.conf file, and is working (except for the root case outlined above).

Answer 1

You may have better luck referring to the group by SID.

Look up the SID for a group:

wbinfo -n "mygroup"

Then set require_membership_of using the SID (determined from wbinfo)

require_membership_of=S-1-5-21-1757981276-1399067357-839522115-75638

Answer 2

In our setup this is restricted by the following line in the file /etc/security/pam_lwidentity.conf:

require_membership_of = OURDOMAIN\domain^admins

Answer 3

In this situation, I cheated and used pam_access instead of banging my head further against pam_winbind.

Answer 4

Can you use the global catalog port of your AD server? speaks LDAP protocol, probably on port 3268 (or 3269 for encrypted ldaps).

I find it's easier, faster, and far more reliable to use the ldap auth & nsswitch modules than winbind, and also (as suggested by Handyman5 above), use pam_access and edit /etc/security/access.conf to control who is allowed to login.