Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our company has a central NIS configuration that we are using to access our teams servers (Redhat)...

The current configuration allows all valid NIS authenticated users to connect to our servers. We cannot update or change something on the NIS Master Server... so...

Is there a way to use netgroups or some other configuration to allow our team members to authenticate using the NIS server but still restrict access to all other users?

Thanks!

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Is there a way to use netgroups or some other configuration to allow our team members to authenticate using the NIS server but still restrict access to all other users?

That is pretty much why netgroups exist.

The easiest solution to do what you want is to use the compat functionality of nsswitch.conf. This is documented -- briefly and poorly -- in nsswitch.conf(5):

Interaction with +/- syntax (compat mode)

...In /etc/passwd you could have entries of the form +user or +@netgroup (include the specified user from the NIS passwd map), -user or -@netgroup (exclude the specified user), and + (include every user, except the excluded ones, from the NIS passwd map).

In practical terms, this means that if your nsswitch.conf looks like this:

passwd: compat

And your /etc/passwd ends with a line like this:

+@myusers

Then only members of the myusers netgroup will be able to authenticate to the system.

You can accomplish something similar using the pam_listfile module in your PAM configuration and creating restrictions based on group (rather than netgroup) membership. This is nice if you have groups and netgroups that you're trying to keep in sync (because now you can just use standard Unix groups). This document has an example of restricting logins to specific groups using pam_listfile.

share|improve this answer
    
I kind of have tried that... I have created the file /etc/netgroup where I have TeamUsers: (,username1,) then updated the /etc/passwd adding a new line at the end of the file like +@TeamUsers and finally updated the /ets/nssconfig with passwd: compat intead of passwd: files nis. After that no user can access the system!!! Maybe there is something wrong in the way I defined the netgroup?? –  sdmythos_gr Feb 8 '11 at 15:38
    
Just creating /etc/netgroup isn't going to get you anything. The netgroups have to be defined in NIS. If you don't control the NIS servers and you can't get the netgroups created for you you will need to use the PAM mechanism instead. –  larsks Feb 8 '11 at 15:45
    
Thank you! We found a working solution using the pam_listfile module after all! –  sdmythos_gr Feb 9 '11 at 12:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.