Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We use Active Directory (2003 and 2008) for all our users (70% Linux, 30% Windows). Normal user authentication works fine. I now have a situation where on a particular server I need to restrict the users that can login to members of a particular group in ADS. So I created the group and added the users in. Then I set in pam_ldap.conf

pam_groupdb cn=<group>,ou=Applications,dc=<domain>,dc=<tld>


pam_member_attribute memberOf

However, this does not seem to make any difference. I stopped nscd (just in case), but I can still log in using credentials of a user who is not a member of this group. Does anybody have experience with this?

There are other workarounds, but they are rather ugly and I would prefer not having to use them (e.g. extract all users via ldapsearch in a cron job and then put them into a list of allowed users, etc...). Oh, yes, I can see the members of this group just fine using ldapsearch. And I can see individual user's group memberships just fine, also using ldapsearch. I have put sshd on that server into debug mode, but the logs don't reveal anything useful. Any pointers would be highly appreciated.

share|improve this question
What type of AD integration are you using? LDAP or Winbind? – sysadmin1138 Apr 11 '11 at 13:33
Feels like you need to look into a LOCAL POLICIES of that particular Windows server. There's a setting which will prevent the users to login to the server if they're specifically denied that right. It's located at "Local Security Policy" -> "Local Policies" -> "Security Options" -> "Network Accces: ....". There's a plenty of settings there. (Hope I correctly understood your question. – Vick Vega Apr 11 '11 at 13:39
This server is using LDAP. – wolfgangsz Apr 11 '11 at 14:41

We only have a handful of Linux servers here and even less users which should shell into them. Still, I joined the Linux boxes to our domain using Winbind and this documentation (PDF warning). I created a group in AD "linuxserveradmins" and populated it accordingly.

From my /etc/pam.d/common-account:

account required user ingroup linuxserveradmins

Also, from /etc/sudoers, if you're interested:

# Group
%linuxserveradmins ALL=(ALL) ALL
share|improve this answer
Does this only work with winbind? – wolfgangsz Apr 11 '11 at 14:41
@wolfgangsz All my Linux boxes are joined to AD via winbind. I haven't a LDAP-only config to test with, sorry. You could logon as a domain user and issue a groups command to enumerate the user's groups. Should the domain group(s) be listed there, I suspect PAM+LDAP should honor the above rule. – jscott Apr 11 '11 at 14:49
Hmm, but they are not listed. Even when I set the UNIX attributes for the group in AD, and add the relevant members, it still doesn't show the AD group. Might have to use winbind after all. Dang... – wolfgangsz Apr 11 '11 at 15:18
We used something similar, but had purchased Quest Authentication System that made AD groups available under Linux. Then the above commands work as expected. Logins require membership in a specific group that is defined in AD. – zerolagtime Apr 12 '11 at 3:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.