We run AD on server 2008. It has been determined that we won't install services for unix. Knowing that is it possible to limit user access to linux machines based on security groups using only LDAPS? I've installed pam_ldap and have it working successfully for authentication:
uri ldaps://dcs-test01.test.com/
ssl on
tls_cacertdir /etc/openldap/cacerts
pam_password md5
pam_login_attribute name
binddn cn=svc_lab,ou=Service,ou=Users,dc=test,dc=com
bindpw *****
I've tested with a few other PAM options but can't get it to limit based just on the security group. The option seems most promising is:
pam_groupdn CN=TestSecGrp,DC=test,DC=com
But so far it's not working. I have two users one that is a member of that security group and one that is not. Both are still able to authenticate.
Is this the right variable to modify? Thoughts on if this is possible? Anything obvious missing?
We are also looking at likewise & winbind but that isn't a part of this question/evaluation.
accountcheck and show up if you try toidthem) - it's the authorization/password check that will fail. Crank up debugging and double-check your logs to see what's going on -- that may provide more troubleshooting clues. – voretaq7♦ Aug 19 '11 at 21:50