We run AD on server 2008. It has been determined that we won't install services for unix. Knowing that is it possible to limit user access to linux machines based on security groups using only LDAPS? I've installed pam_ldap and have it working successfully for authentication:

uri ldaps://dcs-test01.test.com/
ssl on
tls_cacertdir /etc/openldap/cacerts
pam_password md5
pam_login_attribute name
binddn cn=svc_lab,ou=Service,ou=Users,dc=test,dc=com
bindpw *****

I've tested with a few other PAM options but can't get it to limit based just on the security group. The option seems most promising is:

pam_groupdn CN=TestSecGrp,DC=test,DC=com

But so far it's not working. I have two users one that is a member of that security group and one that is not. Both are still able to authenticate.

Is this the right variable to modify? Thoughts on if this is possible? Anything obvious missing?

We are also looking at likewise & winbind but that isn't a part of this question/evaluation.

link|improve this question

46% accept rate
Your syntax is correct for pam_groupdn. Note that both users will appear on the system (pass the account check and show up if you try to id them) - it's the authorization/password check that will fail. Crank up debugging and double-check your logs to see what's going on -- that may provide more troubleshooting clues. – voretaq7 Aug 19 '11 at 21:50
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown

Browse other questions tagged or ask your own question.