Best way to control access?

Question

I have a few servers that serve different purposes (and thus different users use each) that authenticate to an LDAP server (I do not have permission to modify content on the LDAP server). What is an effective way to manage access across these servers so not all LDAP users can authenticate? I've thought of using a secondary LDAP server to provide the groups and use the primary server solely for authentication, but I haven't seen any documentation to do so and I haven't found any simple UI for it either. Optimally, the access management could also be done via a UI of some sort so less terminal-inclined users can change user groups as well.

Answer 1

I would suggest using the pam_access.so module which allows you to restrict access based on ldap_group,local-group,ldap_user,local_users.

vi /etc/pam.d/common-account   ** depending on which distro the client Server is

account required    pam_access.so

vi /etc/security/access.conf

+ : ALL : LOCAL
- : ALL EXCEPT LDAP_GROUP1 LOCAL_GROUP1 LocalUser ldap_User : ALL

** this would deny everyone except for ldap_group1,local_group1,LocalUser,ldap_User