Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have integrated PAM with LDAP authentication. Q- how to restrict login for some users to some Linux servers.

For example- we have integrated 100 Linux servers in the Org with PAM LDAP auth and we have around 600users are there in the LDAP and now we need to restrict some accounts to some Linux servers. currently all users are able to login to all the Linux servers.

Please let me know if you have any solution for this problem. Please share with me the steps to do it also. Thank you

share|improve this question

4 Answers 4

In ldap you can set host which availible to login. Also you can create group and set access for login on specific system.

share|improve this answer

If there are just few users to login, you could append this to your /etc/passwd

+user1::::::/bin/bash
+user2::::::/bin/bash
+::::LDAP user::/usr/sbin/nologin

This will overwrite GECOS with "LDAP user" and everyone except user{1,2} has /usr/sbin/nologin .

Another solution would be to use /etc/security/access.conf have a look to this post: http://serverfault.com/a/229131/11340

share|improve this answer

I use SSSD and then put a ldap_access_filter line in the conf file like so:

...
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap
...
ldap_access_filter = memberOf=CN=IT,CN=Users,DC=example,DC=com
share|improve this answer

Strictly speaking, this is an access control question, not an authentication question. Your best solution would be to use pam_access. See the access.conf(5) man page. You should create groups or netgroups in LDAP, then include

+: (groupname) @netgroupname: ALL
-: ALL: ALL

in /etc/security/access.conf.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.