1

I have integrated PAM with LDAP authentication. Q- how to restrict login for some users to some Linux servers.

For example- we have integrated 100 Linux servers in the Org with PAM LDAP auth and we have around 600users are there in the LDAP and now we need to restrict some accounts to some Linux servers. currently all users are able to login to all the Linux servers.

Please let me know if you have any solution for this problem. Please share with me the steps to do it also. Thank you

4 Answers 4

0

In ldap you can set host which availible to login. Also you can create group and set access for login on specific system.

0

If there are just few users to login, you could append this to your /etc/passwd

+user1::::::/bin/bash
+user2::::::/bin/bash
+::::LDAP user::/usr/sbin/nologin

This will overwrite GECOS with "LDAP user" and everyone except user{1,2} has /usr/sbin/nologin .

Another solution would be to use /etc/security/access.conf have a look to this post: https://serverfault.com/a/229131/11340

0

I use SSSD and then put a ldap_access_filter line in the conf file like so:

...
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap
...
ldap_access_filter = memberOf=CN=IT,CN=Users,DC=example,DC=com
0

Strictly speaking, this is an access control question, not an authentication question. Your best solution would be to use pam_access. See the access.conf(5) man page. You should create groups or netgroups in LDAP, then include

+: (groupname) @netgroupname: ALL
-: ALL: ALL

in /etc/security/access.conf.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .