Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want only user "theuser" to login to this host.

I have tried the following in nslcd.conf:

pam_authz_search (&(objectClass=posixAccount)(IsActive=TRUE)(uid=theuser))

but all can login. If instead of pam_authz_search I use the "filter" command, it works, but getent returns only one user, the "theuser".

UPDATE: OS is ubuntu 12.10, I'm using libpam-ldapd NOT libpam-ldap

share|improve this question

2 Answers 2

up vote 1 down vote accepted

You can control who logs into a server (regardless of the source of the user database) with the /etc/security/access.conf file. For this mechanism, you need to enable the pam_access module (generally for the account stage). Either in /etc/pam.d/common-account for all services, or something like /etc/pam.d/sshd to make it only effective to ssh connections.

Check the man pages for access.conf and pam_access for the details.

share|improve this answer
    
thanks, that's an elegant solution and worked fine :-) –  sivann Jan 30 '13 at 9:56

For a RHEL6 for example:

edit the /etc/pam_ldap.conf with something like:

pam_filter |(uid=myuid)

and leave the /etc/nslcd.conf unmodified. This will allow you to browse all users using "id someuser" but only allow "myuid" to login.

share|improve this answer
    
sorry no /etc/pam_ldap.conf is used in this library. –  sivann Jan 30 '13 at 10:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.