Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The context

I'd like to restrict some AD users to a specific script, limiting what they can do on this particular machine.

So, instead of connecting them with /bin/bash (for instance), I'd like to force them to use /path/to/my/script. Those users are in a specific AD group.

Other people should be able to use the real shell.

The classic way

If those users where local users, I would just change the shell field in /etc/passwd.

The sssd way

Is there a way to provide a different shell value only for the members of that group?

If not, how would you do it?

share|improve this question

2 Answers 2

You probably can't do it to a group, but you can change the shell per user in AD for SSSD. Go into the actual Object attributes using ADSI Edit and change the "loginShell" attribute for the user. Alternatively, you might look into using Puppet to bring GPO like stuff to Linux and perhaps manage it there (I'm not sure that is possible though).

share|improve this answer
    
I don't think you can use puppet or any other config software tout change the way NSS behave. I know I could tell which shell to use in the loginShell attribute but I can't use this method: the user may need a real shell on other machines; and I would prefer to not install the msSFU AD extension (which provides the needed attribute, right?) –  Christophe Drevet Feb 22 at 13:40
2  
Umm, I believe the attribute exists, and msSFU just gives you a UI other than ADSI edit. Server 2008 and newer are RFC compliant there (I'm pretty sure, as I have server 2008R2 and no SFU installed and I use the attributes all the time for SL6 clients) –  jmp242 Feb 24 at 13:12
    
OK. So your answer is valid as long as the user does not have to connect to another machine with a real shell or a different shell script. –  Christophe Drevet Feb 24 at 14:12

One way to achieve this goal is to declare several domains, restricting the first ones to just the members of a given group.

[sssd]
config_file_version = 2
services = nss, pam
domains=DOMAIN_GROUP1,DOMAIN_GROUP2,DOMAIN

[nss]
default_shell = /bin/bash

[domain/DOMAIN_GROUP1]
id_provider = ad
# Domain
ad_domain = domain.local
# Servers
ad_server = dc01.domain.local,dc02.domain.local,dc03.domain.local
# Restrict to group members
ldap_user_search_filter = (memberOf=CN=group1,OU=Groups,DC=domain,DC=local)
# Shell
override_shell = /shell/path/for/group1

[domain/DOMAIN_GROUP2]
id_provider = ad
# Domain
ad_domain = domain.local
# Servers
ad_server = dc01.domain.local,dc02.domain.local,dc03.domain.local
# Restrict to group members
ldap_user_search_filter = (memberOf=CN=group2,OU=Groups,DC=domain,DC=local)
# Shell
override_shell = /shell/path/for/group2


[domain/DOMAIN]
id_provider = ad
# Domain
ad_domain = domain.local
# Servers
ad_server = dc01.domain.local,dc02.domain.local,dc03.domain.local

Members of group1 use /shell/path/for/group1, members of group2 use /shell/path/for/group2, all other DOMAIN users use /bin/bash

A downside is if a user is a member of both groups: it will always fall in the first "domain" DOMAIN_GROUP1.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.