pam_check_host_attr not working properly

Question

Disclaimer: I'm new to ldap, so hopefully I haven't done anything majorly wrong!

Aim: To centralise user credentials and restrict client login to certain machines.

I have a barebones openLDAP server setup on a fresh Ubuntu 14.04 server by using the following. Essentially, install LDAP and make schema changes to enable the host attribute for users:

# Install ldap
apt-get install -y slapd ldap-utils ldapscripts

# Modify the schema so we can use the host attribute for users
grep -P '^include.+?\.schema' /usr/share/slapd/slapd.conf > ./schema_convert.conf
echo -e "include\t\t/etc/ldap/schema/ldapns.schema" >> ./schema_convert.conf

# Convert the schema into LDIF
mkdir -p ./ldif_output
index=$(slapcat -f ./schema_convert.conf -F ./ldif_output -n 0 | grep ldapns,cn=schema | sed -re 's/^\S+\s+//')
slapcat -f schema_convert.conf -F ldif_output -n0 -H \
  ldap:///${index} -l cn=ldapns.ldif

# Modify the file, ready for importing
sed -i -r \
  -e 's/^dn:.+$/dn: '${index/\{*\}/}'/' \
  -e 's/^cn:.+$/cn: ldapns/' \
  -e '/^(structuralObjectClass|entryUUID|creatorsName|createTimestamp|entryCSN|modifiersName|modifyTimestamp):/d' \
  cn=ldapns.ldif

# Add the schema to the slapd-config
ldapadd -Q -Y EXTERNAL -H ldapi:/// -f cn\=ldapns.ldif

I've added a couple of groups and people. One of my users has the host attribute value set to one of my machines (thor).

On thor and venus I have configured them to authenticate against my ldap server - this works. I have then modified /etc/ldap.conf on thor and venus so this is uncommented:

pam_check_host_attr yes

I had hoped that when I try to login to venus I wouldn't be allowed since the user only has thor set in the host attribute of my ldap server.

Can you provide any insights into how to restrict a user to logging in to only 1 specific host?

Answer 1

It turns out that I had to modify my /etc/nsswitch file as per the instructions in /usr/share/doc/libpam-ldap/README.Debian which states:

If you want to use the "pam_check_host_attr" feature, make sure "pam_unix.so" doesn't provide a valid "account" via the Name Service Switch (NSS), which overrides your LDAP configuration. Don't use "ldap" for "shadow" in /etc/nsswitch.conf, just use "shadow: files".

Therefore, when I changed my /etc/nsswitch file from:

passwd: files ldap
group: files ldap
shadow: files ldap

hosts:          files dns mdns4_minimal [NOTFOUND=return] 
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup: nis

To:

passwd: files ldap
group: files ldap
shadow: files

hosts:          files dns mdns4_minimal [NOTFOUND=return] 
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup: nis

And updated PAM:

pam-auth-update

The host-based authentication now works.