1

I have a few servers that serve different purposes (and thus different users use each) that authenticate to an LDAP server (I do not have permission to modify content on the LDAP server). What is an effective way to manage access across these servers so not all LDAP users can authenticate? I've thought of using a secondary LDAP server to provide the groups and use the primary server solely for authentication, but I haven't seen any documentation to do so and I haven't found any simple UI for it either. Optimally, the access management could also be done via a UI of some sort so less terminal-inclined users can change user groups as well.

2
  • What OS? What LDAP server and client software? Typically some attribute of the user's object is used to limit authorization. Oct 17, 2011 at 19:15
  • The servers I'm using are a variety of Mac OS, Debian, and Windows. I don't mind if Windows is thrown out the window and ignored. The LDAP server is not under my control. I realize usually the user object has a group attribute which holds permissions, but I can't modify that.
    – kevmo314
    Oct 17, 2011 at 19:16

1 Answer 1

1

I would suggest using the pam_access.so module which allows you to restrict access based on ldap_group,local-group,ldap_user,local_users.

vi /etc/pam.d/common-account   ** depending on which distro the client Server is

account required    pam_access.so

vi /etc/security/access.conf

+ : ALL : LOCAL
- : ALL EXCEPT LDAP_GROUP1 LOCAL_GROUP1 LocalUser ldap_User : ALL

** this would deny everyone except for ldap_group1,local_group1,LocalUser,ldap_User

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .