I've set up an OpenLDAP-Server to authenticate users to our Ubuntu-servers. The authentication works quite well but I'd like to restict the user's access to certain servers.

I know this can be done through nss_base_something in the client's ldap.conf. However, this requires the group restrictions to be specified on the client. I wonder if the restrictions can be set completely in OpenLDAP. If it is, I'd like to know how.




You can do this with the pam_ldap module. (man page here)

In openldap, configure a host attribute for a user with the hostname of the system to allow access to.

in /etc/pam_ldap.conf:

pam_check_host_attr yes

It should now check against the attribute when the user attempts to login.

  • That sounds promising, does it also work on group-level? – Anonymous Coward Sep 4 '12 at 8:44
  • I believe it's possible, I have not tried it. All you need is an objectclass that supports it. We handle our host access permissions through groups in Active Directory and locking down access via access.conf. Before this we did host attribute checking above via openldap. – Andy H Sep 4 '12 at 22:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.