I have integrated PAM with LDAP authentication. Q- how to restrict login for some users to some Linux servers.

For example- we have integrated 100 Linux servers in the Org with PAM LDAP auth and we have around 600users are there in the LDAP and now we need to restrict some accounts to some Linux servers. currently all users are able to login to all the Linux servers.

Please let me know if you have any solution for this problem. Please share with me the steps to do it also. Thank you


In ldap you can set host which availible to login. Also you can create group and set access for login on specific system.

| improve this answer | |

If there are just few users to login, you could append this to your /etc/passwd

+::::LDAP user::/usr/sbin/nologin

This will overwrite GECOS with "LDAP user" and everyone except user{1,2} has /usr/sbin/nologin .

Another solution would be to use /etc/security/access.conf have a look to this post: https://serverfault.com/a/229131/11340

| improve this answer | |

I use SSSD and then put a ldap_access_filter line in the conf file like so:

id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
access_provider = ldap
ldap_access_filter = memberOf=CN=IT,CN=Users,DC=example,DC=com
| improve this answer | |

Strictly speaking, this is an access control question, not an authentication question. Your best solution would be to use pam_access. See the access.conf(5) man page. You should create groups or netgroups in LDAP, then include

+: (groupname) @netgroupname: ALL

in /etc/security/access.conf.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.