LDAP showing too many users and groups on Linux clients

Question

We are hosting LDAP on a Solaris server and using 150 Solaris clients and 50 Linux clients. Users and groups have a list of netgroups (server hostnames) that they are able to access. This means that a user apacheman01 can only access specific servers via SSH with his username/password. So far this works all well.

ldap.conf:
[root@tst-01 ~]# cat /etc/openldap/ldap.conf
TLS_CACERTDIR /etc/openldap/cacerts
URI ldap://ldap1.tst.domain.tld ldap://ldap2.tst.domain.tld
BASE dc=tst,dc=domain,dc=tld

These commands however show all users and groups available on the LDAP server and not only the users that have access on this server. This also means that when a user is logged in, it can "su -" to another user that shouldn't even have access on the server.

getent passwd
getent group

So LDAP authentication works as it should for initial LDAP SSH authentication, but getent passwd/group shouldn't list ALL users/groups on the LDAP, but only to the servers/netgroups that are assigned to these users/groups.

Answer 1

This is expected behaviour, as documented in getent(1):

The getent command displays entries from databases supported by the Name Service Switch libraries, which are
configured in /etc/nsswitch.conf.  If one or more key arguments are provided, then only the entries that
match the supplied keys will be displayed.  Otherwise, if no key is provided, all entries will be displayed
(unless the database does not support enumeration).

If you want to restrict the use of su, use /etc/pam.d/su instead:

auth       required   pam_wheel.so