0

Disclaimer: I'm new to ldap, so hopefully I haven't done anything majorly wrong!

Aim: To centralise user credentials and restrict client login to certain machines.

I have a barebones openLDAP server setup on a fresh Ubuntu 14.04 server by using the following. Essentially, install LDAP and make schema changes to enable the host attribute for users:

# Install ldap
apt-get install -y slapd ldap-utils ldapscripts

# Modify the schema so we can use the host attribute for users
grep -P '^include.+?\.schema' /usr/share/slapd/slapd.conf > ./schema_convert.conf
echo -e "include\t\t/etc/ldap/schema/ldapns.schema" >> ./schema_convert.conf

# Convert the schema into LDIF
mkdir -p ./ldif_output
index=$(slapcat -f ./schema_convert.conf -F ./ldif_output -n 0 | grep ldapns,cn=schema | sed -re 's/^\S+\s+//')
slapcat -f schema_convert.conf -F ldif_output -n0 -H \
  ldap:///${index} -l cn=ldapns.ldif

# Modify the file, ready for importing
sed -i -r \
  -e 's/^dn:.+$/dn: '${index/\{*\}/}'/' \
  -e 's/^cn:.+$/cn: ldapns/' \
  -e '/^(structuralObjectClass|entryUUID|creatorsName|createTimestamp|entryCSN|modifiersName|modifyTimestamp):/d' \
  cn=ldapns.ldif

# Add the schema to the slapd-config
ldapadd -Q -Y EXTERNAL -H ldapi:/// -f cn\=ldapns.ldif

I've added a couple of groups and people. One of my users has the host attribute value set to one of my machines (thor).

On thor and venus I have configured them to authenticate against my ldap server - this works. I have then modified /etc/ldap.conf on thor and venus so this is uncommented:

pam_check_host_attr yes

I had hoped that when I try to login to venus I wouldn't be allowed since the user only has thor set in the host attribute of my ldap server.

Can you provide any insights into how to restrict a user to logging in to only 1 specific host?

  • try use value of 'hostname -f'. – Reinaldo Gil Jan 7 '15 at 13:25
  • From documentation: "If set to 'yes' and a user has no value for the 'host' attribute, then the user will be unable to login". If you still log-in after enable pam_check_host_attr so /etc/ldap.conf was ignored. – Reinaldo Gil Jan 7 '15 at 13:26
  • You can hack pam_filter attribute like: pam_filter (host=venus) – Reinaldo Gil Jan 7 '15 at 13:30
1

It turns out that I had to modify my /etc/nsswitch file as per the instructions in /usr/share/doc/libpam-ldap/README.Debian which states:

If you want to use the "pam_check_host_attr" feature, make sure "pam_unix.so" doesn't provide a valid "account" via the Name Service Switch (NSS), which overrides your LDAP configuration. Don't use "ldap" for "shadow" in /etc/nsswitch.conf, just use "shadow: files".

Therefore, when I changed my /etc/nsswitch file from:

passwd: files ldap
group: files ldap
shadow: files ldap

hosts:          files dns mdns4_minimal [NOTFOUND=return] 
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup: nis

To:

passwd: files ldap
group: files ldap
shadow: files

hosts:          files dns mdns4_minimal [NOTFOUND=return] 
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup: nis

And updated PAM:

pam-auth-update

The host-based authentication now works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.