I have several linux servers (ubuntu 12.04) setup to authenticate user logins over an external (to my branch office) LDAP (Novell Edirectory specifically). This is working well, however I am trying to filter user logins by membership in an LDAP group.
A user account looks like this in Edir:
dn: cn=mmcloud,ou=eng,o=lsi loginShell: /bin/bash homeDirectory: /home/mmcloud gidNumber: 2001 uidNumber: 9418 mail: xxxxxx@xxxxxxxxx uid: mmcloud initials: Q givenName: Moran sn: McCloud objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: ndsLoginProperties objectClass: Person objectClass: Top objectClass: posixAccount eMailAddress: 7#xxxxx@xxxxxxxxxxxx cn: mmcloud
A group entry looks like this in Edir:
dn: cn=shellacct,ou=groups,ou=eng,o=lsi memberUid: jbarlin memberUid: mmccloud memberUid: ssemryn memberUid: cdesmon gidNumber: 2009 objectClass: groupOfNames objectClass: Top objectClass: posixGroup
I only want users in the
shellacct group to login. I've found many examples using
/etc/ldap.conf but have only gotten the filter to work by filtering on specific
userDn attributes such as:
pam_filter &(objectclass=user) pam_filter &(objectclass=Person) pam_filter &(loginShell=/bin/bash)
What I want is to filter on the group membership. The
cn=shellacct,ou=groups,ou=eng,o=lsi (gid=2009). I've tried in
pam_filter &(objectclass=posixAccount)(|(gidNumber=2009)) pam_filter |(member=cn=shellacct,ou=groups,ou=eng,o=lsi) pam_filter |(memberUid=cn=shellacct,ou=groups,ou=eng,o=lsi)
pam_filter work for what I want to do or does it only look at the
userDn for filtering?