I have a RedHat Linux server that are is use for more than 1000 users

Users names are coming to the server via LDAP protocol, so login authentication is from the LDAP

My question: is it possible to block user login on the local machine, while users names come from LDAP?

  • You're using straight LDAP for auth? Not Kerberos?
    – jmp242
    Feb 24 '15 at 15:40
  • yep I use LDAP , and I see that from the /var/log/secure and LDAP files -:) Feb 24 '15 at 15:41

You can limit logins via PAM settings: http://www.cyberciti.biz/tips/howto-deny-allow-linux-user-group-login.html

  • +1 for your exelent solution thx so much Feb 24 '15 at 16:13
  • may I need to restart the sshd service after config? Feb 24 '15 at 16:23
  • what is the diff between group name to user name - or maybe they are the same ? , because I want to block username Feb 24 '15 at 16:27
  • If you follow the suggestion to man pam_listfile, you'll see: apply=username is how to limit to a specific user...
    – jmp242
    Feb 24 '15 at 18:24

you can use DenyUsers or if you want to deny a group DenyGroups in /etc/ssh/sshd_config

  • can you advice how? or give example? Feb 24 '15 at 16:12
  • DenyUsers user01 in and after you edit /etc/ssh/sshd_config reload the ssh service
    – c4f4t0r
    Feb 24 '15 at 16:36

You can follow below steps

This can be done per servers using PAM module.

root@test-login:~# vim /etc/ssh/sshd_config

add below line

DenyUsers ldapuser1 ldapuser2 ldapuser3

DenyGroups ldapgroup1 ldapgroup2

Save the file and restart ssh services

root@test-login:~# service ssh restart

And try now

  • 1
    Yes, there are PAM modules that allow for this behavior, but sshd is not pam module.
    – 84104
    Sep 29 '16 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.