I'm using pam_access and /etc/security/access.conf to restrict who can login to my Rhel 6.5 hosts.
I have an LDAP server with a diverse user base, and the security people would like a list of who can login to what.
I need a sciptable way to check if an account will be able to login to the host. getent passwd, id, finger, groups and every other tool I've tried return the same output if an account is restricted from logging in or not. passwd -S doesn't seem to work with LDAP accounts at all.
Is there a way to check if a given account has login permissions? On Solaris if the user or netgroup isn't in /etc/passwd none of the tools can identify a restricted account, but it seems to be completely the opposite on Linux.
This is the account section of /etc/pam.d/system-auth:
account required pam_access.so
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_krb5.so
account required pam_permit.so
My puppet config only does the following that could change the pam setup.
/usr/sbin/authconfig --enablemkhomedir --updateall
/usr/sbin/authconfig --enablekrb5 --updateall
/usr/sbin/authconfig --enablepamaccess --updateall
/usr/sbin/authconfig --enablesssd --updateall
/usr/sbin/authconfig --nisdomain=domainname.corp --updateall
+ : root : ALL
.... all system accounts
+ : @ngunix_admins : ALL
- : ALL : ALL
getent netgroup ngunix_admins
ngunix_admins ( ,danw,domainname.corp)
I'm in the ngunix_admins netgroup so this makes sense
% id danw
uid=355400001(danw) gid=355400001(danw) groups=355400001(danw)
% getent passwd danw
But this other user is not in the ngunix_admins netgroup so I need some way to identify that he cannot log in
uid=355400003(testuser) gid=355400003(testuser) groups=355400003(testuser)
getent passwd testuser
2nd Edit: Clarify that I'm not tuning login permissions, but trying to report on access for auditing.