2

I have successfully installed PBIS-open to authenticate against active directory. I also used the /opt/pbis/bin/config RequireMembershipOf command to allow a certain domain group to login.

I would now like to allow root, and the group(s) specified with the /opt/pbis/bin/config RequireMembershipOf command, and deny all other local users to login. Is there any way to do this?

  • use Allowuser in /etc/ssh/sshd_config – c4f4t0r Aug 17 '15 at 8:47
  • I also want to make sure only these users are allowed to logon directly on the server, so "Allowuser" is not an option in this case – mpmv2015 Aug 17 '15 at 8:49
  • please when you talk about login, please tell how? ssh or console? – c4f4t0r Aug 17 '15 at 9:06
  • I'm sorry, I'm talking about the console – mpmv2015 Aug 17 '15 at 9:14
  • For your case, you can use pam_access and configure the file /etc/security/access.conf – c4f4t0r Aug 17 '15 at 9:34
0

If you would like to use pam_access in redhat and centos and so on, first you need to include the module in your pam configura as follow.

authconfig --update --enablepamaccess

Now you can configure which users that can use your server.

/etc/security/access.conf:

my example rules

+ : DOMAIN\admins : ALL
+ : root : ALL
- : ALL : ALL

If you use DOMAIN\ sintax in front of the users and groups, that would say you are using winbind, for AD join, I'm using pam_ldap with sfu in the windows side, for this reason in my comments I don't use the domain.

Now you have configured Pam for the users access control, but Now you need to be sure that sshd is using pam,

grep "UsePAM" /etc/ssh/sshd_config
UsePAM yes

If the UsePAM isn't yes, you need to change this to yes and restart sshd service

  • I can now only login with my root account. The domain group isn't working. I used PBIS-open to join the domain. – mpmv2015 Aug 17 '15 at 11:26
  • sorry, but I don't see any logs of information about what you are doing, is realy hard to help you in this way, is better with start a chat, we can't continue to write comments. – c4f4t0r Aug 17 '15 at 11:29
  • Ok, how do we start to chat? I'm kind of new here – mpmv2015 Aug 17 '15 at 11:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.