Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
I'm trying to restrict login to specific LDAP groups in Debian 8. The system is configured to use OpenLDAP (PAM) as authentication method.
My goal is to configure the system to allow all local users (including root) plus LDAP users that belong to a list of LDAP groups. In the server, the groups are entries having it's objectClass as posixGroup, so the memberUid attribute contains the users in that group.
I solved the problem by adding a security rule in /etc/security/access.conf:
-:ALL EXCEPT root [user] ([myldapgroup]):ALL
* replace [user] by my local username (so I can log in locally) and [myldapgroup] by the ldap group allowed to login.
And adding this line to the start of /etc/pam.d/common-account:
account required pam_access.so
Now only root, [user], and users that belong to [myldapgroup] are able to login.
For more information: https://wiki.debian.org/LDAP/PAM
nslcdor something similar? – gf_ Dec 16 '15 at 21:12