I'm trying to restrict login to specific LDAP groups in Debian 8. The system is configured to use OpenLDAP (PAM) as authentication method.

My goal is to configure the system to allow all local users (including root) plus LDAP users that belong to a list of LDAP groups. In the server, the groups are entries having it's objectClass as posixGroup, so the memberUid attribute contains the users in that group.

  • Are you using nslcd or something similar? – gf_ Dec 16 '15 at 21:12
  • Yes, nslcd. (from libnss-ldapd and libpam-ldapd). – nowat Dec 17 '15 at 16:47

I solved the problem by adding a security rule in /etc/security/access.conf:

-:ALL EXCEPT root [user] ([myldapgroup]):ALL

* replace [user] by my local username (so I can log in locally) and [myldapgroup] by the ldap group allowed to login.

And adding this line to the start of /etc/pam.d/common-account:

account required pam_access.so

Now only root, [user], and users that belong to [myldapgroup] are able to login.

For more information: https://wiki.debian.org/LDAP/PAM

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.