5

I've got a host of servers running various flavors of Linux all setup as OpenLDAP clients via SSSD. I added an LDAP group (sysadmins). I also added a sysadmins group on all of my servers. The members of the sysadmins group will change over time.

How can I get all users in the LDAP group to be added to the local group on login?

Improve this question
2
  • 1
    Why do you want to do this? Having these group members in a central location is one of the most important features of an LDAP user database.
    – Sven
    Jan 25, 2016 at 21:49
  • Also see my answer at serverfault.com/a/908097/267016 for a method to add all users to a local group at login time.
    – roaima
    Apr 17, 2018 at 22:21

2 Answers 2

Reset to default
5

According to the ubuntu documentation you can do a mapping of domain users to local groups, I'm not sure if it is applicable to any OS, but it seems to use standard modules that should be on any *nix system.

From Ubuntu docs

Assign local groups to users

To assign local groups to a domain (ldap) user do the following edit /etc/security/group.conf and add something like the following to it (log in as a local user and run the groups command to verify what to add):

*;*;*;Al0000-2400;audio,cdrom,dialout,floppy

In order to get the pam_group module working you could create a file like /usr/share/pam-configs/my_groups:

Name: activate /etc/security/group.conf
Default: yes

Priority: 900
Auth-Type: Primary 
Auth: required pam_group.so

and activate it by running pam-auth-update.

This roughly equals editing /etc/pam.d/common-auth by hand and adding the following line before any pam_ldap and pam_krb5 settings:

auth required pam_group.so

You should now have local groups showing up for users logging in via gdm and ssh and can verify this by executing id or groups.

Finalize

Just to make sure everything works, run the following:

pam-auth-update
/etc/init.d/nscd restart
Improve this answer
4
  • Note that due to a bug in GDM/Gnome (and other display managers have had this too) even if you have a correct pam_group setup, it may only work when you log in via SSH or a terminal from Ctrl+Alt+F1-F5 and not inside your GUI session. This is possibly due to adoption of systemd and the --user sessions it can trigger for things like Gnome-terminal that don't automatically inherit groups because it doesn't do a PAM check apparently.
    – dragon788
    Aug 22, 2018 at 16:27
  • There should be a new line between Auth-Type: and Primary Auth:
    – Gabriel Hautclocq
    Jan 19, 2022 at 16:45
  • @GabrielHautclocq I'm actually wondering if it needed a newline after Primary before the Auth, and then the arguments/attributes to the Auth: can be on the same line. I don't have access to the machines and domain where I had set this up before, but maybe you can give it a try?
    – dragon788
    Apr 27, 2022 at 22:56
  • I want to clarify what @GabrielHautclocq said (really highlight). The /usr/share/pam-configs/my_groups file MUST be exact! That means check for extra spaces at the end of each line, if there are any remove them, it the file will not be accepted. So if you run pam-auth-update and * next to activate /etc/security/group.conf, and every time you run pam-auth-update it shows the * disappeared, check the format of this file! Also these instructions only work on Ubuntu. they dont work on Centos or RHEL.
    – Dave
    Mar 1 at 13:17
2

There's one way of accomplishing this at the moment -- you can either add the user on each host locally and then add the member from LDAP into /etc/groups.

The second way is currently under development for glibc and wouldn't make it to RHEL sooner than 7.3 but you can read about it here: https://sourceware.org/glibc/wiki/Proposals/GroupMerging

That would basically allow you to define the group both locally and in LDAP and have libc merge the group contents.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.