Linux – How to automatically create user accounts ( SSH + LDAP )

PAM has the ability to restrict access based on an access control list (at least on Ubuntu) which, like kubanskamac's answer (+1) regards the groups as posix groups, whether they're stored in LDAP, /etc/group or NIS.

/etc/security/access.conf is the access list file. In my file, I put at the end:

-:ALL EXCEPT root sysadmin (ssh-users):ALL

This denies everyone except root, sysadmin and in the group ssh-users (which is in LDAP) wherever they login from (the second ALL).

Then in my PAM account file (this IS an account module), I add at the very end:

account required pam_access.so

which tells PAM to use this file. It works a treat :-)

You should have an entry in nsswitch.conf using the ldap module for passwd. A user's passwd entry is unassociated with their authentication mechanism; it's just handy to keep them both in LDAP if that's a good solution for you.

passwd:      db ldap files

is a good entry.

You'll also need to make sure that your /etc/ldap.conf file is properly configured, although the defaults (except the base and host of course ;)) might work just fine. And lastly, ensure that the ldap nss module is installed.