Linux – validate only one user with pam ldap and nslcd

ldaplinuxpam

I want only user "theuser" to login to this host.

I have tried the following in nslcd.conf:

pam_authz_search (&(objectClass=posixAccount)(IsActive=TRUE)(uid=theuser))

but all can login. If instead of pam_authz_search I use the "filter" command, it works, but getent returns only one user, the "theuser".

UPDATE:
OS is ubuntu 12.10, I'm using libpam-ldapd NOT libpam-ldap

Best Answer

You can control who logs into a server (regardless of the source of the user database) with the /etc/security/access.conf file. For this mechanism, you need to enable the pam_access module (generally for the account stage). Either in /etc/pam.d/common-account for all services, or something like /etc/pam.d/sshd to make it only effective to ssh connections.

Check the man pages for access.conf and pam_access for the details.

Related Solutions

Linux – libpam-ldapd not looking for secondary groups

I believe the map group parameter needs to be associated with a corresponding filter group parameter. Here's how I use it connecting to Active Directory:

filter passwd (&(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=Linux-SA,OU=Groups,DC=global,DC=example,DC=com)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
map    passwd uid              sAMAccountName
map    passwd homeDirectory    unixHomeDirectory
map    passwd gecos            displayName
map    passwd loginShell       "/bin/bash"
filter shadow (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
map    shadow uid              sAMAccountName
map    shadow shadowLastChange pwdLastSet
filter group  (&(objectClass=group)(gidNumber=*))
map    group  uniqueMember        member

Linux ldap authentication, pam_filter ignored

Ok, the solution was to use

nss_base_passwd ou=people,dc=rwth-cbmb,dc=de??ou=linux

in /etc/ldap.conf on the client. According to documentation:

Syntax:

nss_base_XXX base?scope?filter

I don't know why pam_filter doesn't work, but nss_* solves the problem.

Best Answer

Related Solutions

Linux – libpam-ldapd not looking for secondary groups

Linux ldap authentication, pam_filter ignored

Related Topic