[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: Basic ACL question...I think.
Hi, Thanks for the reply. I found that the pam ldap module does help, like using pam_groupdn to point to a group that contains (in memberuid) the people that I want to have access. The problem with that is that
the nss library still sees the entries as valid uids, which I don't want. Is there a similar module config I could use for libnss?
What defines the entries is just a group that I put them into, i.e. I create a group called emailusers and create a memberuid entry in that group for each user that I want to be visible.
On Apr 16, 2010, at 12:49 PM, Andrew Findlay wrote:
> On Fri, Apr 16, 2010 at 10:50:08AM -0400, Ken Kleiner wrote:
>
>> What I'm trying to do is set up my ldap server so that when a specific host binds using a particular DN, that host only sees specific entries in the ou=People tree, so that getent, id, nss, pam, etc only recognizes those users.
>>
>> Is this possible? I'm stumped. Thanks.
>
> It is possible, but it may not be the best thing to do... If you want
> to restrict who can login on each machine then it may be better to use
> the authorisation facilities of the PAM LDAP module.
>
> In any case, what defines the set of entries to be seen / permitted on
> each host? There are several ways that you might represent the set:
> LDAP groups, new attributes etc, and each would have result in
> different ACLs. I suspect that you do not want to define the set
> separately for each host, so some sort of group hierachy might be
> appropriate.
>
> You will find a few examples here:
> http://www.skills-1st.co.uk/papers/ldap-acls-jan-2009/
>
> Andrew
> --
> -----------------------------------------------------------------------
> | From Andrew Findlay, Skills 1st Ltd |
> | Consultant in large-scale systems, networks, and directory services |
> | http://www.skills-1st.co.uk/ +44 1628 782565 |
> -----------------------------------------------------------------------
Ken Kleiner
System Manager
University of Massachusetts Lowell
Computer Science Department
978 934 3645