ssh group membership access

[Daniel Bahena <informatux@gmail.com>]

Hi,

I have a set of servers in which I want to configure ssh access based on the users group membership. 

I'm using CentOS 5 and this version of openldap 

[root@centos5 ldifs]# rpm -qa | grep ldap
openldap-servers-2.3.43-12.el5_7.10
php-ldap-5.1.6-27.el5_7.5
openldap-servers-overlays-2.3.43-12.el5_7.10
openldap-2.3.43-12.el5_7.10
nss_ldap-253-42.el5_7.4
openldap-2.3.43-12.el5_7.10
nss_ldap-253-42.el5_7.4
openldap-clients-2.3.43-12.el5_7.10
[root@centos5 ldifs]# 


And this is my ldap.conf

base dc=homelinux,dc=net
timelimit 120
bind_timelimit 120
idle_timelimit 3600
pam_groupdn cn=access,ou=Group,dc=homelinux,dc=net
pam_member_attribute member
nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm
uri ldap://127.0.0.1/
ssl no
tls_cacertdir /etc/openldap/cacerts
pam_password md5


And this is the contents of cn=access

[root@centos5 ldifs]# ldapsearch -x -W -D 'cn=Manager,dc=homelinux,dc=net' -h 127.0.0.1 "cn=access" 
# access, Group, homelinux.net
dn: cn=access,ou=Group,dc=homelinux,dc=net
cn: access
objectClass: top
objectClass: groupOfNames
objectClass: labeledURIObject
member: uid=nobody,ou=People,dc=homelinux,dc=net
labeledURI: ldap:///ou=People,dc=homelinux,dc=net??one?(gidNumber=10060)
labeledURI: ldap:///ou=People,dc=homelinux,dc=net??one?(host=jumpbox)
[root@centos5 ldifs]# 


And this is the contents of the gid 10060 (unixsa)

[root@centos5 ldifs]# ldapsearch -x -W -D 'cn=Manager,dc=homelinux,dc=net' -h 127.0.0.1 "cn=unixsa" 
# unixsa, Group, homelinux.net
dn: cn=unixsa,ou=Group,dc=homelinux,dc=net
gidNumber: 10060
description: unixsa
objectClass: top
objectClass: posixGroup
cn: unixsa
memberUid: uid=dan,ou=People,dc=homelinux,dc=net
memberUid: dan
[root@centos5 ldifs]# 


And when I try to ssh into this box I get the following:

[kwame@vader ~]$ ssh dan@centos5
dan@centos5's password: 
You must be a member of cn=access,ou=Group,dc=homelinux,dc=net to login.
Connection closed by 192.168.122.225
[kwame@vader ~]$

This is the info for the user dan
[root@centos5 ldifs]# id dan
uid=10051(uid=dan,ou=People,dc=homelinux,dc=net) gid=10051(dan) groups=10051(dan),10060(unixsa)


Comments? Thoughts? Words of wisdom?

Best regards