>Yes, I can use PAM, that is how we are going to be authenticating on the >machines. But how would you have pam restrict this? The "host" attribute perhaps?