Re: Disable Linux commands for LDAP users

To: Bernard Fay <bernard.fay@gmail.com>

Subject: Re: Disable Linux commands for LDAP users

From: Daniel Howard <dannyman@toldme.com>

Date: Fri, 21 Oct 2016 14:19:54 -0700

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toldme-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=dkpe2M3WrxywiSHdXSpWewMYUCjGGoyjJVgtWu6hZD0=; b=pfrJU8i3QUfTkEHiyhj5PTAJaoYbTUUhlzsqAK1y/kGyAv58LSSUTJqBOEpeFBU2Uy g/r6ewZUkePh+f5cLmiy2ZkB7xTBKWZvzi1lT6DUuQN93mE8nYO0THI2uxd/lhCziRBe F5POFrNLntbQtf5tK0pVRxOVGGQt2CqS5+ppAbJSdmNpYzSJ5qjdMEeddHqunIkMRsvy /5ogW+9z+kVkVzQYPaMvrxIrozSHRmhonAbwazb1ASkJZGk0keaIqFLv20TTId9dGUAp rzIk5HcTgymnQbLzzOGAlpBqJX2F4ZSiD3kmCm+FgcEqgal/bvKS6cqRWH3XdA/gIy0M bwVQ==

In-reply-to: <CAH3AE4Ybx7jGgE-DmzBK1B7fU_L4GYfpXB8JvWVfObon3gpUNg@mail.gmail.com>

References: <CAH3AE4Ybx7jGgE-DmzBK1B7fU_L4GYfpXB8JvWVfObon3gpUNg@mail.gmail.com>

Unix doesn't really work that way but maybe you make your special ldap user password script check if the user is in LDAP: if they are, do LDAP password, if they are not, wrap around Unix password.

Easier lazy solution is to have a passwd-ldap and a passwd-unix command, then replace passwd with a little script that tells the user to invoke the appropriate command.

-danny

On Thu, Oct 20, 2016 at 9:15 AM, Bernard Fay <bernard.fay@gmail.com> wrote:

Hi,

I would like to able to disable some Linux commands for LDAP users. One of those commands is passwd. Because of some specific needs, when the LDAP users have to change their password a special script has been created for this purpose. They MUST not use passwd but this command is still required by local users.

Does one of you might have an idea to disable Linux commands for LDAP users only?

Thanks,
Bernard

http://dannyman.toldme.com

References:

Disable Linux commands for LDAP users
- From: Bernard Fay <bernard.fay@gmail.com>