Re: Namespace layout [was: pam_ldap questions]

["Karel Zajicek" <karel.zajicek@ecn.cz>]

On Thu, 7 Sep 2000 09:29:00 +0200, Nyers, Gabor wrote:

>This way if a user needs access to a machine just add his/her name to the
>machine group.
>
>How do the ldap.wizards :-) this?

I use PAM and pam_listfile module for this purpose.

auth       required     /lib/security/pam_listfile.so item=group sense=allow \
	file=/etc/mygroup onerr=fail
auth       required     /lib/security/pam_ldap.so
account    required     /lib/security/pam_ldap.so

where /etc/mygroup contains just the name of a valid unix group (which can be 
defined in LDAP). Accounts not listed in the group are denied.

Karel Zajicek (karel.zajicek@ecn.cz)
Econnect, Ceskomalinska 23, 160 00 Praha 6, Czech Republic
Tel.: +420-2-24311780, Fax: +420-2-24317892, http://www.ecn.cz