Re: pam ldap limit authentication

From: Jamie Beverly (jbeverly1_at_tampabay.rr.com)
Date: 08/02/05 

Date: Tue, 02 Aug 2005 00:57:40 GMT

grrr... in the third option, you would limit =rx access to userPassword
only, everything else would need to be readable in order for the users
homeDirectory, uid, etc,etc.

Jamie Beverly wrote:

> there are several ways to accomplish this, since you asked about PAM last,
> I'll give that answer first.
>
> pam_listfile.so provides the ability to list account names, and in pam.d
> you may specify users, groups, etc and a "sense" which would be either
> allow or deny.
>
> something like this would permit only users in the list
> file /etc/valid_users:
> auth required pam_listfile.so item=user sense=allow
> file=/etc/valid_users onerr=fail
>
>
> Now, I believe another way you could accomplish this is with your
> ldap.conf. specify a filter on your nss_base_shadow only, but not the
> nss_base_passwd line.
>
> And thirdly, on your ldap server itself, you should be able to define an
> ACL that would only allow =rx to people in your admin group by
> peername=server.you.wish.to.restrict.access.to
>
> hope one of those is to your liking. Good luck.
>
>
>
> trevor_obba@yahoo.co.uk wrote:
>
>> I have a suse linux machine which authenticate users to ldap, this is
>> working fine. But I would like to limit users that logon to the
>> machines to just the system admins.
>> The machines hosts different web sites which users accessed from there
>> home directory like http://foo.mdx.ac.uk/~username
>>
>> At the monent my /etc/ldap.conf has
>> nss_base_passwd
>> o=mdx?sub?groupMembership=cn=linux_servers,ou=access-grou
>> ps,ou=UNIX,ou=services,ou=staff,o=mdx
>>
>> nss_base_shadow
>> o=mdx?sub?groupMembership=cn=linux_servers,ou=access-grou
>> ps,ou=UNIX,ou=services,ou=staff,o=mdx
>>
>> nss_base_group
>> ou=group,ou=sun.mdx.ac.uk,ou=nis,ou=services,ou=unix,ou=service
>> s,ou=staff,o=mdx?one
>>
>> I would like to limit authentication to cn=linux_admin but if I change
>> the above /etc/ldap.conf to cn=linux_admin users will not be able to
>> get there web site.
>>
>> Using PAM, how do I limit authentication to all services just to
>> cn=linux_admin, while normal user still be able to access there web
>> site through http://foo.mdx.ac.uk/~username
>>
>> Thanks

Relevant Pages

  • Re: New article on SecurityFocus
    ... There was a list I saw of some of these 'legitimate' web sites and if one of my employees had surfed there I would have fired his or her rear end. ... What source do you have for "hundred of thousands of machines"? ... Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. ... Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • SUS group policy
    ... I've had my sus policy working for about a year now, ... admin group of their machines, ... auto-restart for scheduled automatic updates installation' ... of the local admin group in order to receive the no option ...
    (microsoft.public.win2000.active_directory)
  • Re: QuickTime 7.1.6: Java vulnerability Fix
    ... That is a subset of actual PCs in use. ... There is a group of machines that are sold as PCs that will never show up in the statistics that you are demonstrating. ... "his report lists the market share of the top operating systems in use. ... small fraction of web sites, then this looks like the place. ...
    (comp.sys.mac.system)
  • Re: ISA2004 Beta of 2003 STD SVR need help on publishing web sites
    ... >Are you testing from an external client? ... a seperate comuter runing STD Server 2003 and have two ... BUT I can't publish any of my five web sites on the web ... All machines on the ...
    (microsoft.public.isa)
  • Re: Active directory migration tool, access denied
    ... The machines are on, but not logged in. ... > Is the domain admin group part to the computers local admin group? ... >> transfer the computers I get access denied when trying to launch the ... >> migration agent on the client computers. ...
    (microsoft.public.windows.server.sbs)