Re: How to configure ubuntu server with LDAP group based authentication

To: Philip Colmer <philip.colmer@linaro.org>

Subject: Re: How to configure ubuntu server with LDAP group based authentication

From: "Geo P.C." <pcgeopc@gmail.com>

Date: Thu, 2 May 2013 15:24:22 +0530

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:mime-version:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=2/6Qh4LUxSIyTkr+TsTz/g6zclN2sdSZW7Wh5R0dvD4=; b=FwgZ8lb7N3gus2M7gR5t3PqER70jdwapgHnAIHex0Yc5dev6cQ93TypcxvrnGdOYUZ SMl9De0w3V3dKu5EClZtwUj/d4r1LXx+kAriAX+XrXIiMIGzrW0QpXSfFeHZ6/ybwOh4 81tjSU58CWZ0j26I+m5FozXSEBJC1fjtxQijg6fPrL3wBy66B2qgqn2tA0LOuIJgS4qy ANZCpFzB0GhxMuYYqw8nugNQDQaPhoq8hZ8Nkcl1+/GCVY1pnUb1el+bSl46JfRgyJi8 SAvuIevBVzlBSKMWns+VZdkTDj8kjglZjaY4C9NwwxFoAkC29X6/jH5jCanNDJ8FFnXh vhhA==

In-reply-to: <CAKTSSTj++dzoZdHPRn_S3QYphOUrsYjFUdN7Yo_tCenJMW8qOw@mail.gmail.com>

References: <CAKtc8vUaXUCZX3JnEOqti9r2S8nBMWOTSmHthVaugLOBVaoAgA@mail.gmail.com> <CAKTSSTj++dzoZdHPRn_S3QYphOUrsYjFUdN7Yo_tCenJMW8qOw@mail.gmail.com>

Dear Philip

Its working perfectly fine. Thanks...

Thanks & Regards
Geo P.C.
www.geopc.co.cc

On Thu, May 2, 2013 at 2:34 PM, Philip Colmer <philip.colmer@linaro.org> wrote:

This is how I've done it:

Edit /etc/pam.d/sshd and uncomment

account required pam_access.so

Edit /etc/security/access.conf and add this line at the bottom:

-:ALL EXCEPT root sysadmin ubuntu (name of ssh group):ALL

The group can be an LDAP group. Users will still authenticate but they will be immediately disconnected if they are not in the required group. The group needs to be a Posix group (i.e. not groupOfNames or groupOfUniqueNames).

Hope that helps.

Philip

On 2 May 2013 09:46, Geo P.C. <pcgeopc@gmail.com> wrote:

By installing libnss-ldap we are able to integrate an Ubuntu server with ldap (openldap). But we are unable to configure ldap group based authentication.
We need to configure in such a way that user from a particular group need only to login.
Please let me know is it possible configure it and please update us the steps or any url.
Thanks
Geo