Answers: <p>You don't need to edit /etc/groups since the LDAP group already exists in your LDAP database. You want to let SSH know to use it, try using the AllowGroups setting in /etc/ssh/sshd_config. </p>
  
  <p>From the manpage: "If specified, login is allowed only for users whose primary 
  group or supplementary group list matches one of the patterns.  Only group     names are valid; a numerical group ID is not recognized.  By default, login is allowed for all groups."</p>
  
  <p>See <a href="https://stackoverflow.com/questions/50638944/ansible-to-update-sshd-config-file">this question for more information</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2019-02-19T14:55:25.850Z
Answers: 2019-02-19T14:55:25.850Z
Answers: TheFiddlerWins
Answers: <p>As explained by @TheFiddlerWins, there is no need to add ldap groups into /etc/group.</p>
  
  <p>The challenge here is to give ssh a way to access your ldap directory:
  I did this some time ago by adding a custom script to the sshd config, but using pam looks a lot cleaner today.</p>
  
  <p>Then you just need to handle the required changes using your playbook.</p>
  
  <p>Just remember that your ldap accounts will need a posixAccount object in order to be able to log into you ubuntu boxes.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-07-21T07:32:17.327Z
Answers: 2019-07-21T07:32:17.327Z
Answers: Pier
Body: <p>I have LDAP Group.</p>
  
  <pre><code>superproduct1
  </code></pre>
  
  <p>In LDAP Group has some users: </p>
  
  <pre><code>developer1, tester1, analitic1, project1
  </code></pre>
  
  <p>I want to create ansible playbook for add LDAP group to SSH access on host.</p>
  
  <p>Found only </p>
  
  <p><a href="https://docs.ansible.com/ansible/latest/modules/group_module.html" rel="nofollow noreferrer">group – Add or remove groups</a></p>
  
  <pre><code>- name: Ensure group "somegroup" exists
    group:
      name: somegroup
      state: present
  </code></pre>
  
  <p>How to add LDAP group superproduct1 for ssh access?</p>
  
Tags: <ansible>
Title: How to add LDAP group for ssh access by ansible playbook?
UserDisplayName: Nikolay Baranenko
ThreadText: # How to add LDAP group for ssh access by ansible playbook?
  
  (Asked by: username_0 on 2019-02-16)
  
  I have LDAP Group.
  
  ```
  superproduct1
  
  ```
  
  In LDAP Group has some users:
  
  ```
  developer1, tester1, analitic1, project1
  
  ```
  
  I want to create ansible playbook for add LDAP group to SSH access on host.
  
  Found only
  
  [group – Add or remove groups](https://docs.ansible.com/ansible/latest/modules/group_module.html)
  
  ```
  - name: Ensure group "somegroup" exists
    group:
      name: somegroup
      state: present
  
  ```
  
  How to add LDAP group superproduct1 for ssh access?
  
  **Tags:** ansible
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2019-02-19. Score: 1
  
  You don't need to edit /etc/groups since the LDAP group already exists in your LDAP database. You want to let SSH know to use it, try using the AllowGroups setting in /etc/ssh/sshd\_config.
  
  From the manpage: "If specified, login is allowed only for users whose primary
  group or supplementary group list matches one of the patterns. Only group names are valid; a numerical group ID is not recognized. By default, login is allowed for all groups."
  
  See [this question for more information](https://stackoverflow.com/questions/50638944/ansible-to-update-sshd-config-file)
  
  
  ---
  
  ### Answer by username_2 on 2019-07-21. Score: 0
  
  As explained by @username_1, there is no need to add ldap groups into /etc/group.
  
  The challenge here is to give ssh a way to access your ldap directory:
  I did this some time ago by adding a custom script to the sshd config, but using pam looks a lot cleaner today.
  
  Then you just need to handle the required changes using your playbook.
  
  Just remember that your ldap accounts will need a posixAccount object in order to be able to log into you ubuntu boxes.
  
  
  ---
  
  