Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have an ldap server and an ldap client in a domain. As part of the in-charge of a subdomain, I want to enable ldap logins for only some users on a particular machine, and want to disable the rest of the users. I DO NOT have adminisptrative access to the ldap server. Can it be done. If so, how?

e.g. machine1, all users enabled for ldap login machine2, only xyz, and pqr are allowed to login machine3, abc and def are not allowed, rest all are allowed.

In short, to allow/disallow a subset of users from accessing a particular ldap-client, without root/administrative privileges to the ldap server.

nsswitch.conf looks like this:

passwd:     files ldap
shadow:     files ldap
group:      files ldap

Client runs Ubuntu 10.04 and OpenLDAP.

Thanks. EDIT: Please note that although I'm proficient in linux, I'm very new to LDAP(don't even understand the terminology well), and hence an easy, simple and adhoc solution would be more welcome than an advanced solution.

share|improve this question

2 Answers 2

You list information about the directory configuration but what you want is authorization configuration, i.e., PAM. You can accomplish what you want to do by using pam_listfile where you would list all the users that are allowed to log in in a file and add pam_listfile to the pam stack.

share|improve this answer

Simple and adhoc, and having root access to the client machines: enable pam_access in the pam config and set up /etc/security/access.conf . See the samples in the file and pam_access(8).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"//careers.stackoverflow.com?utm_source=stackoverflow.com&amp;utm_medium=site-ui&amp;utm_campaign=footerlink\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\r\n                </div>\r\n            </div>\r\n\r\n            <div id=\"copyright\">\r\n                site design / logo &#169; 2014 stack exchange inc; user contributions licensed under <a href=\"http://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a>                   with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\r\n            </div>\r\n            <div id=\"svnrev\">\r\n                rev 2014.12.20.2132\r\n            </div>\r\n            \r\n        </div>\r\n    </div>\r\n    <noscript>\r\n        <div id=\"noscript-warning\">Server Fault works best with JavaScript enabled<img src=\"http://pixel.quantserve.com/pixel/p-c1rF4kxgLUzNc.gif\" alt=\"\" class=\"dno\"></div>\r\n    </nosc"], "copyright__copyright__copyright": ["owed to log in in a file and add pam_listfile to the pam stack.\n\nshare|improve this answer\n\nSimple and adhoc, and having root access to the client machines: enable pam_access in the pam config and set up /etc/security/access.conf . See the samples in the file and pam_access(8).\n\nshare|improve this answer\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}