Linux Restrict Server Login via LDAP Groups

Monday, January 28, 2013

If you are working with Linux systems and need to restrict server login via LDAP groups, read through the following post.

Either method below should work using RHEL 5 or RHEL 6, but only use PAM LDAP or SSSD, not both.

LDAP Server Setup

Regardless of what method below is used, the LDAP server setup will be the same; simply, create an LDAP group with the specific users you want to allow to authenticate to the client server.

Client Server Setup with PAM LDAP

Prerequisites

It is already assumed the client server can talk to the LDAP server.

Be sure to install the following packages:

yum install nss-pam-ldapd pam_ldap

Single LDAP Group

Append the following to /etc/ldap.conf:

pam_groupdn cn=Group Name,ou=Groups,dc=example,dc=com

Multiple LDAP Groups

Unfortunately, PAM LDAP only allows authenticating against a single LDAP group. If you want to authenticate against multiple LDAP groups jump to the next section.

Client Server Setup with SSSD

Prerequisites

It is already assumed the client server can talk to the LDAP server.

Be sure to install the following package (the nss-pam-ldapd and pam_ldap packages can be removed):

yum install sssd

Single LDAP Group

Open /etc/sssd/sssd.conf and add the following under domain/default:

access_provider = ldap
ldap_access_filter = memberOf=cn=Group Name,ou=Groups,dc=example,dc=com

Multiple LDAP Groups

The following will allow users in LDAP groups System Administrators or Database Users to authenticate to the client server.

Open /etc/sssd/sssd.conf and add the following under domain/default:

access_provider = ldap
ldap_access_filter = (|(memberOf=cn=System Adminstrators,ou=Groups,dc=example,dc=com)(memberOf=cn=Database Users,ou=Groups,dc=example,dc=com))

The ldap_access_filter accepts standard LDAP filter syntax, so get as complicated as you need to. Be sure to restart the sssd service after any changes:

service sssd restart
comments powered by Disqus