ldap authorization 2007-10-12 - By Nigel Wade
Back
Troy Knabe wrote:
> No, I mean a groupOfUniqueNames.
>
I think that should be ok. You would need to use the "group" method.
For each host you will have to set the pam_groupdn to the DN of the
entry for that host in the LDAP directory. The entry for a host should
be of (or include) class groupOfUniqueNames. For each user who is
allowed to login to the host you will have to add an attribute
uniqueMember which is the DN (note: the DN) of the user.
In the system-auth you posted above there is no mention of pam_ldap.so.
I don't know how kerberos and LDAP interact. In my setup I only use LDAP
and pam_ldap is in the system-auth stack. As I understand it it is
pam_ldap which is responsible for providing host based access, if it is
not in the stack there probably won't be any host based access checking
performed. I don't know how kerberos and LDAP interact so I can't say
how to setup PAM to use both.
--
Nigel Wade, System Administrator, Space Plasma Physics Group,
University of Leicester, Leicester, LE1 7RH, UK
E-mail : nmw@(protected)
Phone : +44 (0)116 2523548, Fax : +44 (0)116 2523555
--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@(protected)?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
|
|
