Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working for an university. I can access the University LDAP server but can't modify anything (it's readonly to me). I have several Linux machines, I want to config all the machines to authenticate via the university LDAP. (that's pretty easy, right?). Problems are:

Only a subset of LDAP users are allow to log in to the machine, (I know it can be done via LDAP group or additional LDAP attribute, but I can't modify anything in the university LDAP) Some users may not be in the LDAP but have accounts on the machine My thought is: use the /etc/passwd as the user-list: if (a user is NOT in the list) { he can't log in, } else { if(he is in LDAP) { check his password again the university LDAP } else { check his password againt /etc/shadow } }

Is there any solution? Any help appreciated.

share|improve this question
up vote 0 down vote accepted

For allowing only a subset of LDAP users to login:

  1. If you have a way to filter them without modifying the LDAP server, then you can add the filter to your /etc/nslcd.conf file, e.g.:

    filter passwd (objectClass=localAccount)
    
  2. Otherwise, you'll have to allow all LDAP users as local users and grant permissions just to the ones that you want, e.g., by changing /etc/security/access.conf and/or /etc/ssh/sshd_config.

For having additional local users, on top of those from the LDAP server, you'll need your /etc/nsswitch.conf file to contain something like:

passwd: files [unavail=return] ldap
group:  files [unavail=return] ldap
shadow: files ldap

I hope I'm not forgetting something...

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .