0

I need to add users to a specific group on Linux automatically to allow running some programs from another user with no password prompt like:

su nopswduser -c 'echo Hello'

I'm adding group to local users automatically by extending EXTRA_GROUPS parameter in /etc/adduser.conf

Here is my configuration for /etc/pam.d/su for su with no password prompt.

auth    [success=ignore default=1] pam_succeed_if.so user = nopswduser
auth    sufficient pum_succeed_if.so use_uid user ingroup nopswduser

All it is works well. The problem is that I have a Active Directory users that can login to Linux machine. Domain membership configured by using samba/winbind. /etc/adduser.conf configuration is not working for AD users. I tried to use group mapping like that way:

net groupmap add ntgroup="domain users" unixgroup="nopswduser" rid=1234 type=l

But it didn't make any sense and when user trying to su nopswduser in terminal appears password to prompt. I tried to configure PAM system to add user to group automatically on login by modifying /etc/security/group.conf with line:

*;*;*;Al0000-2400;nopswduser

And adding this lines to /etc/pam.d/common-auth and /etc/pam.d/login

auth    optional    pam_group.so

When I'm login from AD account group appears in uid command, but when I'm trying to su nopswduser terminal asks for password like user is not in group.

There is no problem when I'm manually adding AD user for /etc/group, but I need to do this automatically because I don't know who concretely of AD users can login to Linux machine.

There is MX Linux 19.4 running on machine. Domain is controlled by Windows Server 2003.

Improve this question

1 Answer 1

Reset to default
0

It sounds like your Linux computer is domain joined, if so, then you don't map an AD group to a Linux group, you just make the AD group into a Linux group.

Improve this answer
2
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Oct 29, 2021 at 20:26
  • As I mentioned I have local users. And I have suspicions that users won't be able to su to another user without password if they are not inside his primary group.
    – Mikhail Kulikov
    Nov 3, 2021 at 10:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .