I need to add users to a specific group on Linux automatically to allow running some programs from another user with no password prompt like:
su nopswduser -c 'echo Hello'
I'm adding group to local users automatically by extending EXTRA_GROUPS parameter in /etc/adduser.conf
Here is my configuration for /etc/pam.d/su for su with no password prompt.
auth [success=ignore default=1] pam_succeed_if.so user = nopswduser
auth sufficient pum_succeed_if.so use_uid user ingroup nopswduser
All it is works well. The problem is that I have a Active Directory users that can login to Linux machine. Domain membership configured by using samba/winbind. /etc/adduser.conf configuration is not working for AD users. I tried to use group mapping like that way:
net groupmap add ntgroup="domain users" unixgroup="nopswduser" rid=1234 type=l
But it didn't make any sense and when user trying to su nopswduser in terminal appears password to prompt. I tried to configure PAM system to add user to group automatically on login by modifying /etc/security/group.conf with line:
*;*;*;Al0000-2400;nopswduser
And adding this lines to /etc/pam.d/common-auth and /etc/pam.d/login
auth optional pam_group.so
When I'm login from AD account group appears in uid command, but when I'm trying to su nopswduser terminal asks for password like user is not in group.
There is no problem when I'm manually adding AD user for /etc/group, but I need to do this automatically because I don't know who concretely of AD users can login to Linux machine.
There is MX Linux 19.4 running on machine. Domain is controlled by Windows Server 2003.
