0

We have LDAP server with 300+ users-10 servers with different group. when we creating the users, every user has access of all the 10 servers. So I want to restrict the user access. So LDAP user or LDAP user group only access the specific servers. Our users are access the servers using SSH. how to do the restrict from LDAP.

This is what I got from the internet, But this way I want to do it for each user :( LDAP RESTRICT SERVER LOGIN

Is there any other way to implement using LDAP Groups? I couldn't find relative information on google. Thanks

4
  • Access HOW ? ssh? Console-Login? Web ?
    – Marco
    Jun 17, 2022 at 8:03
  • @Marco Please check now, I edit the question, Users are access the servers via ssh
    – Dinesh KS
    Jun 17, 2022 at 9:09
  • 1
    What about "AllowGroups" ? see man sshd_config
    – Marco
    Jun 17, 2022 at 10:15
  • Thanks @Marco. It is working and info is really helpful.
    – Dinesh KS
    Jun 22, 2022 at 4:51

1 Answer 1

0

Thanks for info @Marco

When I added the AllowGroups in sshd_config, I got the errors like invalid credentials.

pam_ldap: error trying to bind as user "cn=test user,ou=people,dc=example,dc=com" (Invalid credentials)

This error is pop up because pam_groupdn is not enabled and pam_member_attribute.

Changed the setting in /etc/ldap.conf Enable the pam_groupdn and pam_member_attribute

pam_groupdn

# Group to enforce membership of
#pam_groupdn cn=PAM,ou=Groups,dc=padl,dc=com

pam_member_attribute

#pam_member_attribute uniquemember

Then added the AllowedGroups in sshd_config

it is working as expected.

Note: Add your sudo users or group in AllowGroup or AllowUser, else you will get blocked for sudo access.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .