Fedora directory users - Nov 2007 - Restricting Users Login Question

I am setting up a Fedora Directory Server for use in our company. Our problem
now is that any user that has a posix account (which it is necessary for every
user to have a posix account due web applications and our heavy use of Linux
machines) can log into machines we do not want them having access to (ie
production web servers, gateways, firewalls, etc etc etc).
Yes, we could lock it down via sshd_config on the servers with the AllowUsers
statement, but that would not prevent them from being able to log in on the
local machine.
I have changed my ldap.conf on my linux / bsd machines to allow only the
following:

pam_groupdn cn=syadmins,ou=IT,ou=Groups,dc=company,dc=tld 
# Group member attribute 
pam_member_attribute uniqueMember 

This does and does not work. When logging into the server with a user that is
not a member of that group, I get the following warning:
You must be a uniqueMember of cn=syadmins,ou=IT,ou=Groups,dc=company,dc=tld to
login
But it logs me right in. 
I have posted the full ldap.conf here: 
http://pastebin.com/m11b0b227 
Here is the shorter version (minus all commented out stuff) 
http://pastebin.com/m26f9048d 

Any help or pointers would be appreciated. 



-- 
- Thank you, 
- Jared B. Griffith 
- Farheap Solutions, Inc. 
- Lead Systems Administrator 
- California IT Department 
- Email - jared.griffith@farheap.com 
- Phone - 949.417.1500 ext. 266 
- Cell Phone - 949.910.6542

On Redhat 4.1, using PAM, we use /etc/security/access.conf

the relevant line is
-:ALL EXCEPT wheel permitted-ldap-group-for-this-box  permitted-ldap- 
group-for-this-box-root:ALL

so that''s deny everyone from everywhere, except people in these three  
groups.

So, any local accounts (if your connection to your LDAP box fails,  
you need a backup account) that can log in are in the wheel group.

Then, normal users are in the "permitted-ldap-group-for-this-box"  
group are also allowed on

Further, those in "permitted-ldap-group-for-this-box-root" are also  
allowed on, and that group also appears in /etc/sudoers to control  
which users can also use sudo.

you just define groups of boxes that should have similar access  
authorization, make a group for that set of boxes, add that group to  
the access.conf, and then add the users you want to allow to those  
boxes to that group.

Rinse and repeat for the other classes of boxes.

Timothy

On Nov 12, 2007, at 8:11 PM, Jared B. Griffith wrote:
> I am setting up a Fedora Directory Server for use in our company.   
> Our problem now is that any user that has a posix account (which it  
> is necessary for every user to have a posix account due web  
> applications and our heavy use of Linux machines) can log into  
> machines we do not want them having access to (ie production web  
> servers, gateways, firewalls, etc etc etc).
> Yes, we could lock it down via sshd_config on the servers with the  
> AllowUsers statement, but that would not prevent them from being  
> able to log in on the local machine.
> I have changed my ldap.conf on my linux / bsd machines to allow  
> only the following:
>
> pam_groupdn cn=syadmins,ou=IT,ou=Groups,dc=company,dc=tld
> # Group member attribute
> pam_member_attribute uniqueMember
>
> This does and does not work.  When logging into the server with a  
> user that is not a member of that group, I get the following warning:
> You must be a uniqueMember of  
> cn=syadmins,ou=IT,ou=Groups,dc=company,dc=tld to login
> But it logs me right in.
> I have posted the full ldap.conf here:
> http://pastebin.com/m11b0b227
> Here is the shorter version (minus all commented out stuff)
> http://pastebin.com/m26f9048d
>
> Any help or pointers would be appreciated.
>
>
>
> -- 
> - Thank you,
> - Jared B. Griffith
> - Farheap Solutions, Inc.
> - Lead Systems Administrator
> - California IT Department
> - Email - jared.griffith@farheap.com
> - Phone - 949.417.1500 ext. 266
> - Cell Phone - 949.910.6542
> --
> Fedora-directory-users mailing list
> Fedora-directory-users@redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users