topic LDAP netgroup problem (Continued) in Operating System - HP-UX

LDAP netgroup problem (Continued)

Glenn_73 — Tue, 29 Mar 2005 08:17:21 GMT

I have been having exactly the same problem as described in the "LDAP netgroup problem" thread by Alec Pringle 3/2/2005.

I tried the solution from that thread and at first glance it appears to work. I can now access the userids in the ldap directory. The problem is I can now access ALL the userids in the directory. The solution essentially turns off the netgroups.

I need to restrict access to the client to only those users in teh directory who are members of the netgroup.

Any ideas?

Re: LDAP netgroup problem (Continued)

RAC_1 — Tue, 29 Mar 2005 08:54:46 GMT

On the client, where you want to restice the access, you need to modify the /etc/passwd file as follows.

+@group_name

If you have + in /etc/passwd file, then all users will get access on this host.

man passwd for details.

Re: LDAP netgroup problem (Continued)

Glenn_73 — Tue, 29 Mar 2005 09:19:41 GMT

Yes indeed. My /etc/passwd has the +@group_name: at the end.

With the "passwd: compat" etc in the nsswitch it seems to recognize that it has to deal with netgroups. With the nsswitch set to "passwd: files [NOTFOUND] ldap" it appears to ignore the +@group thing and allow access to all the userids in the ldap directory.

This behavior make sense to me.

Perhaps another hint:

The finger comand appears to understand the netgroups and who is in it. Other commands like groups and su do not. In other words: when I have the "passwd:compat" in the nsswitch, and the +@group in the /etc/passwd, a finger will only show the userids in the valid netgroups. Other commands respond with "no such user".

As with Alec Pringle's thread, this all seems to work OK on my Solaris clients.

Re: LDAP netgroup problem (Continued)

RAC_1 — Tue, 29 Mar 2005 09:24:19 GMT

You certaily do not need
passwd : compact (It is for file and nis environment.)

You need as follows.

passwd: files [NOTFOUND=continue] ldap
group : file [NOTFOUND=continue] ldap
netgroup : ldap