topic Restricting Access to Linux Servers after connecting to Active Directory in Operating System - Linux

Restricting Access to Linux Servers after connecting to Active Directory

Fred Abell — Fri, 11 May 2012 14:38:20 GMT

Greetings,

I have successfully connected my RH 5.8 servers to AD using Winbind. The problem is now anyone in AD can connect to the RH server. I need to allow only web developers to connect from different offices around the world. An AD solution is unlikely.

Fred

Re: Restricting Access to Linux Servers after connecting to Active Directory

Matti_Kurkela — Mon, 14 May 2012 07:52:17 GMT

In AD, your web developers are probably distinguishable by being members of a particular group. Or you could request the AD admins to create a group for the purpose. Having a separate group might be useful if you someday need to allow someone who is not a web developer to access the Linux servers, or you'll have a web developer which must not be allowed to access the Linux servers for some reason.

That group should be automatically mapped to a Linux group by winbind: use that group in your access control configuration for all relevant services, so that the login attempt will be rejected if the user does not belong to that particular group.

You could apply this either at the server level (for example, SSH has DenyGroups/AllowGroups directives available in /etc/ssh/sshd_config file), or at the PAM level using the pam_succeed_if module (see "man pam_succeed_if").

Something like this at the appropriate location in /etc/pam.d/system-auth might be what you're looking for:

auth required pam_succeed_if.so user ingroup <web_developers_group>

Remember that the order of lines in PAM configuration files is meaningful.

Re: Restricting Access to Linux Servers after connecting to Active Directory

Fred Abell — Mon, 14 May 2012 15:39:15 GMT

MK,

Thank you for responding. Unfortunately, there is no particular AD group to use. Users are scattered all over the world and isolating them via AD is impossible.

Fred

Re: Restricting Access to Linux Servers after connecting to Active Directory

Fred Abell — Mon, 14 May 2012 22:24:56 GMT

Having discussed this further, I think the AD way is the only way to restrict access.