LDAPux Filters

[David Whitley]

Is there a method for supplying machine specific filters for the password base search without creating ldapux profiles for each machine?

We are using LDAPux on our HP clients and nss_ldap on our Linux clients. Both sets of clients are retrieving userid and group information from Windows 2003 AD.

On our Linux clients it is possible to alter the machines search by specifing a filter on the nss_base_passwd field similar to:

nss_base_passwd dc=abc,dc=net?sub?MemberOf=CN=machine1,OU=groups,DC=abc,DC=net

This will allow only users with group of CN-machine1 to be visable to machine1. The same command can be repeated for machine2..machineN.

Since the ldapuxprofile is shared among all hpclients. It does not appear as though we can use this type of filter, unless we create individual profiles for each machine.

Is there a method or overriding the profile global default filter on a machine by machine bases? or some other method of reducing the number of userid visable via the pwget type commands?

[Bob Neal-Joslin]

To filter out which users show up on a host (are visible through NSS), you would need a unique profile for each host.

However, if your goal is to allow logins only from a select set of users, then you can do that with pam_authz (part of LDAP-UX). You can define which groups of users are allowed to login to a host based on a number of criteria, such as the one above (filtering based on a MemberOf attribute).

Refer to "LDAP-UX Client Services B.04.15 Administrator's Guide (edition 9)" at http://docs.hp.com/en/J4269-90083/J4269-90083.pdf. Refer to chapter 5, subsection "PAM_AUTHZ Login Authorization".

You would create the /etc/opt/ldapux/pam_authz.policy and place your filtering rule in there. With ADS, there are two ways to achive the above restriction:

allow:ldap_group:CN=machine1,OU=groups,DC=abc,DC=net

or

allow:ldap_filter:(MemberOf=CN=machine1,OU=groups,DC=abc,DC=net)

Hope that helps,

Bob