Using NetGroup on 11i

[Philip Piotrowski_1]

Hi,

Got some problems enabling netgroup on my test server. Here's what I've done so far:

On the NIS+ master, created a netgroup "servers_sap_test" with the following entries:
(hsapt2,xx1234, ), (hsapt2,xx5678, )

On the server, I've added the line +@servers_sap_test at the end of the passwd file.

On nsswitch.conf, this line is added:
netgroup: nisplus [NOTFOUND=continue] files

Now, the issue is that doesn't prevent other users from connecting (ssh) to this server.
I want to restrict the access using netgroup
so it would be easier to manage from a single
machine.

Any help would be greatly appreciated.

Thanks

[Steven E. Protter · Accepted solution]

NIS+ ... Shiver.

Complex.

It would appear that you have not completed the configuration process. I see nothing in the steps you posted that should prevent ssh users from connecting.

ssh/openssh uses pam and the /etc/passwd and related security files for authentication. If the users are still there, ssh/openssh connections should still be possible.

SEP

[RAC_1]

Looks like ssh logins are not looking at netgroup entries. Please check, if there is something in this regatd that can be configured in sshd_config/ssh_config??

Anil

[Philip Piotrowski_1]

Thanks for you help.

Then, is there a way to use "DenyGroups" in
sshd_config and put a netgroup ?

Thanks again

[Philip Piotrowski_1]

Better with "DenyUsers" & "DenyGroups"
with sshd_config.