Restrict user logins when using NIS

[David Spencer_1]

I'm running RH 3 update 3 and want to restrict logins to our Admin team on our critcial servers. The systems are using NIS for password and group information. I created local logins for admins which work but need to disable the general users accounts from logging in. How can this be accomplished?
(These servers are also NIS slave servers.)
Thanks.

[Stuart Browne · Accepted solution]

If you've got a fixed, known-list of allowed logins for these machines, then '/etc/pam.d/login' is your friend.

Read the documentation (in '/usr/share/doc/pam-0*/txts/') with regards to 'pam_wheel' and 'pam_listfile'.

One of these two will be able to restrict based on the user they are logging in as, or the group they belong to.

[Ivan Ferreira]

You can modify the /etc/pam.d/login file an stack an listfile restriction, like this:

auth required pam_listfile.so item=user sense=allow file=/etc/adminusers
onerr=fail

So only users listed on /etc/adminusers will be allowed to login.

[David Spencer_1]

The /etc/pam.d/login edits work fine for my log in restrictions. Thanks for the assistance.