> #2 > a.there is also a setting in /etc/ldap.conf called pam_groupdn. This > lets you define an LDAP object with multiple membe attributes to > control who can login. I find it easy to use > b. SSH can be told to only accept logins from a posix group (same deal > just handled at a different part of the stack) One other question came to mind, and that was users with ssh keys. How will migrating to LDAP-only authentication affect them? Is there a way to continue allowing these users to use their keys for logins?
