Hello Ian,
On Sun, 15 Apr 2001, Ian Macdonald wrote:
> I currently have my PAM configuration file for su set to use
> pam_wheel, followed by pam_ldap as follows:
> auth sufficient /lib/security/pam_rootok.so
> auth required /lib/security/pam_wheel.so
> auth sufficient /lib/security/pam_ldap.so
> auth required /lib/security/pam_unix_auth.so use_first_pass
> account sufficient /lib/security/pam_ldap.so
> account required /lib/security/pam_unix_acct.so
> password required /lib/security/pam_cracklib.so
> password sufficient /lib/security/pam_ldap.so
> password required /lib/security/pam_pwdb.so use_first_pass
> session required /lib/security/pam_unix_session.so
> However, the effect is not quite the desired one. pam_wheel only
> consults the local /etc/group file to find users who are allowed to
> su, whereas I would like an LDAP server to be queried instead.
> This would greatly ease administration, since we could just add or
> remove a user from the wheel group in LDAP and instantly either
> empower or emasculate said user across all of our systems.
> We could then also configure other applications to allow only certain
> users to use them, by having pam_wheel query over LDAP for membership
> of other groups than just wheel. This would be an extremely powerful
> feature.
> So, is there any way of getting pam_wheel to go over LDAP for its
> look-ups?
To do group lookups via LDAP, you should have the following line in
nsswitch.conf:
group: files ldap
And you should make sure that you don't have a 'wheel' group listed in
/etc/group. This is because NSS doesn't allow you to combine group entries
from multiple NSS backends: getgrnam("wheel") will return either the entry
from LDAP or the entry from /etc/group, depending on which is specified first
in nsswitch.conf. (I strongly recommend listing 'files' before 'ldap' for
security reasons; if someone has gone to the trouble of explicitly setting up
a user or group on the local machine, you normally don't want someone to be
able to override that setting in the network database.)
HTH,
Steve Langasek
postmodern programmer
