Locally deny login to users authenticated via LDAP

Question

I have a RedHat Linux server that are is use for more than 1000 users

Users names are coming to the server via LDAP protocol, so login authentication is from the LDAP

My question: is it possible to block user login on the local machine, while users names come from LDAP?

Answer 1

Authentication logic is usually handled by PAM nowadays. My guess is you should be able to set this up in PAM's configuration files (in my case, in /etc/pam.d).

Common authentication logic is stored in common-auth. In your case, I'm guessing you should have something like this:

auth    [success=2 default=ignore]   pam_unix.so nullok_secure
auth    [success=1 default=ignore]   pam_ldap.so use_first_pass
auth    requisite                    pam_deny.so
auth    required                     pam_permit.so

... or maybe something a little simpler, like:

auth    sufficient                   pam_unix.so nullok_secure
auth    sufficient                   pam_ldap.so use_first_pass

... depending on whether LDAP is the first or second source compared to standard UNIX authentication (considering it is also involved).

Now, if you want to disable LDAP authentication on a machine, or deny access to LDAP-authenticated users, all you have to do is remove that source from PAM's configuration, and have it rely on UNIX authentication only:

auth    [success=1 default=ignore]   pam_unix.so nullok_secure
auth    requisite                    pam_deny.so
auth    required                     pam_permit.so

• When pam_unix.so succeeds, skip 1 element from the rest of the chain (pam_deny.so), and evaluate the next (pam_permit.so). This means that when UNIX authentication fails, the user gets thrown into pam_deny.so, which results in an authentication failure. When it succeeds, it gets to pam_permit.so, and is granted access to the system.
• LDAP is not involved here, meaning that any user that is not stored in /etc/passwd cannot access the system.

Now, if you want to specifically block LDAP users...

auth    [success=die]                pam_ldap.so
auth    sufficient                   pam_unix.so

• When pam_ldap.so succeeds, return a failure code and terminate the chain. If it fails, pam_unix.so is sufficient to access the system.
• This will interrupt all PAM authentications whenever LDAP credentials match. UNIX users can still access the system.

Of course, there are many other ways to configure PAM, and some are probably better/more efficient than those I just gave. For more information about this, have a look at this page. Just a side note though: before you start playing with PAM's configuration, make sure you have a root terminal running safely somewhere. If you mess up the authentication logic, you'll be more than happy to access /etc/pam.d again and revert your changes :)

Another side note: while PAM handles authentication (and some other stuff), name resolving is handled by NSS (Name Service Switch), the configuration for which can be found in /etc/nsswitch.conf. If you leave LDAP in this file, then the system will still know about these LDAP users, but won't let them in. Basically, it allows the system to match UIDs to names, for example when you're listing the contents of a directory (ls -l) and getting the files' owners.

You may also remove this LDAP name source by editing the NSS configuration, but I wouldn't recommend it if your users actually own files available on the machine.