I have openldap (phpldapadmin) that sync all users to Linux Debian servers,if I try to add LDAP user as Linux user I got error user already exist (I know its not a valid)

aabuhasna@qa:/$ who am i
aabuhasna pts/1        2016-06-16 03:38 (XXXXX)
aabuhasna@qa:/$ sudo adduser aabuhasna
[sudo] password for aabuhasna:
adduser: The user `aabuhasna' already exists.
aabuhasna@qa:/$ cat /etc/passwd |grep aabuhasna

In the openldap if the user doesn't have /bin/bash as loginshell then he can NOT login to any server at all, my problem I want user only to access three servers only with his LDAP information,

My questions:

  • Can I add the user to /etc/passwd as a workaround to make him login, if yes please advice about the correct way to add it.
  • if option one is not valid (adding the user to /etc/passwd) is there a file that can be change to make exception for this use.
  • Take a look at the pam_succeed_if module and the user ingroup group operator. – Patrick Jun 16 '16 at 12:14

There are two ways I know of to accomplish what you're trying to accomplish. The first is to use the pam_access module on each individual server to allow/disallow access on a per-user basis. The second is to use the pam_check_host_attr directive in /etc/pam_ldap.conf, enabling this on all servers, and then create an attribute:value pair associated with a given user ID for each server that user should be able to log in to.

For example, after enabling this on a hostname "gargoyle", if I want user ben to be able to login to that host, I must add the attribute/value pair "host:gargoyle" to ben's LDAP entry.


John's answer will work.

Alternatively, the filter statement in the nss_ldap or nslcd configurations allows you filter users by random LDAP filters; e.g.,

filter passwd (|(uidNumber=1234)(gidNumber=1234))

This example will only define users with uid or gid '1234' on the current machine. You can use any valid LDAP filter here. The difference with John's solution is that with this, the filtered-out users will not even exist on this server (I.e., getent passwd for these users will return nothing).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.