I'm trying to define different login shells for different users of an AD domain, as described here. The aim is to deny members of a particular group from logging in while allowing them to do SSH tunneling.
Here below is the file
/etc/sssd/sssd.conf. MYDOMAIN.GLOBAL is the default domain provided by the AD. The config below defines a test domain MYDOMAIN_TEST.GLOBAL, which is not in the AD, as the domain for these limited users. (This is just a configuration for testing: later, in the MYDOMAIN_TEST.GLOBAL domain section,
override_shell = /bin/zsh will be replaced by
override_shell = /sbin/nologin.)
[sssd] domains = MYDOMAIN.GLOBAL,MYDOMAIN_TEST.GLOBAL config_file_version = 2 services = nss, pam [nss] default_shell = /bin/bash [domain/MYDOMAIN.GLOBAL] ad_server = ad.mydomain.global ad_domain = MYDOMAIN.GLOBAL ldap_user_search_filter = (memberOf=CN=AdminsGroup,OU=Groups,DC=MYDOMAIN,DC=GLOBAL) id_provider = ad simple_allow_groups = [email protected] override_shell = /bin/bash [domain/MYDOMAIN_TEST.GLOBAL] ad_server = ad.mydomain.global ad_domain = MYDOMAIN.GLOBAL ldap_user_search_filter = (memberOf=CN=LimitedGroup,OU=Groups,DC=MYDOMAIN,DC=GLOBAL) id_provider = ad simple_allow_groups = [email protected] override_shell = /bin/zsh
A member of MYDOMAIN.GLOBAL is able to login via SSH, while a member of MYDOMAIN_TEST.GLOBAL can't and gets a "Permission denied, please try again" or a "Authentication failed" error.
sssd logfiles don't show any error.
Why is that?
Does MYDOMAIN_TEST.GLOBAL need to be present in the AD? If yes, is it possible to somehow bypass this and configure sss with different "local categories" of users to do what I want?