Hi,
You might want to check out nisNetgroup functionality.
1. add rfc2307bis to Your nis.schema:
#attributetype ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' # DESC 'Netgroup triple' # SYNTAX 1.3.6.1.1.1.0.0 )
# rfc2307bis attributetype ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' DESC 'Netgroup triple' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
2. add nis-netgroups to Your directory:
dn: cn=myhostname,ou=Netgroup,dc=example,dc=com objectClass: top objectClass: nisNetgroup description: users allowed to log in to myhostname cn: myhostname nisNetgroupTriple: (,user1,) nisNetgroupTriple: (,user2,) ...
3. add compat-mode to nsswitch.conf:
passwd: compat passwd_compat: ldap group: compat group_compat: ldap
4. add netgroup-entries to /etc/passwd and /etc/shadow:
Last line of /etc/passwd: +@ myhostname:x:::::
Last line of /etc/shadow: +@ myhostname:NP:::::::
Now only local users and users listed in dn: cn=myhostname,ou=Netgroup,dc=example,dc=com can log in to the machine.
For easy administration You can group together users in netgroups and allow those as memberNisNetgroup:
dn: cn=myhostname,ou=Netgroup,dc=example,dc=com objectClass: top objectClass: nisNetgroup description: users allowed to log in to myhostname cn: myhostname memberNisNetgroup: rhdmin memberNisNetgroup: mysqldba ...
Regards
Juergen Sprenger