restricting ldap unix groups to groups of hosts.