(CCing the list) On 08/03/12 11:31 +0800, Qian Zhang wrote: Personally, I prefer to place authorization attributes within the user's dn, rather than to maintain groups for the same purpose, but I have done it both ways in the past. Using 'nssov-pam userhost [...]' would be a good way to do that. -- Dan White