<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Thanks much for the responses. I'm
really glad I asked. <br>
<br>
To answer Roberto's question, my employer produces an appliance as
part of our "SecureData" portfolio. We try to get customers to
treat it as ... just that, an appliance. But they all know that
under the covers it's just Linux, so they often want to tweak it
to fit their "how we manage Linux" model, which varies. <br>
<br>
The appliance is CentOS based, but I also have an OpenSUSE guest
at HQ that I need to wire-in with our AD space there. Naturally
this game is very different between RH and SUSE. An LDAP question
from a customer (w/r/t the appliance) prompted me to revisit my
personal server, so it all converges now. <br>
<br>
<br>
On 10/20/2016 01:53 PM, Brian wrote:<br>
</div>
<blockquote
cite="mid:CAA6osQwGku8ye3c5SrQJyteCzHVotoh0QzOrVeBF3J9Q=yZSNA@mail.gmail.com"
type="cite">
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>When I convert my Linux servers to use LDAP, I
get the following line added to the end of
/etc/passwd:<br>
<br>
"+::::::".<br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
Yep, that's the one! Maybe that magic cookie gets used by runtime
and not by LDAP or Kerberos or YP specifically. I'll look for it on
the CentOS and OpenSUSE boxes I've been tinkering with. <br>
<br>
<br>
<blockquote
cite="mid:CAA6osQwGku8ye3c5SrQJyteCzHVotoh0QzOrVeBF3J9Q=yZSNA@mail.gmail.com"
type="cite">
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>And Jim is referring to another PAM module that
will create your home directory for you. That is
managed by a line in your default session config
file that reads <br>
</div>
</div>
</div>
</div>
<br>
session optional pam_mkhomedir.so<br>
</div>
</div>
</div>
</div>
</blockquote>
<br>
YESSS!!! That would be the piece I'm looking for. <br>
<br>
<br>
<blockquote
cite="mid:CAA6osQwGku8ye3c5SrQJyteCzHVotoh0QzOrVeBF3J9Q=yZSNA@mail.gmail.com"
type="cite">
<div>
<div>
<div>If not everyone in your LDAP domain should have access to
every server, you should also have a line in your default
account PAM config file that references pam_access.so:<br>
<br>
account required pam_access.so<br>
<br>
</div>
I think Red Hat does this by default. I have to add the line
manually on SuSE servers. You can then edit your
/etc/security/access.conf file to allow LDAP groups or users
(you would need to add any locally defined users, also) to
login to the system.<br>
</div>
</div>
</blockquote>
<br>
Awesome. For my HQ guest the whole AD/LDAP domain is open. But for
the customer case things need to be more selective. <br>
<br>
Portions deleted in this reply, but I'm taking notes. Thanks very
much, gentlemen. <br>
<br>
-- R; <><<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
</body>
</html>