Configure LDAP Host Access 389
Configure LDAP Host Access 389
It’s a common security practice to require a special LDAP attribute in order to allow only specific users to a system that may contain sensative data, such as databases, file servers, or infrastucture type servers.
Let’s get Started.
Server configration:
Login to the 389-Console
Find a user that you want to gran special access to, in this case we will use bob.
go to the properties of the user, and make sure all POSIX info is filled out before proceeding to the next step:
once completed, we can proceed on to add the host attribue to the LDAP account.
Right-Click, and go to the Advanced Properties of the Account:
- Click on the “object class” section
- Add Value –> Hostobject, hit ok
- Add Attribute –> host –> hostname.yourdomain.local
so in the end you will have the new “hostobject” added to your object class
and the host(s) that you want to allow are as follows, you can add multiple, by hitting “Add Value”
or there’s the CLI way:
# andrew, domain.local
dn: uid=whoever,dc=domain,dc=local
host: somehost.domain.local
ldapadd -D “uid=admin,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot” -h 127.0.0.1 -W -f host.stuff.above
Client Configuration:
vi /etc/sssd/sssd.conf
in your LDAP/Domain Section, customize, and add the following:
now restart sssd
PAM Configuration:
vi /etc/pam_ldap.conf
pam_check_host_attr yes
Troubleshooting:
This is the normal error(s) you see in /var/log/secure when a user who DOES NOT have the LDAP attribute, and tries to log in.
Feb 11 21:55:04 server1 sshd[26719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=someserver.yourdomain.local user=joe
Feb 11 21:55:04 server1 sshd[26719]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=someserver.yourdomain.local user=joe
Feb 11 21:55:04 server1 sshd[26719]: pam_sss(sshd:account): Access denied for user joe: 6 (Permission denied)
Feb 11 21:55:04 server1 sshd[26719]: Failed password for joe from 192.168.117 port 58066 ssh2
Feb 11 21:55:04 server1 sshd[26720]: fatal: Access denied for user joe by PAM account configuration
That’s it! You now should ONLY be able to login to the servers that you have specified a host attribute in LDAP.