On 05/12/2006, at 4:28 AM, Ben Wheare wrote:
Hiya,
I'm trying to set up a Samba PDC with an LDAP backend.
I experienced problems joining machines to domains, the machine
account was created, but Windows said user name cannot be found.
I resolved this by adding ldap to /etc/nsswitch.conf, but this has
the side effect of allowing ldap users to login to the server via SSH.
Whilst I can understand the need for LDAP users to be accessible to
the system, i.e. checkpwnam etc for permisisons, I don't want users
to be able to login to anywhere except the client Windows 2000/XP
boxes.
People (only 3) who can login via SSH already have "real" user
accounts in /etc/passwd etc.
Do these people have multiple user accounts? (one for samba and one
for their "real" one?) ... I would consider it a bad idea to do so
(IMHO).
Is there a way to stop this being allowed?
The way I achieve this (since in my setup I'm the only person who is
allowed to log into the linux boxes) is to make sure all other users
have no password entry in the ldap database (note: they have the
samba passowrd entries, just not the posix one), and to make sure
their home folder is /dev/null and their login shell is /bin/false.
I think if there's also probably a shadow option that disables the
posix account (haven't checked yet) - since my method may be able to
be bypassed by a user executing a given command at the ssh command
line - actually I'll look into that as soon as I get into work today.
I'm not sure if doing that would actually prevent samba from using
the account for SMB purposes.
--
Matt Skerritt
[EMAIL PROTECTED]
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
