[Fedora-directory-users] problems with pam ldap ?

[Bogdan Cehan]

Hello all 



I'm using the fedora directory server for centralized authentication ,
and i have made users with posix account and i put them in ou=People  
like this :
---------------------------------------------------------------------------------------------
# alexadu, People, pol.mediaimage.ro
dn: uid=alexadu,ou=People,dc=pol,dc=ro
givenName: Alexandra
sn: Dumitru
loginShell: /bin/bash
uidNumber: 1069
gidNumber: 100
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: posixAccount
uid: alexadu
cn: Alexandra Dumitru
homeDirectory: /home/alexadu
------------------------------------------------------------------------------------------
and after that i made some groups 
in ou=Groups 
like this :
-----------------------------------------------------------------------------------------
# Server1, Groups, pol.ro
dn: cn=Server1,ou=Groups,dc=pol,dc=ro
description: group for users that have access on server 1
objectClass: top
objectClass: groupofuniquenames
uniqueMember: uid=lauru,ou=People,dc=pol,dc=ro
uniqueMember: uid=alexadu,ou=People,dc=pol,dc=ro
cn: Server1
----------------------------------------------------------------------------------------


and my ldap.conf looks like this :



URI ldap://lacatzel.pol.ro
port=389
BASE dc=pol,dc=ro
host lacatzel.pol.ro
TLS_CACERTDIR /etc/openldap/cacerts
TLS_REQCERT allow
scope sub
bind_policy soft
#pam_password exop
pam_filter objectclass=posixAccount
pam_login_attribute uid
pam_member_attribute memberUid
pam_groupdn cn=Server1,ou=Groups,dc=pol,dc=ro
pam_check_host_attr yes
nss_default_attribute_value loginShell /bin/false
nss_base_passwd ou=People,dc=pol,dc=ro
nss_base_shadow ou=People,dc=pol,dc=ro
nss_base_group  ou=People,dc=pol,dc=ro
---------------------------------------------------------------------------------------------

now i want to restrict some users to servers based on groups but my pam_ldap 
does not help me to do that , I'm using my old friend "www.google.com" to 
help me in this problem but with no luck .....  all my users have access to 
this computer .... so , if i understand wright all i have to do is create 
users with posix account and after that create groups and put the users in 
that group but this does not work ..... any ideas ? anyone use FDS for what i 
intend to do ? 



Thank you for your time ..... 



Bogdan