adding authenticated AD user to wheel

daisychick · 12-02-2011, 04:26 PM

CentOS 5.5

so, I have this little bash wrapper that's supposed to control access (see below). I can login fine with my credentials but I am a domain admin. I created a test user that is only a member of domain users and added it to the wheel group.

wheel:x:10:root,testuser,galaxy

however, I can't login with it. It requests password and locks the user out after three wrong password per AD group policy. Suggestions?

Code:

#!/bin/sh

# This script restricts shell access to privileged users. The "template shell"
# option in the '/etc/samba/smb.conf' file should be set to call this wrapper.

# Get group memberships for this user.
BFN_ID=$(/usr/bin/id)

# Grant shell access to users that are in the local wheel group.
if /bin/echo "$BFN_ID" | /bin/grep -P '[=,][0-9]{1,8}\(wheel\)' > /dev/null
then
exec /bin/bash --login "$@"
fi

# Grant shell access to users that are in the domain administrators group.
if /bin/echo "$BFN_ID" | /bin/grep -P '[=,][0-9]{1,8}\(domain\ admins\)' > /dev/null
then
exec /bin/bash --login "$@"
fi

# Else print a notice and just exit.
echo "Shell access to this computer is disabled."

# eof

War3zWad|0 · 12-03-2011, 03:03 AM

You should not need to use the wrapper for this access. Make sure that you have added the correct ACL rules for Reading and Authenticating against the LDAP database. I know that I missed this step several times when I first started working with LDAP.

Assuming that you have all the correct ACL rules setup check the logs for any kind of indication as to why Authentication failed. Depending on how you have your LDAP configured you may want to look into 389DS which is a RHEL based LDAP GUI that if I remember correctly has a "User Guide" for some of the basics.

I personally use SUSE Linux for my LDAP setup and once I had the right ACL rules in place I didn't have a problem. At first I couldn't figure out how to allow users to authenticate against the LDAP Server. The 2 ACL rules that I can remember off the top of my head that are needed were as follows:

Code:

everyone can authenticate
authenticated users can read all

I know I added 2 other rules. One had to do with authenticated dn, unfortunately my LDAP box is in storage and is not readily available. However if needed I can setup an VPS with LDAP to provide some pointers. I originally learned LDAP for a CDC competition.