Hi This is swastik

I want that only my domain members will be able to use network resource as Internet.
Other User will not be able to access any services through my domain.

Someone says me that this will be through LDAP. I dont have any idea how to do it.
It is very required for me to do that in my office today.
Plz help me .
Regards:-
--------------
swastik
swastikmohangupta@gmail.com

What kind of use do you mean by "access any services through my domain" ?

Prevent users from logging in by not giving password. But if these are users you need to allow shell login, but still prevent them from accessing the internet, that's much harder.

It is too unclear what you mean by these resources. Since different things may need different methods to control access, there isn't a good way to answer this until we know more.

i'll brief what exactly i am having:-

1. There is a central domain controller over windows server 2008 for 15 locations.
2. There is a central DHCP server for 15 locations over which 15 different ip pools have been defined for the respective location.

Now,i am looking for some solution with which i can restrict any unauthorized user(which is not in the list of users on domain controller)..

Searching over the internet somewhere i found that something i have to work with LDAP.

Kindly Suggest

Regards:-
------------------
swastikmohangupta@gmail.com

One of possible ways to solve the problem is configuring a Squid proxy server to authenticate off Active Directory.
http://wiki.squid-cache.org/ConfigEx...ctiveDirectory

Another way (not so nice) is to create a separate file/database (independent of domain controller) and it will authorize users. It may have the same login/password pairs as the domain's are. But if your domain security policy is to change passwords every N days, this scheme will be not so elegant.
You may configure MySQL authentication http://wiki.squid-cache.org/ConfigEx...enticate/Mysql
or NSCA authentcation (login:encrypted_password file) (no link, Google please)

http://wiki.squid-cache.org/ConfigEx...ctiveDirectory

I tried to do this by above link.
In Authentication options of above link there are below methods.
Negotiate/Kerberos, Negotiate/NTLM, NTLM and basic authentication
I am unable to think which method is better.
Plz help me do this by giving step by step method through text or video link

Regards:-
--------------------
swastikmohangupta@gmail.com

Of the methods listed, Kerberos would be the most secure, also the most complex. Samba with WinBind (Windows Authentication) would be second, followed by basic authentication. The decision should be based upon your needs, as well as whether or not you already use Kerberos as part of your Windows Domain (you probably do).
The short answer you will likely receive to this request is: no. You need to do your own searching for instructions on how to accomplish this task. In fact, the link you provided looks pretty good to me as far as a step by step set of instructions. If there are parts of this process that you don't understand, then you need to read, research and learn the missing pieces. Trying to just implement a service of this nature with said understanding will lead to failure or a terribly insecure system. It doesn't matter how badly you believe you need it RIGHT NOW, you must develop the understanding of what you are attempting to do when it comes to centralized authentication systems.

1 members found this post helpful.

Seeing as you have centralised your DHCP you could make it so that only known devices (mac addresses) are given a lease, although if someone really wants to get on your network they can but this is probably going to be the case regardless.

Also not to point out the obvious but this is a "linux" forum and no where have you stated you are actually using any type of linux so perhaps asking the same question in a Microsoft based forum might yield some more responses.