Hi,

Working with pam_access.so and /etc/security/access.conf. RHEL3, there is a NIS server running.

this is my access.conf
===================
# permission : users : origins
+:root:ALL
+:@allow:ALL #allows netgroup "allow"
-:@deny:ALL #denies netgroup "deny"
+:reg:ALL #allows user reg
-:ALL:ALL #denies all
===================

my getent output (so u know my nis is working)
===================
[root@bjicyz110 root]# getent netgroup allow
allow ( , testaccount, )
[root@bjicyz110 root]# getent netgroup deny
deny ( , reg, )
===================

my /etc/nsswitch.conf (i only list 3 important lines)
===================
passwd: files nis
group: files nis
netgroup: files nis
===================

my /etc/sysconfig/network is correct with the NISDOMAIN entry.


1) with the above configuration of access.conf, user reg is able to login, even though -:@deny is above it. so reg is getting in because of line 4 in access.conf
2) with the above configuration user testaccount cannot log in even though +:@allow allows it.
3) so basically pam_access.so is not reading the @deny or @allow in the access.conf file. I am not sure what is wrong. I know NIS is working and getent is replying correctly.

Is there a problem with pam and NIS netgroup? am I missing some configuration somewhere?

Hi,

I install another system to test, same RHEL 3 ES, and it work just fine. I try matching up the configurations but the trouble system still did not work. After spending many hours looking around, I cannot find the problem. I decided to reinstall the system and it is working fine now. What I learn and maybe someone would find it useful is information about netgroup. I find that documentation and examples are lacking in the internet, especially when you started nesting one group into another. Here is what I do to get nesting one group inside another to work.

groupA (,userA,) (,userA1,)
groupB (,userB,) (,userB1,)
groupC groupA (,userB1,)

here groupA also belongs to groupC and includes userB1.
Sometime you will see this format (-,userA,-) man pages say that - makes searches faster. I have a very small map, so I didn't use this format.