sssd gpo supports all what pam supports, so you can have users able to
login locally , but not ssh or the other way round.
Why not change the login shell:
the user might be a web admin, so needs access to a range of linux
boxes, running webservers, but not on the mail servers for example.
if you have to maintain a lot of machines, it is just easier and less
error prone to also be able to manage the access from a central point.
This way, it is just a matter of moving the web servers in the right OU
and all web admins have automatically access to the web servers, etc...
if you only have a few machines, you might as well change it on the
machine itself.
In my specific situation: I create a lot of virtual machines from 1 or 2
templates
When I get sssd-ad and GPO working, I dont need any modification
whatsoever. I just assign the machine to a specific department and all
the right people have access to only their set of machines.
Regards, Koen
Rowland Penny <mailto:repenny241155@gmail.com>
23 Jan 2015 22:54
OK, what about user walking up to unix machine and logging in ? what
about ssh ? wouldn't it be easier to just change the users login shell
to /bin/false ?
Rowland
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Lukas Slebodnik <mailto:lslebodn@redhat.com>
23 Jan 2015 22:31
There is a design document[1] for GPO and pdf attachement in mail[2]
contains "gpo data flow diagram".
All this information can be too technical.
HTH
LS
[1]
https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration
[2]
https://lists.fedorahosted.org/pipermail/sssd-devel/2014-September/020758...
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Rowland Penny <mailto:repenny241155@gmail.com>
23 Jan 2015 22:24
On 23/01/15 21:10, Koen de Boeve wrote:
OK, I'll believe you, now could someone explain how sssd can read a
GPO that is supposed to (as far as I know) alter the registry on a
windows machine and use those settings on a Linux machine that does
have anything like a registry ?
Rowland
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Rowland Penny <mailto:repenny241155@gmail.com>
23 Jan 2015 22:01
On 23/01/15 20:58, Koen de Boeve wrote:
Thought so, forget it, Linux knows absolutely nothing about GPO's
Rowland
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
Koen de Boeve <mailto:koen@galaxystudios.com>
23 Jan 2015 21:58
Yes I am Rowland, well it is a separate Policy specifically for linux
machines.
Regards, Koen