[SSSD-users] sssd-ad GPO not working

Koen de Boeve koen at galaxystudios.com
Fri Jan 23 22:22:53 UTC 2015


sssd gpo supports all what pam supports, so you can have users able to 
login locally , but not ssh or the other way round.

Why not change the login shell:

the user might be a web admin, so needs access to a range of linux 
boxes, running webservers, but not on the mail servers for example.
if you have to maintain a lot of machines, it is just easier and less 
error prone to also be able to manage the access from a central point.

This way, it is just a matter of moving the web servers in the right OU 
and all web admins have automatically access to the web servers, etc...

if you only have a few machines, you might as well change it on the 
machine itself.
In my specific situation: I create a lot of virtual machines from 1 or 2 
templates
When I get sssd-ad and GPO working, I dont need any modification 
whatsoever. I just assign the machine to a specific department and all 
the right people have access to only their set of machines.

Regards, Koen
> Rowland Penny <mailto:repenny241155 at gmail.com>
> 23 Jan 2015 22:54
>
>
> OK, what about user walking up to unix machine and logging in ? what 
> about ssh ? wouldn't it be easier to just change the users login shell 
> to /bin/false ?
>
> Rowland
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
> Lukas Slebodnik <mailto:lslebodn at redhat.com>
> 23 Jan 2015 22:31
>
> There is a design document[1] for GPO and pdf attachement in mail[2]
> contains "gpo data flow diagram".
>
> All this information can be too technical.
>
> HTH
>
> LS
>
> [1] 
> https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration
> [2] 
> https://lists.fedorahosted.org/pipermail/sssd-devel/2014-September/020758.html
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
> Rowland Penny <mailto:repenny241155 at gmail.com>
> 23 Jan 2015 22:24
> On 23/01/15 21:10, Koen de Boeve wrote:
>
> OK, I'll believe you, now could someone explain how sssd can read a 
> GPO that is supposed to (as far as I know) alter the registry on a 
> windows machine and use those settings on a Linux machine that does 
> have anything like a registry ?
>
> Rowland
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
> Rowland Penny <mailto:repenny241155 at gmail.com>
> 23 Jan 2015 22:01
> On 23/01/15 20:58, Koen de Boeve wrote:
>
> Thought so, forget it, Linux knows absolutely nothing about GPO's
>
> Rowland
>
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
> Koen de Boeve <mailto:koen at galaxystudios.com>
> 23 Jan 2015 21:58
> Yes I am Rowland, well it is a separate Policy specifically for linux 
> machines.
>
>
> Regards, Koen
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20150123/d7f7f5e9/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: compose-unknown-contact.jpg
Type: image/jpeg
Size: 770 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20150123/d7f7f5e9/attachment.jpg>


More information about the sssd-users mailing list