<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA256<br>
<br>
Stephen,<br>
<br>
That worked just great, thank you!<br>
<br>
Best regards,<br>
George Vasiliu<br>
Security Admin<br>
Hostopia, a Deluxe Company<br>
E-Mail: <a class="moz-txt-link-abbreviated" href="mailto:gvasiliu@hostopia.com">gvasiliu@hostopia.com</a><br>
Tel: 416-883-6785, Cell: 647-924-7257<br>
Key ID: 0x2D0D7895<br>
Key Server: keys.gnupg.net<br>
On 05/13/2014 04:21 PM, Stephen Gallagher wrote:<br>
<span style="white-space: pre;">> On 05/13/2014 03:56 PM, George
Vasiliu wrote:<br>
><br>
> > Hi,<br>
><br>
> > We're migrating from pam_ldap to sssd and so far
everything works<br>
> > as expected: ldapsearch, getent passwd <user>,
getent group<br>
> > <group>, tested offline caching, great product!<br>
><br>
> > From a security perspective, nslcd ( CentOS 6) is not
able to get<br>
> > any users that are not part of certain allowed groups by
having<br>
> > "filter passwd LDAP_FILTER" in /etc/nslcd.conf. Is there
any<br>
> > similar functionality I could use with SSSD to prevent
exposing<br>
> > whole ldap tree? Do filter_groups or/and filter_users
work with<br>
> > ldap filters?<br>
><br>
><br>
> Take a look at the sssd-ldap(5) manpage[1] and search on<br>
> 'ldap_search_base'. It has an optional component that allows
you to<br>
> specify a filter limiting the lookups.<br>
><br>
> In your specific case, you're probably looking for:<br>
><br>
> ldap_user_search_base =<br>
>
ou=users,o=Example,dc=example,dc=com?subtree?(|(description=CN=prod,OU=groups,O=Example,DC=example,DC=com)(description=CN=sec,OU=groups,O=Example,DC=example,DC=com))<br>
><br>
><br>
> [1]<br>
>
<a class="moz-txt-link-freetext" href="http://jhrozek.fedorapeople.org/sssd/1.11.5.1/man/sssd-ldap.5.html">http://jhrozek.fedorapeople.org/sssd/1.11.5.1/man/sssd-ldap.5.html</a><br>
><br>
> _______________________________________________<br>
> sssd-users mailing list<br>
> <a class="moz-txt-link-abbreviated" href="mailto:sssd-users@lists.fedorahosted.org">sssd-users@lists.fedorahosted.org</a><br>
> <a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/sssd-users">https://lists.fedorahosted.org/mailman/listinfo/sssd-users</a><br>
></span><br>
<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1<br>
Comment: Using GnuPG with Thunderbird - <a class="moz-txt-link-freetext" href="http://www.enigmail.net/">http://www.enigmail.net/</a><br>
<br>
iF4EAREIAAYFAlNyg5sACgkQeQrbMxAIdW2EwwD9GY3NIRrVhQ8NuINDvL7PdRll<br>
JZgRT6aaFSypXg8oUlYBAIE3DhsV4k5ogsckeVq9IUoq/KxdOwwnD9Vs8XNPZKOT<br>
=RqZt<br>
-----END PGP SIGNATURE-----<br>
<br>
</body>
</html>