SSH with ADS authentication

[allen4all]

Hello all,

Here is the scenario that I’m facing.

I have setup a RHEL5 machine with smb, winbind and krb with ads as the security model. Joined the RHEL machine to the domain.

I’m able to see users on the active directory and also able to log-in using SSH which automatically creates a home directory for me (using oddjobd).

Two things that I’m trying to achieve are:

1. Only users from a certain group on the AD should be allowed to ssh into the RHEL machine.
2. Once they ssh in, they should not be able to go to any other directory other than their home directory.

Can you please let me know if this can be done and if so, how?

Thanks in advance for your help.
Al

[meton_magis]

I don't know if there are any modules already created for what you need, but you'll need to look into PAM (plugable authentication modules.) Honestly, some googling will be your best bet to find if anyone has done this already.

on my fedora server, there is a package in yum,
pam_smb.i686
you may want to start your search there.

[allen4all]

Thanks Meton!!

I've been looking around a bit and have found a couple of resources. Once I complete this, I will probably post the steps here to stop reinventing the wheel!!

Thanks
Al