I understand that Kerberos is for Authentication not Authorization, but Is it possible to get Kerberos to refuse to Authenticate certain users on specific hosts? I am currently using LDAP for /etc/passwd /etc/group, providing the userPassword entry as a '!!' to disallow login by default. And Kerberos is serving up authentication. It would be nice if all the hosts could use LDAP, while providing lists of users they do not (or do) wish to give authentication via Kerberos.. If this is not possible, how would you recommend I do this?

When I installed the KDC, I was under the impression that the kerberos ACL would allow me to specify where (which services/hosts) specific users could get tickets.

  • I am looking into some solutions for this. It seems as though I can filter the results with high granularity through LDAP. I will answer the question when I finish my implementation (with some links if I can do it with my rep).
    – Shane
    Dec 15, 2014 at 2:09

1 Answer 1


This is more a solution to what I'm trying to accomplish than an answer to the question I asked. If somebody has a more direct answer to the question asked, please contribute it.

Thanks to the good people at CERN and Ubuntu for getting me on the right track: http://linux.web.cern.ch/linux/docs/account-mgmt.shtml

Apparently the package nss-pam-ldap for using LDAP in the NSSwitch for providing /etc/passwd allows to do some filtering or overriding of values (though I haven't tried this yet). This could be useful if normally your LDAP users' homedirs are on NFS, but on a specific host, you want them to have local homedirs.

# Set the user homedirectory to /home/$USER map passwd homeDirectory "/home/$homeDirectory"

Or map to nologin for maintaining correct file permissions on an NFS server (without allowing LDAP users a shell)
# Set the login shell to /sbin/nologin map passwd loginShell "/sbin/nologin"

Some basic filtering
# Only get users from group 1160 filter passwd (&(objectClass=user)(uidNumber=*)(unixHomeDirectory=*)(gidNumber=1160))

More stuff can be done with the ldap configuration itself (/etc/ldap.conf or /etc/openldap/ldap.conf), for instance adding a user attribute: host to the LDAP users, where you have a host attribute (with hostname) for each host the user can access, and lines like this:
nss_base_passwd ou=Users,dc=example,dc=com?one?|(host=thehostname)(host=\*)

For more info, just follow the links I posted at the top, and if I have some time to get all this stuff working in a way I appreciate, I'll try to clarify this answer a little bit.

EDIT: the main website for the nss-pam-ldap package is here:
it has some documentation for the nsldc.conf file

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.