<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 07/11/2013 05:39 PM, KodaK wrote:
<blockquote
cite="mid:CAA9J0ZH_aXDfibzJsrq2ghLGWhYXzz7m9AUpWN9k_kC5DHqBRg@mail.gmail.com"
type="cite">Just thought I'd pass along my work-around.
<div><br>
</div>
<div>I create a group for each host called hostname-access and
populate each group with the users allowed to connect.</div>
<div><br>
</div>
<div>Then, using puppet, I push out an sshd_config that has
"AllowGroups: admins unixadmins hostname-access".</div>
<div><br>
</div>
<div>The erb is: "AllowGroups: admins unixadmins <%= host
%>-access"</div>
<div><br>
</div>
<div>Then restart sshd.</div>
<div><br>
</div>
<div>This is a lot of up-front work, but seems to be the easiest
to maintain in the long run (at least until we can get</div>
<div>AIX to honor HBAC rules.) Unfortunately, I can't have groups
of groups -- that would make initial setup even</div>
<div>easier -- but I'm used to not having everything, as you can
see. :)</div>
<div><br>
</div>
<div>This only works for sshd, obviously. We do currently have
ftp and telnet open (yeah, I know) but I'm trying</div>
<div>to get those turned off. In the meantime I can use
tcp-wrappers to only allow those machines that need</div>
<div>to connect. This is sub-optimal, since unauthorized users
may be able to telnet in from those machines.</div>
</blockquote>
<br>
Well it is something like this that I had in mind. But you have
beaten me...<br>
Great to see you found an acceptable solution.<br>
<br>
<blockquote
cite="mid:CAA9J0ZH_aXDfibzJsrq2ghLGWhYXzz7m9AUpWN9k_kC5DHqBRg@mail.gmail.com"
type="cite">
<div><br>
--Jason<br clear="all">
<div><br>
</div>
-- <br>
The government is going to read our mail anyway, might as well
make it tough for them. GPG Public key ID: B6A1A7C6
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>