<br><font size=2 face="sans-serif">Thanks, everyone, for the thought.</font>
<br>
<br><font size=2 face="sans-serif">Terry's answer looks like it'll do the
trick and I very much like the look of Matiu's login hook suggestion. (Login
hooks - I never think of them at the right time...) RADIUS, however, remains
a mystery to me. </font>
<br>
<br><font size=2 face="sans-serif">d</font>
<br><font size=2 face="sans-serif">
<br>
<br>
<br>
Darryl Rosin<br>
<br>
Server Administrator, Digital Arts Project<br>
Griffith University AUC Developer Fund Coordinator<br>
<br>
Research Computing Services<br>
Division of Information Services<br>
South Bank Campus<br>
Griffith University 4111 Australia<br>
<br>
d.rosin@griffith.edu.au<br>
t: 04 1876 0956<br>
<br>
PRIVILEGED – PRIVATE AND CONFIDENTIAL<br>
This email and any files transmitted with it are intended solely for the
use of the addressee(s) and may contain information which is confidential
or privileged. If you receive this email and you are not the addressee(s)
[or responsible for delivery of the email to the addressee(s)], please
disregard the contents of the email, delete the email and notify the author
immediately</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td><font size=1 color=#5f5f5f face="sans-serif">From:</font>
<td><font size=1 face="sans-serif">Matiu Carr <m.carr@auckland.ac.nz></font>
<tr valign=top>
<td><font size=1 color=#5f5f5f face="sans-serif">To:</font>
<td><font size=1 face="sans-serif">University Macintosh Technical Mailing
List <unimactech@auc.edu.au></font>
<tr valign=top>
<td><font size=1 color=#5f5f5f face="sans-serif">Date:</font>
<td><font size=1 face="sans-serif">06/04/09 06:49 AM</font>
<tr valign=top>
<td><font size=1 color=#5f5f5f face="sans-serif">Subject:</font>
<td><font size=1 face="sans-serif">Re: [UniMacTech] AD authentication and
restricting logins</font></table>
<br>
<hr noshade>
<br>
<br>
<br><font size=3>Yes, RADIUS via Microsoft IAS.</font>
<br>
<br><font size=3>Access could be controlled at the network layer via group
policy if you have devices that can do the gating (eg. Airport Extreme).</font>
<br>
<br><font size=3>Another way of achieving what you want is to use some
kind of loginhook to test group membership of the connecting person.</font>
<br>
<br><font size=3>If you use the active directory plugin then users arrive
on the box with all their group information in the user record. For instance
on the student file server (OS X.5 in AD)</font>
<br>
<br><font size=3>fileserver:~ mylogin$ id <br>
uid=1836357057(mylogin) gid=1522854277(EC\domain users) groups=1522854277(EC\domain
users)<br>
1194167463(EC\tamakilabs.fos)<br>
1534136336(EC\dialin.itss)<br>
1486277511(EC\student.psrwi)<br>
.<br>
.<br>
.<br>
760710041(EC\wifiaccess)<br>
1474264128(EC\statlabs.fos)<br>
304261082(EC\ecwiki)</font>
<br>
<br><font size=3>Note, I have tidied up the output a bit, the groups come
as a comma separated list. It would not be too difficult to look for a
particular group membership in the list and act on the presence or lack
of such memberships. eg:</font>
<br>
<br><font size=3>#!/bin/tcsh -f</font>
<br>
<br><font size=3># assumes that this is being run as part of the log in
process</font>
<br><font size=3># and the user has been authenticated, and we have access
to</font>
<br><font size=3># group data via LDAP, AD etc. $1 should contain the login</font>
<br><font size=3># name -what you would expect in a login hook<br>
<br>
set MUSTBEAMEMBER = DOMAIN\\canlogon # check this carefully<br>
set ALLOWLOGIN = no<br>
<br>
foreach thegroup (`id -nG $1`)<br>
if ($thegroup = $MUSTBEAMEMBER) then<br>
set ALLOWLOGIN = yes<br>
endif<br>
end<br>
<br>
if ($ALLOWLOGIN = no) then<br>
logout<br>
exit 1<br>
endif<br>
<br>
<br>
# do login stuff...<br>
<br>
exit 0</font>
<br>
<br>
<br><font size=3>Then you can manage access via groups on the AD.</font>
<br>
<br><font size=3>There may be a way of doing this with PAM</font>
<br>
<br>
<br><font size=3><br>
</font>
<br><font size=1 face="Monaco">Mat</font>
<br><font size=1 face="Monaco">--</font>
<br><font size=1 face="Monaco">Matiu Carr <</font><a href=mailto:m.carr@auckland.ac.nz><font size=1 color=blue face="Monaco"><u>m.carr@auckland.ac.nz</u></font></a><font size=1 face="Monaco">></font>
<br>
<br><font size=1 face="Monaco">IT Manager</font>
<br><font size=1 face="Monaco">National Institute of Creative Arts and
Industries</font>
<br>
<br><font size=1 face="Monaco">+64 9 3737 599 x86511</font>
<br><a href=http://www.people.auckland.ac.nz/Mat/><font size=1 color=blue face="Monaco"><u>http://www.people.auckland.ac.nz/Mat/</u></font></a>
<br>
<br>
<br><tt><font size=2>_______________________________________________<br>
unimactech mailing list<br>
unimactech@auc.edu.au<br>
</font></tt><a href=http://www.auc.edu.au/mailman/listinfo/unimactech><tt><font size=2>http://www.auc.edu.au/mailman/listinfo/unimactech</font></tt></a><tt><font size=2><br>
</font></tt>
<br>
<br>