{{tag>[ldap openldap group ssh sshaccess]}}

=====OpenLDAP - SSH access for group=====
====Configure OpenLDAP====
  * Create LDIF for group<code># vim sshaccess.ldif

dn: cn=sshaccess,ou=groups,dc=<domain>,dc=<tld>
objectClass: top
objectClass: posixGroup
gidNumber: 3000</code>
  * Add LDIF to LDAP:<code># ldapadd -H ldaps://<FQDN> -x -W -D "<Manager DN>" -f sshaccess.ldif</code>
  * Add a user to the new group, create LDIF:<code># vim addusertogroup.ldif

dn: cn=sshaccess,ou=groups,dc=<domain>,dc=<tld>
changetype: modify
add: memberuid
memberuid: newuser</code>
  * Load LDIF in LDAP:<code>ldapadd -H ldaps://<FQDN> -x -W -D "<Manager DN>" -f addusertogroup.ldif </code>


====Configure SSHd====
  * Append to /etc/ssh/sshd_config:<code># vim /etc/ssh/sshd_config

AllowGroups sshaccess</code>
  * Restart sshd:<code>systemctl restart sshd</code>

====Configure login access control====
  * Append to /etc/security/access.conf<code># vim /etc/security/access.conf

+ : dev : ALL
- : ALL : ALL</code>