0

I am running Red Hat Enterprise Linux 6.6 and for authentication we use LDAP authentication. We have running application on a server (doesn't really matter which one it is) and the way application work is it basically uses OS just to authenticate user, everything else is handled in application.

Here is the problem I have, occasionally users share their usernames and password which is against our policy, but I don't know when that happens (few of them admitted and they were disabled soon after). What I came accross when user is authenticating, application tells OS "authenticate this user", OS is set to use LDAP and LDAP is using PAM module.

What I want to do at the level of authentication is to run script to check user's incoming IP address and check if it has multiple sessions, if user have multiple sessions, check IP address from session and see if they match. This is the best I can come up with since user cannot be at two machines at the time.

I know that there is a way to restrict user per IP, but some users have laptops and they move around, thus their IP is assigned dynamically and changes all the time. At the same time it would be nightmare to maintain 600+ IP users and addresses.

Any suggestions?

Improve this question
2
  • since user cannot be at two machines at the time -- Actually, they can. Trivially. Unless the servers literally cannot SSH to each other, they can simply authenticate to one machine and then use the commandline ssh client to reach another machine.
    – Andrew B
    Commented Feb 18, 2016 at 4:47
  • @AndrewB in theory you can, but you cannot work at two machines at the time. You can switch back and forth but you cannot be at both at the same time physically. And in addition we are talking about client machines not connecting multiple servers, server is only one, all other users are client machines
    – zuboje
    Commented Feb 18, 2016 at 14:38

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .