pam_ldap: pam_groupdn inhibit error message
I want to restrict access to a machine to ldap users with a specific
group membership.
So in /etc/ldap.conf:
pam_groupdn cn=PAM,ou=Groups,dc=example,dc=com
And in /etc/pam.d/common-auth:
auth required pam_env.so
auth sufficient pam_unix2.so
auth required pam_ldap.so
Now users within the group PAM are authorized while users not known to
the ldap server are asked for a password. Users known to ldap without
the group membership are rejected with the message:
You must be a uniquemember of cn=PAM,ou=Groups,dc=example,dc=com
My question: Is it possible to inhibit this error message? It gives an
attacker the information that a user name is known to the system. This
is highly unwanted in this case.
Günther
|