22 Apr
2021
22 Apr
'21
9:36 a.m.
On Apr 22, 2021, at 9:07 AM, Pisch Tamás <pischta@gmail.com> wrote:
I would like to set up VPN on a Samba DC (Debian Bullseye). I could set it up with ntlm_auth, but I read that ntlm_auth may serve about 30 request per second maximum, and uses smbv1. I would like to filter users by group or msNPAllowDialin AD property. I can use:
winbind_username = "%{mschap:User-Name}" winbind_domain = "%{mschap:NT-Domain}"
in mschap, but how I can filter users?
Use LDAP group checking. The "winbind" feature just does authentication. It doesn't do anything else. See the LDAP-Group documentation for how to use LDAP groups. In recent versions of the server, there are even pointers to this in mods-available/ldap Alan DeKok.