<p>You don't need to edit /etc/groups since the LDAP group already exists in your LDAP database. You want to let SSH know to use it, try using the AllowGroups setting in /etc/ssh/sshd_config. </p>

<p>From the manpage: "If specified, login is allowed only for users whose primary 
group or supplementary group list matches one of the patterns.  Only group     names are valid; a numerical group ID is not recognized.  By default, login is allowed for all groups."</p>

<p>See <a href="https://stackoverflow.com/questions/50638944/ansible-to-update-sshd-config-file">this question for more information</a></p>

CC BY-SA 4.0
2019-02-19T14:55:25.850Z
2019-02-19T14:55:25.850Z
TheFiddlerWins
<p>As explained by @TheFiddlerWins, there is no need to add ldap groups into /etc/group.</p>

<p>The challenge here is to give ssh a way to access your ldap directory:
I did this some time ago by adding a custom script to the sshd config, but using pam looks a lot cleaner today.</p>

<p>Then you just need to handle the required changes using your playbook.</p>

<p>Just remember that your ldap accounts will need a posixAccount object in order to be able to log into you ubuntu boxes.</p>

CC BY-SA 4.0
2019-07-21T07:32:17.327Z
2019-07-21T07:32:17.327Z
Pier
<p>I have LDAP Group.</p>

<pre><code>superproduct1
</code></pre>

<p>In LDAP Group has some users: </p>

<pre><code>developer1, tester1, analitic1, project1
</code></pre>

<p>I want to create ansible playbook for add LDAP group to SSH access on host.</p>

<p>Found only </p>

<p><a href="https://docs.ansible.com/ansible/latest/modules/group_module.html" rel="nofollow noreferrer">group – Add or remove groups</a></p>

<pre><code>- name: Ensure group "somegroup" exists
  group:
    name: somegroup
    state: present
</code></pre>

<p>How to add LDAP group superproduct1 for ssh access?</p>

<ansible>
How to add LDAP group for ssh access by ansible playbook?
Nikolay Baranenko
# How to add LDAP group for ssh access by ansible playbook?

(Asked by: username_0 on 2019-02-16)

I have LDAP Group.
superproduct1

In LDAP Group has some users: 
developer1, tester1, analitic1, project1

I want to create ansible playbook for add LDAP group to SSH access on host.
Found only 
group – Add or remove groups
- name: Ensure group "somegroup" exists
  group:
    name: somegroup
    state: present

How to add LDAP group superproduct1 for ssh access?

**Tags:** ansible


---

## 2 answers

### Answer by username_1 on 2019-02-19. Score: 1

You don't need to edit /etc/groups since the LDAP group already exists in your LDAP database. You want to let SSH know to use it, try using the AllowGroups setting in /etc/ssh/sshd\_config.

From the manpage: "If specified, login is allowed only for users whose primary
group or supplementary group list matches one of the patterns. Only group names are valid; a numerical group ID is not recognized. By default, login is allowed for all groups."

See [this question for more information](https://stackoverflow.com/questions/50638944/ansible-to-update-sshd-config-file)


---

### Answer by username_2 on 2019-07-21. Score: 0

As explained by @username_1, there is no need to add ldap groups into /etc/group.

The challenge here is to give ssh a way to access your ldap directory:
I did this some time ago by adding a custom script to the sshd config, but using pam looks a lot cleaner today.

Then you just need to handle the required changes using your playbook.

Just remember that your ldap accounts will need a posixAccount object in order to be able to log into you ubuntu boxes.


---

