In <fvvic6$rq...@registered.motzarella.org> Nikhil <mnik...@gmail.com> writes:

PAM is certainly the way to accomplish this.  We use it that way, but
not with groups or netgroups.  It's something that I call service
classes, but the result is the same.  The account module type in
pam.conf is the best place to control access.  I'm not aware of any
native PAM modules that will accomplish this.  We use locally-written
PAM modules.  That portion of pam.conf looks like this, with the last
three modules being locally-written:

  #
  # Default definition for Account management
  # Used when service name is not explicitly mentioned for account management
  #
  other   account requisite       pam_roles.so.1
  other   account required        pam_unix_account.so.1
  other   account requisite       pam_class_auth.so.1 allow=uadmin,celano
  other   account requisite       pam_status_auth.so.1 allow=active
  other   account required        pam_event_rec.so.1

--
-Gary Mills-    -Unix Support-    -U of M Academic Computing and Networking-