Thanks for the info. A similar solution to what you suggest is netgroups, or so I’m told. The groups exist within the directory rather than on the local machines.

In my case though it’s not quite how you describe. Each machine points at a separate OU in the LDAP directory. So we can control which accounts can access which machines using our central host management system.

The problem I’m solving is the case where the user account does need to go on the machine (eg. it could be a Samba server), but the user shouldn’t be able to log in.

Using the method you describe would work, but would require additional groups to be created and managed (and there’s an annoying limit on the number of groups an individual can belong to with NFS). Groups in our setup are not currently managed by the central system either.

The route I’ve chosen works using the password field sent by the management system, which we can control centrally. And my LDAP management code can then lock out (or unlock) an account on the LDAP server without ever touching the end system.

Thanks for your comments though, it’s useful to know about other solutions. And it’s refreshing to get a non-spam comment

In GNU/Linux there exists a different approach than the one you have suggested for Solaris/FreeBSD. You can use the pam module pam_access which will then allow you to deny groups of users to logon:

http://blog.evad.info/2008/11/27/manage-access-to-your-linux-systems-via-groups-pam_access/

Sadly Solaris lacks an equivallent to pam_access, such that many people port Linux PAM’s pam_access to Solaris. I don’t believe there is an equivallent under FreeBSD either.

Once you place pam_access in your PAM stack (under “account”) you can use one configuration file in /etc/security/ and you’re done. The security file will remind you how how compat mode used to work in /etc/passwd in the days of NIS. You simply prefix the lines with “-” to deny and “+” to allow.

I hope this is helpful to you, however given its a Linux specific “innovation” which has not been replicated to other free operating systems its usefulness to you is probably limited. This, at any rate, is probably why pam_unix on Linux PAM is less useful than its cousins.

Of course, this should work with external authentication even if “auth” isn’t being consulted because “account” should still be consulted by the SSH Daemon (or some other access system). Let me know if you find a better solution, right now I’m still using NIS at work (shudder) so the problem does not yet exist for us.

Thank you for your script !

From what I’ve read on the forums when the money turns to bad debt you’re unlikely to see any of it. They pass it on to their debt collectors, but I think they say you’ll only get a small percentage back, if anything.

Still, if you spread widely enough it should help lessen the blow. I guess it’s just easy to get worried by the bad stories others give on the forums…

Good luck with Zopa, it sounds like you’re doing well!

See this post.

I still have concerns over the money being locked away for a minimum of three years. It’d be great to see a loans market, but I’m not really sure how that’d work.

Regarding the S&S ISA, I definately think it’s a good idea. Unless you’ve got some other use for the allowance it’s good to make use of it whilst you can. As you say, down the road it may save you from capital gains tax. One other thing I have been thinking about is a SIPP, but the money is definately locked away then, and I’m not sure I understand them enough to make a decision on it yet.

I did go with a tracker fund in the end, and I luckily put my first sum in at the current bottom of the market (by pure chance!). I’m under no illusions that it won’t be a rough ride from here, but the past couple of months have started to look more positive. However, over the long term who knows what’ll happen

Thanks for the recommendation on A Random Walk Down Wall Street, I think it’s on my list already.

Something I’ve found useful lately is listening to podcasts. I have some slots in my day when I’m doing other things but my brain is idle, so I use that time to educate myself. Generally I just listen to news style podcasts like the money ones from Radio 4 and 5, but I also find the Motley Fool ones interesting. I don’t think they’re always directly applicable, but I don’t pick up a lot about the general state of the economy.

Good luck with your investing.

Tim.