Firewalling at the domain users level instead of network level

[Santos <casd@netvisao.pt>]

Hi all.


I'm implementing a "Windows clients, Linux servers" kind of network.
Some users may login at different machines, therefore, ip level is not
enough. I wonder if it's possible to control the access at the "domain
users" level instead of network or ip level.  I could implement some
proxies, but each client machine had to be configured  and that would
mean extra work. IPtables can filter at the user level, but only with
local users. Is there a way to configure iptables and kerberos working
together or something like that?  Is this doable with PAM? I have read
that SAMBA authenticated gateway HOWTO, but it doesn't look very
reliable. Well, so basically what i want, is a firewall similar to a ISA
Server firewall

Any ideas about this would be apreciated, thanks in advance.


Santos