[CentOS] LDAP Authentication and Authorisation.

Hello all,

At my current job the time has come to unify our LDAP infrastructure
into one tree (preferably). The basics are working but we are not sure
how to restrict which users can log into which machines.

What we would like is for everyone in the (for example) "infra" group
to log into all machines while people in the "development" group can
only log into development servers. From an initial Google my options
seem to be:

* LDAP based netgroups
* OpenSSH - AllowGroups, DenyGroups
* PAM - mod_access

Does anyone have any real world, in the trenches experience they would
be willing to share? I would like to know which is the most
maintainable and easy to hand-over to more junior admins.

Thanks,

Fred.