2
votes
1answer
97 views

How can I force a mac mobile account user to be logged out or locked out when their LDAP account is disabled?

I have a FREEIPA LDAP server and a Mavericks Client. I have bound my Mac to my ldap and created a mobile account. What I want is when someone is disabled it logs out the user or locks the screen.
1
vote
0answers
119 views

Routing LDAP traffic from Application server to Proxy to internet

I've included a drawing so you get an idea how it would work. (Red = LDAP connections , Blue = HTTP / AJP in the backend) Problem: We want to connect our customer application server to an LDAP of ...
0
votes
1answer
87 views

Why can a local root turn into any LDAP user?

I know this has been asked here before, but I am not satisfied with the answers and don't know if it's ok to revive and hijack an older question. We have workstations that authenticate users on an ...
0
votes
1answer
433 views

LDAP throws Event ID 2887 warnings even after enabling “require signing”

I am running an AD LDS directory and, ever since configuring it, I have been seeing 2887 warning messages, so I have decided to follow this guide to have the server require LDAP signing. The problem ...
2
votes
1answer
74 views

How to securely connect to multiple different LDAPS servers (Debian)

I'm trying to connect to multiple different LDAPS servers. A lot of the documentation I've seen recommends setting TLS_REQCERT never, but that strikes me as horribly unsecure to not verify the ...
1
vote
1answer
1k views

Why do I need Pre-Windows 2000 Compatible Access to enumerate group membership?

I am trying to lock down security including removing the leaked password hashes that the UNIX addon creates. I removed Authenticated Users from the Pre-Windows 2000 Compatible Access group. However ...
3
votes
4answers
134 views

What are the dominant purposes of having random user names vs fixed-format email addresses with AD/LDAP?

Example, a user name might be "ekg7d9a", but the user's real name is "Charlie Hanes", and the email is "chanes@example.com". What are the dominant reasons to use non-related user names with logins ...
3
votes
2answers
768 views

Google authenticator with Openldap or Fedora 389 Server

After a little googling I could see some references of configuring Google Authenticator with Windows Active Directory, however, I could not see how I could do it on Linux/CentOS system. What would be ...
2
votes
1answer
521 views

Best practices for LDAP and DMZ

We are in the process of setting up a DMZ and I have stumbled into the question of how to handle machines that need to have ports exposed to the internet, but at the same time be able to make LDAP ...
1
vote
2answers
1k views

How to safely use corporate Active Directory (LDAP) authentication for an internet facing web site? [closed]

Let's say you have a public web service (Jira in my case) that is used by both intranet users and external users. The server is already configured to use HTTPS (secure). Because the server is ...
2
votes
1answer
104 views

Securing access to virtual directories with valid users determined by part of the URL

I'm not a very experienced Apache sysadmin (fell in to the role as I was the only person who knew anything at all about it!) and I'm really stuck with this problem. Thanks to an over-zealous salesman ...
1
vote
0answers
279 views

Can ApacheDS LDAP change root user name?

ApacheDS 1.5 has the following account by default. Bind dn or user: uid=admin,ou=system Bind password: secret i would like to change it to the following to avoid making changes in my code Bind dn ...
5
votes
2answers
2k views

Network authentication + roaming home directory - which technology should I look into using?

I'm looking into software which provides a user with a single identity across multiple computers. That is, a user should have the same permissions on each computer, and the user should have access to ...
8
votes
2answers
615 views

What the heck is really going on in these Lion LDAP vulnerability reports?

Just read a Slashdot thread on LDAP brokenness on OSX. Can anyone explain exactly what is being secured by OpenLDAP and why anything other than data stored on a Lion machine might be at risk? A quote ...
4
votes
3answers
519 views

Can nss/pam ldap send password to ldap server already hashed?

I have nss & pam configured so that I can authenticate linux users via LDAP against my companies AD server. All works fine except password are sent in plain text. For reasons out of my control our ...
0
votes
0answers
188 views

Jira: Handling multiple LDAP Organizational Units in 4.3

I'm in the process of upgrading my company's Jira instance to the latest version 4.3.4. In previous versions of Jira we've been able to intergrate with LDAP just fine, by using a baseDN in the ...
6
votes
2answers
1k views

What's the default hash format / algorithm of Active Directory?

I'm wondering what format I need to put hashes in to write to userPassword via LDAP. Apache Directory Studio gives me several options, but I don't think any of them are it. Can anyone document the ...
0
votes
3answers
495 views

How to secure LDAP

Not sure if this belongs more on serverfault or not... BACKGROUND: I am using openldap, and pam/nss/ldap for authentiction on my server (webmail, etc). My files, which work fine: ...
0
votes
0answers
120 views

Is there any way to implement 2FA for MySQL Remote Access

Is any way to implement 2FA for MySQL remote access (on a linux box), say for users who may be accessing via a GUI client? A PAM > Radius > Active Directory/LDAP (with some back-end token ...
11
votes
2answers
2k views

The Story of secure user-authentication in squid

once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network: <the Internet> ...
5
votes
5answers
611 views

LDAP for privilege control?

I've been wondering for a while if LDAP can be used to control user privileges. For example, if I have UNIX and web logins, is there an easy way to grant a user access to just or just UNIX (or even ...
0
votes
2answers
3k views

How to disable anonymous access on LDAP

I need to secure my LDAP server and am not quite sure the best way to go about it. I am running Debian "Lenny", and using OpenLDAP (slapd). I notice that if I run: ldapsearch -x -W -b ...
0
votes
2answers
127 views

How could I digitally sign LDAP data?

How could I digitally sign LDAP data? I want to make an LDAP request from a user machine to a proxy server that then relays the request to an LDAP server. The LDAP server would then respond with the ...