0
votes
1answer
27 views

Usergroups in LDAP: User and Group in same object

"Usergroups" are a common concept in UNIX, many Linux distributions (e.g. Debian) use it as default. It means that each user has its corresponding private group (e.g., User "alex" has also a group ...
1
vote
2answers
92 views

Account name changes

The way we currently handle account name changes is quite cumbersome and wondering if there is an easier way to go about things. Name change request comes through and we create a new AD account, ...
2
votes
3answers
382 views

How to handle centralized user authentication without LDAP?

I'm attempting to create a centralized database for my users for my server and web accesses, so that I can allow those users to log in through ssh if they have access, and through my web services to ...
3
votes
1answer
185 views

Should I manage Linux Groups in LDAP on a per machine basis?

I am currently running an OpenLDAP Server managing my Linux Users as posixaccount and posixgroup elements like so: dn: cn=shellinger,ou=groups,dc=company,dc=com cn: shellinger gidNumber: 5001 ...
1
vote
2answers
182 views

How can I allow users to change their local passwords?

We use an LDAP-server, but we also use local accounts. [jdoe@tst-03 ~]$ passwd Changing password for user jdoe. Changing password for jdoe. (current) UNIX password: Enter login(LDAP) password: This ...
9
votes
4answers
692 views

Managing access to multiple linux system

A searched for answers but have found nothing on here... Long story short: a non-profit organization is in dire need of modernizing its infrastructure. First thing is to find an alternatives to ...
2
votes
1answer
165 views

How to manage users and resources in a multiple server environment? [duplicate]

Possible Duplicate: A system for distributing SSH public keys Need help managing developer authentication on our system. We have multiple CentOS servers (database, Web, Redis, etc.), and ...
3
votes
4answers
135 views

What are the dominant purposes of having random user names vs fixed-format email addresses with AD/LDAP?

Example, a user name might be "ekg7d9a", but the user's real name is "Charlie Hanes", and the email is "chanes@example.com". What are the dominant reasons to use non-related user names with logins ...
1
vote
2answers
3k views

How to add LDAP user to existing group?

I'm attempting to add some of our LDAP users to a locally defined group on our RHEL server, however I get an error stating that the LDAP user is not found in /etc/passwd. What would be the best way ...
2
votes
4answers
672 views

What are my options for centralizing Unix user management

We have 15 Debian servers and growing. What's a simple, lightweight method for centralizing user management? Use cases would be adding a user across all servers, tweaking a users access on a specific ...
1
vote
1answer
328 views

Creating a New Kerberos User

I've inherited a Fedora Linux system running Kerberos, and I'm trying to create a new user. I've been able to bring up the kadmin prompt, and I'm trying to create the user NewUser, so I tried issuing ...
1
vote
1answer
327 views

LDAP loginShell on platforms with different paths

I'm using LDAP to deal with users and authentication across my network. I'm now adding FreeBSD hosts and have hit a problem with login shells. on Linux, shells tend to be in /bin/$shellname, so ...
0
votes
1answer
548 views

How to manage ldap users/kerberos principals on Ubuntu server?

I've recently setup a small test network with an Ubuntu server and Ubuntu clients. People can login to a client machine using an account stored in LDAP (created using ldapadduser from the ldapscripts ...
1
vote
3answers
520 views

Adding/modifying users to OPENLDAP?

Is it recommended to add users/modify properties of users to OpenLDAP after stopping the service ? I have been facing issues on adding users when the OpenLDAP server is running. I am using scripts ...
1
vote
3answers
249 views

Is there a generic way to tell if a username is valid on a Unix-like given system?

I'm looking for a cross-platform way of determining whether or not a username and groupname is valid. The platforms are Linux, Solaris, Aix, and HPUX. It would need to work whether the user/group is ...
0
votes
2answers
662 views

bulk swap uidNumber/gidNumber?

We currently have LDAP servers in Dev env. and staging/prod env. Both are not coupled and accounts are created manually. So the uids are same but the uidNumber and gidNumber are different across these ...
0
votes
2answers
167 views

Active Directory or Mac configuration. Where to look?

I m a student at a university. There is a computer lab which has Mac computers. There is citrix account which is kinda VPN to school network. There is putty in citrix applications. When i use putty ...
1
vote
1answer
3k views

Adding inetOrgPerson to account/posixAccount LDAP entries

I have a LDAP database we have been using for managing user accounts on our hosts, these entries have account and posixAccount as objectClass. Now we'd like to extend this to also use it as an adress ...
5
votes
5answers
621 views

LDAP for privilege control?

I've been wondering for a while if LDAP can be used to control user privileges. For example, if I have UNIX and web logins, is there an easy way to grant a user access to just or just UNIX (or even ...
3
votes
3answers
896 views

How to allow a group to change user passwords?

I have the following openldap server configuration: access to attrs=userPassword by self write by anonymous auth by set="[cn=users,ou=Group,dc=my-company,dc=de]/memberUid & user/uid" ...
3
votes
2answers
6k views

How do I migrate user-accounts from OpenLDAP to Active-Directory?

We want to migrate our user-accounts from OpenLDAP to Active-Directory without changing the passwords and such. The users shouldn't notice the difference against which server they're authenticating ...
6
votes
8answers
4k views

Best practices or experience with company wide Username policies and resolving duplicates

I am a programmer with an application that needs to be integrated into the new company wide Active Directory login scheme. This means changing all the usernames in our system to use the new scheme. ...