Tag Info

Hot answers tagged

3

You can use the unique overlay to achieve this. See chapter 12.16 of the OpenLDAP manual and man slapo-unique (unfortunately, both still only refer the old-style configuration in slapd.conf, not the cn=config online configuration).


3

It looks like you're supplying a binddn, but bad credentials for it. Are the contents of /etc/ldap.secret and what you put in a the -W prompt exactly the same? rootbinddn is the binddn used by root on the client machine. It should generally not be the rootdn of the suffix as that would mean that compromise of the machine would also compromise the ...


2

Check the simple things first. Make sure the times match on all the computers (They should since it is Hyper-V, but it's a quick thing to check). Kerberos authentication can fail if they don't, and a failed login by the computer could be sending the trust message when trust isn't really the issue. Also, make sure the DNS servers specified in the host IP ...


2

Easy thing. Just say http://*.DOMAIN.COM 1 *.domain.com isnt enough


1

Is it possible, that the SSH server will 'understand' that the user has already authenticated? No. Just implement key auth for SSH as well. Then your users can ssh into your servers without typing a password at all (save for the initial private key load into your ssh key agent). You really should be using key authentication anyway. Doing this is a ...


1

I don't know of any way to do what you want with PAM without writing a new pam module. PAM is relatively complex and the way that sshd interacts with PAM and kerberos has been in my experience such that there is always an edge case that just doesn't work. What you want may be possible, I just don't know how to do it. If you only need to secure ssh what I ...


1

A user with an existing, valid Kerberos ticket must be asked only for the second factor. This can't be achieved through PAM. Successful key-based authentication performed against sshd bypasses the auth stack of PAM. This includes GSSAPI, which is a requirement for ticket based Kerberos authentication. It has no choice but to do this as PAM was ...


1

What you are looking for is an Identity Manager. There's a few around e.g. OpenIDM. Essentially Identity Managers provision users, manage roles, handle password issues etc. STS like ADFS allow authentication against those users. ADFS sits on top of AD. You could provision directly against AD using ADUC, via LDAP, via C# libraries etc. but these are all ...


1

The problem is that when you specify a tacacs or radius server first in your login method in your case the defualt method, it will never try the local username unless tacacs or radius is unreachable. So if you want to test your local login 1 of the following: 1. remove your device from radius (not good for production devices) 2. shut off the port that ...


1

You can do it by mounting /home via NFS and setsebool use_nfs_home_dirs 1


1

I don't have enough rep to comment it seems, so this is a bit of a shot in the dark attempt at an answer. pam_ldap: ldap_starttls_s: Operations error I have to wonder if this part of your log is indicating the culprit. My suspicion is that your ldap config is mishandling tls in some way that causes the connection to fail. Notice the responses from ...



Only top voted, non community-wiki answers of a minimum length are eligible