Tag Info

New answers tagged

1

First of all, ua2b provided the critical answer which was causing my confusion: PAM modules can only return a single status value per invocation Since modules can only return one status code, it's clear that the action for any bracketed set of value/action pairs is unambiguous. I thought that a module could return several status codes at once (based on ...


4

PAM modules have over 30 different return values that are mapped to either pass or fail of the whole PAM stack as stated by the configuration. It is noteworthy that a PAM module may behave different depending on the context (auth, account, password, session) that it is called in. The pairs of value=action in square brackets describe which action to take ...


1

You are describing a web-proxy which authenticates users with it's code. Yes, it's possible. But it this setup, you will have to proxy requests programmatically with PHP curl module, not with nginx itself. For nginx this would look just like a normal PHP web-site. Althoug this system looks overcomplicated. I'd propose you to authenticate users using IIS ...


0

Folks, Thanks for all. I found these links : https://bugzilla.redhat.com/show_bug.cgi?id=895513 and this one : http://www.unixmen.com/rhel-centos-6-4-ldap-md5-certificate-error-caused-by-nss-3-14-update/ I've got one problem for testing this solution, how to put this following line in GRUB2 systemd.setenv=NSS_HASH_ALG_SUPPORT=+MD5 So, I 've got ...


0

PAM saves it configurations per daemon in directory /etc/pam.d/. You should check the sshd configuration in that directory.


0

I then edited /etc/ssh/sshd_config changing: UsePAM yes to UsePAM no That's working the ldapuser and the local can connect on the server


2

I think this bit is probably the key: certificate is not valid - error -8016:The certificate was signed using a signature algorithm that is disabled because it is not secure My guess is that the server that refuses the cert might be configured not to accept SHA-1 based signatures. I'm no cryptographer, but of the other SSL issues that have come to my ...


0

You did not indicate how you installed the CA cert file. When using RH or derivatives you could just use the info in man update-ca-trust, the tldr; version is: copy the CA cert file to /etc/pki/ca-trust/source/anchors/ run update-ca-trust enable && update-ca-trust profit! update-ca-trust comes with the package ca-certificates which is in the ...


1

Besides deploying the certificate, you may need to create a symbolic link for the certificate. The c_rehash utility is provided for this. You can also use a command openssl x509 -noout -hash -in vsignss.pem to get the hash value for the certificate. The symlinks have a .0 suffix. Alternatively, you can add the certificate to your LDAP configuration. ...


1

I also ran into the same problem. After reading a lot of docs I came up with the following "solution": To workaround the name clashes I renamed User Private Groups by adding a "g" character at the beginning. For example: User=erik, Group=erik. Now on active directory I named the group "gerik". This way I can continue concentrating on AD migration without ...


0

According to what you said in comments you may need to add an explicit x.x.x.x puppetmaster record to your /etc/hosts file. Because you have search local domain in /etc/resolv.conf so if there is no explicit record in /etc/hosts it tries to resolve domain puppetmaster.local which is not what is in the certificate you have.



Top 50 recent answers are included