New answers tagged

0

It's probably this recent node driver regression: https://jira.mongodb.org/browse/NODE-726. Downgrade to 2.1.18.


1

Key-based authentication with tied-down keys (ie, keys restricted by the IP range they can be used from and/or the command they can be used to invoke) is a pretty safe way of being able to use SSH-based resources from scripts. If you go fully 2FA on sshd, you lose the ability to have automated tasks access resources without operator intervention.


1

You need to decide if you want to do 2FA on your own of if you want to trust an external entity. This is not only to not trust authy but to not trust any attacker, who might intercept the authentication request. Each time you want to login via SSH an HTTP API Request is sent to authy.com. Authy decides if access is granted or not. There are other hosted ...


0

I finally found a discussion that seems to describe the error as being caused by certain android phones. For reference: https://talk.plesk.com/threads/android-kitkat-phones-cannot-authenticate-to-dovecot-imap.332410/ I'm not sure if it means anything or not but the user login id is username@domain.com, the message where the Digest-md5 creates the user ...


1

For some reason, users which are not members of the gauth group are able to log into the machine without supplying any password at all You removed from the PAM stack @include common-auth line in the start, which takes care of normal authentication. If I am right, PAM checks all auth mechanisms in the PAM stack and if one of them "allows" connection (...


1

When playing around with the PAM stack I usually do not use the service, that I in fact want to modify, since this is a "productive" service. So in this case I would test with /etc/pam.d/login instead of ssh. login can be tested by simply calling: login If the PAM config looks good, I can transfer it to gdm, ssh or whatever. (Who needs a local login ;-) ...


0

You need to use multiple Match Group directives: Match Group foo # blah settings Match Group bar # blah settings ... Standard settings


0

I think you may want to modify your sql select statement to be sql_select: SELECT password FROM mailbox WHERE username='%u@%r' AND active ='1' as that should select both the user and domain..


1

I am looking for a similar thing. This could help you : https://github.com/phokz/mod-auth-external/tree/master/mod_authnz_external


0

AS far as I know, SQUID is not a SOCKS server. WinGate has a SOCKS server, which supports client connections using TLS/SSL including client certs (which is non-standard) which authenticates to the proxy based on the UPN in the certificate (when using the Active Directory connector in WinGate). You can also with policy lock the destination down to wherever ...


0

I also meet the problem , it seems support ssl-only + acl , you can try it http://comments.gmane.org/gmane.comp.apache.kafka.user/12619


0

Cisco ASA routers support one authentication group per profile. So if your VPN connection profile is set to use an authentication group named VPN then when users connect to the VPN they will authenticate to the first available server in the VPN authentication group. You can have LOCAL set for a fallback authentication source, but it is only available if the ...


0

After watching the traffic with tcpdump, I found that it is indeed the proxied server that is sending another authentication request. The reverse proxy forwards the Authorization: Basic XXXXXXXXXXXXXXXXX header, and the application treats that as a valid login procedure. However, since the login credentials from the revers proxys htpassword file do not ...


0

Does it pop up more than twice? Redirects will cause the popup to show again.


1

The file you edited is the ssh client configuration. You want sshd_config.


2

Using Ubuntu 14.04 LTS I needed to allow the listing of LDAP users! Edit /etc/sssd/sssd.conf, and change enumerate = false to enumerate = true.


3

I don't know the details of your application, but it sounds to me like it is not compatible with Active Directory. Read the public documentation for ADS_NAME_TYPE_ENUM. Those are the login name formats that you are allowed to log in with. "EXT123456" is not one of them. I know that you think "EXT123456" is logging in with a sAMAccountName, but it actually ...


2

I don't think you'll be able to do this without changing client configs. However, after the client computers all set up, you'll be able to manage this from the LDAP server. One way to achieve this is: Write an access_ldap.conf file which contains this, and put it /etc/security: +:root:ALL -:ALL EXCEPT (the_group_that_has_access):ALL There is an access....



Top 50 recent answers are included