Tag Info

New answers tagged

0

You can resolve this by adding the below line to your /etc/puppet/puppet.conf [master]: certname=puppetmaster


0

The Apache authentication system checks are performed in the Apache worker processes and not in the WSGI daemon process. The Apache authentication system only says whether a user is permitted to access the web application. It doesn't change the user that the worker process runs as and it will keep running as the Apache user. If you are trying to use database ...


1

You can do it by mounting /home via NFS and setsebool use_nfs_home_dirs 1


-1

You can bypass the with the -o StrictHostKeyChecking=no option. This is very useful when using ssh in a shell script. ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 -o PasswordAuthentication=no -o ConnectionAttempts=5 xxUser@xxxHost


1

What you are looking for is an Identity Manager. There's a few around e.g. OpenIDM. Essentially Identity Managers provision users, manage roles, handle password issues etc. STS like ADFS allow authentication against those users. ADFS sits on top of AD. You could provision directly against AD using ADUC, via LDAP, via C# libraries etc. but these are all ...


0

Salt has a Stormpath authentication module: https://github.com/saltstack/salt/blob/develop/salt/auth/stormpath.py Some docs for the latest update can be found here: http://docs.saltstack.com/en/develop/topics/tutorials/stormpath.html


0

No, nor should you need to. They should federate with your instance and manage their own users.


0

As suggested by David Z, you can use mod-authnz-external. Use it with pwauth for example. If you are running Debian or a derivative: apt-get install libapache2-mod-authnz-external pwauth a2enmod authnz_external In your configuration, add <IfModule mod_authnz_external.c> AddExternalAuth pwauth /usr/sbin/pwauth SetExternalAuthMethod pwauth pipe ...


-1

I was able to clear all stored passwords by setting all of the NL$ entries to the same as the last one (the last few NL$ entries were the same so it looks like they are just placeholders). I tested this on Windows 7 PRO 64bit computers, I have not tested it on anything else. Just copy the below into notepad and save it as a .reg then run regedit /s ...


3

It looks like you're supplying a binddn, but bad credentials for it. Are the contents of /etc/ldap.secret and what you put in a the -W prompt exactly the same? rootbinddn is the binddn used by root on the client machine. It should generally not be the rootdn of the suffix as that would mean that compromise of the machine would also compromise the ...


3

You can use the unique overlay to achieve this. See chapter 12.16 of the OpenLDAP manual and man slapo-unique (unfortunately, both still only refer the old-style configuration in slapd.conf, not the cn=config online configuration).


2

Easy thing. Just say http://*.DOMAIN.COM 1 *.domain.com isnt enough


1

A user with an existing, valid Kerberos ticket must be asked only for the second factor. This can't be achieved through PAM. Successful key-based authentication performed against sshd bypasses the auth stack of PAM. This includes GSSAPI, which is a requirement for ticket based Kerberos authentication. It has no choice but to do this as PAM was ...


-1

Same issue here but i think i got lucky and found a solution. Looked like a firewall issue here too, but when disabling it there was no change. Acces from localhost worked fine but not from same network or the internet. I have tried changing every value with no luck but finally i have tried editing feature settings of error messages (my server has own error ...


1

I don't know of any way to do what you want with PAM without writing a new pam module. PAM is relatively complex and the way that sshd interacts with PAM and kerberos has been in my experience such that there is always an edge case that just doesn't work. What you want may be possible, I just don't know how to do it. If you only need to secure ssh what I ...


1

The problem is that when you specify a tacacs or radius server first in your login method in your case the defualt method, it will never try the local username unless tacacs or radius is unreachable. So if you want to test your local login 1 of the following: 1. remove your device from radius (not good for production devices) 2. shut off the port that ...


0

For 7-mode, you need to configure the guest account. Unauthenticated CIFS users are mapped to this account. It is set with options cifs.guest_account. From the man page: cifs.guest_account Enables a user to get access to the filer provided that either the filer uses a Domain Controller for authentication and the user ...


1

Is it possible, that the SSH server will 'understand' that the user has already authenticated? No. Just implement key auth for SSH as well. Then your users can ssh into your servers without typing a password at all (save for the initial private key load into your ssh key agent). You really should be using key authentication anyway. Doing this is a ...


0

I couldn't get this to work either, so what I did was setup the FreeRadius package on pfSense and then configured that to be the authentication backend for Squid, then I was able to login with the user I created on FreeRadius. Just set Freeradius up to listen on port 1812 and then set the radius server in the Squid configuration to 127.0.0.1


-1

Add this on the server: ssh-keygen -t dsa -N "" -f /etc/ssh/ssh_host_dsa_key ssh-keygen -t rsa -N "" -f /etc/ssh/ssh_host_rsa_key ssh-keygen -t ecdsa -N "" -f /etc/ssh/ssh_host_ecdsa_key


2

Check the simple things first. Make sure the times match on all the computers (They should since it is Hyper-V, but it's a quick thing to check). Kerberos authentication can fail if they don't, and a failed login by the computer could be sending the trust message when trust isn't really the issue. Also, make sure the DNS servers specified in the host IP ...


1

I don't have enough rep to comment it seems, so this is a bit of a shot in the dark attempt at an answer. pam_ldap: ldap_starttls_s: Operations error I have to wonder if this part of your log is indicating the culprit. My suspicion is that your ldap config is mishandling tls in some way that causes the connection to fail. Notice the responses from ...



Top 50 recent answers are included