Tag Info

New answers tagged

0

From what I recall loginwindow:login is actually used in spawning the GUI login window, similar to builtin:policy-banner. So it is logical to be spawned before the rest of the actions. So the GUI window is the one that is actually irrelevant/bypassable, not the credentials themselves. What exactly would you like to modify and towards what purpose ? For ...


1

To put it short, you can't use Kerberos for subsites with different delegated pricipals. Kerberos SPN has no provisions beyond [service]/[name]:[port/service] . Your options are: Run subsites at different ports and create SPN with Delegation for each service user with different ports. Use NTLM Use same Application Pool account for all subsites


0

This article/blog post might apply. It indicates that using negotiate will automatically use kerberos. Here is a cmd to disable NTLM appcmd.exe set config "mysite" -section:system.webServer/security/authentication/windowsAuthentication /-"providers.[value='NTLM']" /commit:apphost the /-"providers.[value='NTLM']" is to remove. If you wanted to add an auth ...


1

@flurdy's answer is good as a one-off resolution. But if you often: launch new EC2 instances, start and stop EC2 instances, ..without using Elastic IPs (permanently attached to your servers) then you deal with new/changing IPs/hostnames of your instances all the time. If so then you may want to permanently stop SSH checking and storing server ...


2

It would have been good if the output included the connecting address but based on the provided report it would appear that you connected via IPv6. The reason why I say this is that, when processing the a directive in the SPF record, it looked up example.com.au. AAAA instead of example.com.au. A. If the client connected via IPv6 there is no chance that ...


0

You have mixed up terminology in your question. First you ask for two factor authentication. Next you proceed to explain your needs, which are not at all related to two factor authentication. Two factor authentication in itself doesn't impose any limitations on what the user can do once authenticated. Imposing limitations on what can be done with an ssh ...


1

It looks like openssh server passes through the last message from the client in its "Received disconnect" error message, so it appears that this is a zombie login attempt from a botnet that is authored in Java. packet.c case SSH2_MSG_DISCONNECT: if ((r = sshpkt_get_u32(ssh, &reason)) != 0 || (r = ...


1

Your /etc/hosts is ok (the fully qualified name is the first one). Check if the hostname in the machine is the short or the fully qualified name. Just execute hostname and check the response. If the name is the short one, try to change the hostname name to the fully qualified name: hostname servername.testdomain.local I think there is a -t option to set ...


0

Anyone can attempt to authenticate from any workstation. By way of analagy, you are trying to prevent the janitor from putting the wrong key in any door. The only way stop that is to prevent the janitor from doing so is to simply tell him which key in what door, but you can't stop him from trying without physically stopping him. I'm not sure why you ...


2

You cannot do this, unless you start blocking ports, which won't be limited to a specific user. Sorry. Think of it this way - a Windows system doesn't know who a connecting user is, until they authenticate.


1

Avalance, I am the author of the blog entry you are referencing. The problem you comment it is usually because the kerberos implementation uses the first name obtained by the system (usually the first entry in the /etc/hosts file). What it is happening is that you have the keytab with the fully qualified name and the first host entry is the name without ...


1

Found it! As it turns out, pagespeed was unable to find my css and js files and hence they were not combined nor minified. Thats why only collapse_whitespace and remove_comments worked. I need to Map the location of my static assets and then pagespeed was able to pick it up. So I added this to my pagespeed config and after that pagespeed worked like it ...


0

This depends on the wifi hardware you are using. Modern decent hardware, like Cisco, has a way to supply access points with a correct ssid using radius, which is now called NPS in Windows. So basically - yes, this can be done. What is more disturbing, - according to your description it seems like both domain users are mixed in the single network. This is ...


0

my authsources is just defult values plus yahoo : 'openid' => array( 'openid:OpenIDConsumer', 'attributes.required' => array('nickname'), 'attributes.optional' => array('fullname', 'email',), // 'sreg.validate' => FALSE, 'attributes.ax_required' => array('http://axschema.org/namePerson/friendly'), ...


0

In most LDAP servers, the password is stored in the directory the server is hosting. I think it would be easiest to store the passwords in LDAP and authenticate RADIUS and everything else against LDAP. However, e.g. OpenLDAP supports SASL, so you can authenticate LDAP against something else, typically Kerberos.


1

There is an SSLRequireSSL directive which might work for you here - http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslrequiressl


0

Possibly multiple problems here, the certs being one and another maybe related to smtp_sasl_security_options. I once solved a problem involving that "no mechs" message by setting smtp_sasl_security_options=noanonymous following a clue found on linuxquestions.org


1

What you are seeing is a basic function of SMTP, there is no control over who a person can send as, unless of course you set it up. There is an inbuilt functionality in postfix that will allow you to only let people send with the From email address(es) you specify. You do however need to have SASL enabled (which is what authentication normally is). To add ...


0

It's not only the best approach, it's the only approach.


0

A more comprehensive answer is found on this blog post: http://www.daveperrett.com/articles/2010/09/14/ssh-authentication-refused/ The TL;DR version of it is (the permissions are fairly specific): chmod go-w /home/your-user chmod 700 /home/your-user/.ssh chmod 600 /home/your-user/.ssh/authorized_keys* Additionally, if your user's home dir is a symlink, ...


0

Edit the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Client. Set auth_kerberos and auth_negotiate to 1. Restart the service.


1

Lot's of Googling lead me to https://bugs.launchpad.net/percona-server/+bug/1274821 which describes a similar problem. As documented there, this worked: auth requisite pam_google_authenticator.so forward_pass auth required pam_unix.so use_first_pass account required pam_unix.so audit account required pam_permit.so Although why that works remains a ...


0

Try this configuration: auth requisite pam_google_authenticator.so forward_pass auth sufficient pam_unix.so use_first_pass It's really hard to tell, though, without seeing all auth entries in your pam config file.


0

If you are changing "auth" to "account" then pam_unix is not used for authentication anymore. What do you mean with pam_unix.so checks and accepts the password from the user, but then fails anyway How does your pam configuration for this service look like? As "required" means the stack is processed till the end, maybe it breaks after pam_unix. ...


0

Check Security log in Windows Event Log. All logon events are registered here. Use find (or filter) to search for specified accounts events.



Top 50 recent answers are included