Tag Info

Hot answers tagged

20

Assuming all your Domain Controllers are Windows Server 2003 or later you can do this with native Active Directory's dynamic objects functionality without any scripting. Let's say that a user account, "Bob", needs to be in the "Accounting" group for 24 hours. Create a "Bob in Accounting 24 Hours" group and specify an entry-TTL for 24 hours (the duration ...


13

Michael's answer was the closest, but I wanted to be sure, so I installed a fresh copy of Ubuntu Server 8.04.2 (Hardy Heron) in a virtual machine to get the official group list. The installation was a basic one with no specific server roles selected. These are the first groups, assigned by default, to the first user: $USERNAME (e.g. wayne) (primary group ...


13

I was looking for a solution, came across this post, and then later found one! I'd thought I'd actually offer a solution so others can benefit. Logging in and out is so 1995. Taken from: https://arkaitzj.wordpress.com/2010/03/08/linux-add-user-to-a-group-without-logout/ So if you needed to get permissions for the cdrom group you just added your user to: ...


12

FreeIPA is probably what you're looking for. It's to Linux what Active Directory is to Windows. (It can also talk to AD if you have a heterogeneous environment, but shouldn't be used to manage Windows machines directly. Use AD for that.) Red Hat's documentation (they call it Identity Management) is very thorough and easy to follow, and should be mostly ...


9

You need to set AuthLDAPSubGroupDepth to make this work. The integer you provide here specifies the maximum sub-group nesting depth that will be evaluated before the user search is discontinued. Add this to your config: AuthLDAPSubGroupDepth 1 More Info: here and here.


8

Besides AuthLDAPSubGroupDepth, that is available only in apache 2.4, it is possible, when using Microsoft AD LDAP, to do authorization using nested groups by using LDAP_MATCHING_RULE_IN_CHAIN matching rule. This is much faster than searching subgroups on the client, because it is done on the DC server with less queries over network. Require ldap-filter ...


8

This can be done through PowerShell $DNOfManager=dsquery user -o dn -name "Testing Tester" $GroupList=dsquery group DC=ad,dc=example,dc=local -limit 600 Foreach ($group in $grouplist) { set-adgroup -Identity $Group -ManagedBy $DNOfManager add-adpermission -Identity $Group -user $DNOfManager -AccessRights ReadProperty, WriteProperty -Properties ...


7

The domain admins group, and the AD builtin\Adminstrators group (not the local admin group on clients) effectively grant users in them the same rights, however there are some subtle differences: builtin\administrators is a domain local group, where as domain admins is a global group Domain admins are a memeber of builtin\administrators Domain admins are a ...


7

Adding a user to a group does not effect currently logged in users. In the case of a daemon, you need to restart it for new groups to be applied. Furthermore, restarting the daemon using an option in the daemon itself will not work as that will inherit the current environment. The easiest way to get it to work is to fully stop the daemon and start it ...


7

You don't. There has to be a trust between the computer and the domain (aka joining the computer to the domain) to be able to authenticate domain users locally. Now for something practical: You have two options 1) create a local user with the same username and password as the domain user, and add that local user to the local group. 2) Join the machine ...


7

What you're seeing is the SID (Security Identifier) of an object. Generally, Windows is nice enough to automatically translate this SID into a user's display name for you in the Security dialog, so that you don't have to hunt for it, but if a Domain Controller is unable to be contacted when the ACL is being viewed, you'll see a SID. You'll also see this SID ...


7

There is no standard requiring any interoperability meaning of this groups. Traditionally the adm group is used to give a user access to some sort of system log files. See e.g. ls -l /var/log. The sys group normally intended to give a user some kind of administration rights. E.g. archlinux use this group for cups administration. Other distributions behave ...


7

Your understanding is dead on. You could potentially maintain a number of different default address lists based on a user's access level (only letting them have a given group in their list if they're authorized), but that's incredibly ugly and would be nearly impossible to maintain. One way to get rid of the expandability would be to use Dynamic ...


7

Assuming the jumpbox is a linux box, iptables can usefully be used on the OUTPUT chain to restrict which group members can connect to which servers. Something like iptables -A OUTPUT --gid-owner project1 -p tcp --dport 22 -d ip.of.project1.com -j ACCEPT iptables -A OUTPUT --gid-owner project1 -j REJECT iptables -A OUTPUT --gid-owner project2 -p tcp --dport ...


6

Presumably because your sudoers file does not specify this. It is the difference between two lines like these: the first is the default but the second also allows you to run commands as any group, which is what you want. steve ALL=(ALL) ... steve ALL=(ALL:ALL) ...


6

Security groups can be associated with ACLs, whereas distribution groups can't. Both security groups and distribution groups can be mail enabled. http://technet.microsoft.com/en-us/library/cc781446(v=ws.10).aspx


6

You could handle this a few ways, none are native to AD: Write a script and put it in task scheduler. Have it query a text file or CSV somewhere on the network with the current list. Have it remove people not on that list at runtime. Use something like System Center Orchestrator to create a runbook to add users to the group and to remove them after X ...


6

Gimme the codes! powers, activate! $Groups = Get-ADGroup -Properties * -Filter * -SearchBase "OU=Groups,DC=corp,DC=ourcompany,DC=Com" Foreach($G In $Groups) { Write-Host $G.Name Write-Host "-------------" $G.Members } The point being, just take your time and break it out into steps. I know that it's fun to try to get everything and the ...


6

As Gordon Davisson notes, standard Mac OS X 10.6 already has a mysql group, as this command shows: dscl . -read /Groups/mysql You shouldn’t create your own mysql group, and any attempts to modify it will affect the _mysql group. But to answer your question, the most succinct way to do it would be this single command: dscl . -create /Groups/mysql gid 296 ...


6

You can create a file containing the list of usernames, etc., and use the newusers command. It wants the file to look like the format of /etc/passwd with a few exceptions, one is that the password is plain text (newusers encrypts it). newusers userfile.txt It doesn't handle multiple groups, though.


6

It looks like your only option in Apache 2.2 is to list every group that is included by your main authorized group. Require ldap-group CN=MySpecificGroup,OU=Security Groups,OU=MyBusiness,DC=company,DC=local Require ldap-group CN=MyOtherGroup,OU=Security Groups,OU=MyBusiness,DC=company,DC=local This should be reasonable if your nested groups aren't too ...


6

Simple: Someone or something removed him from these groups. This doesn't happen automatically and I've never seen an AD failure that's caused this - it was either an error from another administrator, or an automated process gone awry, such as a script. There's likely nothing you can do now, but in the future you can audit Directory Services changes.


5

If you have just added a user to a group, you will need a log out and log back in in order to acquire the new credentials. For example: $ id uid=500(lars) gid=500(lars) $ groups lars $ sudo usermod -G wheel,libvirt,mock lars $ groups lars $ groups lars lars : lars wheel libvirt mock And if I log out and log back in: $ groups lars wheel libvirt mock


5

I would suggest a good local consultant to assess the particulars of your situation... Really. There may be other business requirements or nuances that people on this forum may not recognize or be invested-enough to consider. A dedicated resource is your best bet... Otherwise, we're just throwing product recommendations at you for something that's easily ...


5

Now I suffer from a mental buffer overflow and little confidence of ever being able to tame this beast. First: Relax. I've learned that, when you're new to something with a learning curve such as Puppet, it is pretty easy to become overwhelmed and not be able to get much done. is his login thebob then defined two times, in lanusers.pp with groups ...


5

Users can't create groups, only the superuser can. And the superuser can create up to the system maximum minus existing groups. Modern Linuxes have a 32-bit gid_t, so just short of 4.3e9. Depends completely on the NSS being used. I don't think the files NSS has a limit. Again, depends on the NSS. Using something like LDAP would be faster than files ...


5

So, I wouldn't say it's bad, but it can be. There's a few reasons, one of them has to do with scripting. Circular nesting is essentially an "infinite loop" because scripts use a lot of recursive functions. This would obviously cause a script to error out, etc. Then there is the idea of 'simplification' in AD that circular nesting inherently goes against. ...


4

The entries in your sudoers look ok. What you need to so is use sudo to run the command e.g. sudo etc/init.d/httpd restart and sudo etc/init.d/mysqld restart You can combine the entries in sudoers too %websupport ALL=NOPASSWD:/etc/init.d/mysqld, /etc/init.d/httpd


4

Your version of usermod doesn't support LDAP. This was fixed in newer versions of RHEL: http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.5_Technical_Notes/shadow-utils.html


4

According to the AD design guidance, there are 2 things to consider when designing your structure: 1)delegation of administrative control and 2)group policies. Since Group Policies don't apply to groups, you're basically left with one - delegation of Administrative control. Your model B gives the option to do some local delegation of administrative tasks ...



Only top voted, non community-wiki answers of a minimum length are eligible