Tag Info

Hot answers tagged

1

I got this to work in my environment by querying LDAP for the userPrincipalName instead of sAMAccountName as my squid also returns user@domain.local from Kerberos/NTLM auth. Also be sure to use %20 instead of spaces and when I was specifying the bind DN in my conf file, I used quotes as it had an & in the DN and squidguard was not binding because of ...


1

I don't know of any way to do what you want with PAM without writing a new pam module. PAM is relatively complex and the way that sshd interacts with PAM and kerberos has been in my experience such that there is always an edge case that just doesn't work. What you want may be possible, I just don't know how to do it. If you only need to secure ssh what I ...


1

A user with an existing, valid Kerberos ticket must be asked only for the second factor. This can't be achieved through PAM. Successful key-based authentication performed against sshd bypasses the auth stack of PAM. This includes GSSAPI, which is a requirement for ticket based Kerberos authentication. It has no choice but to do this as PAM was ...



Only top voted, non community-wiki answers of a minimum length are eligible