Hot answers tagged

2

Edit: Based on the contents of the provided account stack, it looks like pam_krb5.so will be skipped if pam_localuser.so succeeds. This is the most likely cause of the password aging restrictions not being applied. Here's what we know so far: The logged messages confirm that the user's password has expired. pam_krb5 succeeds in authentication despite ...


1

Following on to Toddius' answer, I have a co-worker in a similar situation (Windows 7 Enterprise 64-bit, joined to an AD domain, also running MIT Kerberos for Windows 4.0.1): His copy of the Kerberos Ticket Manager would only allow him to have one principal/one TGT. Whenever he would use the "Get Ticket" button to get a TGT for a different principal, the ...


1

Running your messages through audit2allow we find #============= smbd_t ============== #!!!! This avc can be allowed using the boolean 'samba_export_all_rw' allow smbd_t tmp_t:file { write open }; This tells us that samba isn't allowed to write or open files with a context tmp_t 1. You could put SELinux in Permissive mode and let the system run for a ...


1

Those descriptions are a bit vague. There are two tokens. A process Access Token, and a Kerberos token. The process token is specific to the local computer. "In Windows implementation, the application server derives the authorization data (PAC) and requests Windows OS to generate an access token." https://blogs.msdn.microsoft.com/openspecification/...


1

This is not possible as Alexander explained on freeipa-users: http://www.redhat.com/archives/freeipa-users/2016-June/msg00294.html


1

I believe that Puppet has the ability to execute powershell commands using the Powershell EXEC provider. You could create an account that is only delegated to join the PC to the domain and use: # Create Credentials $Script_Domain_Join_Credential = New-Object System.Management.Automation.PSCredential($Script_Domain_Join_Username,$Script_Domain_Join_Password) ...


1

Foreman has good support for joining realms - however the only provider supported so far is FreeIPA. It allows to manually register bootstrapped hosts in the realm as per your requirement. You may give it a shot with Active Directory and report failures at http://projects.theforeman.org/issues/ as feature requests though. Please check out the documentation ...


1

Ok, first of all, thanks to @Jason-Walker for the pointer at kclient -- a typical Sun's implementation (functional but ugly) in ksh with helper-utilites implemented in C. Apparently, joining a domain consists of creating the host's entry via standard LDAP -- Sun's script uses ldapsearch, ldapmodify, and ldapadd from the OpenLDAP. Once the host is registered ...



Only top voted, non community-wiki answers of a minimum length are eligible