New answers tagged

1

Running your messages through audit2allow we find #============= smbd_t ============== #!!!! This avc can be allowed using the boolean 'samba_export_all_rw' allow smbd_t tmp_t:file { write open }; This tells us that samba isn't allowed to write or open files with a context tmp_t 1. You could put SELinux in Permissive mode and let the system run for a ...


1

Those descriptions are a bit vague. There are two tokens. A process Access Token, and a Kerberos token. The process token is specific to the local computer. "In Windows implementation, the application server derives the authorization data (PAC) and requests Windows OS to generate an access token." https://blogs.msdn.microsoft.com/openspecification/...


0

yellow, the information from the 2008 AD Resource kit is correct, Access tokens are created by local systems and then attached to threads that user is running. there is some very good information here: https://msdn.microsoft.com/en-us/library/windows/desktop/aa374909(v=vs.85).aspx and here https://technet.microsoft.com/en-us/library/cc783557(v=ws.10)....


1

Ok, first of all, thanks to @Jason-Walker for the pointer at kclient -- a typical Sun's implementation (functional but ugly) in ksh with helper-utilites implemented in C. Apparently, joining a domain consists of creating the host's entry via standard LDAP -- Sun's script uses ldapsearch, ldapmodify, and ldapadd from the OpenLDAP. Once the host is registered ...


1

This is not possible as Alexander explained on freeipa-users: http://www.redhat.com/archives/freeipa-users/2016-June/msg00294.html


1

I believe that Puppet has the ability to execute powershell commands using the Powershell EXEC provider. You could create an account that is only delegated to join the PC to the domain and use: # Create Credentials $Script_Domain_Join_Credential = New-Object System.Management.Automation.PSCredential($Script_Domain_Join_Username,$Script_Domain_Join_Password) ...


1

Foreman has good support for joining realms - however the only provider supported so far is FreeIPA. It allows to manually register bootstrapped hosts in the realm as per your requirement. You may give it a shot with Active Directory and report failures at http://projects.theforeman.org/issues/ as feature requests though. Please check out the documentation ...


1

Following on to Toddius' answer, I have a co-worker in a similar situation (Windows 7 Enterprise 64-bit, joined to an AD domain, also running MIT Kerberos for Windows 4.0.1): His copy of the Kerberos Ticket Manager would only allow him to have one principal/one TGT. Whenever he would use the "Get Ticket" button to get a TGT for a different principal, the ...


0

There won't be any transparent way of doing this. The host keytab represents a copy of the host secret - a password that is known only to the Kerberos servers (Active Directory Domain Controllers) and the client. Under normal circumstances, the keytab is created when the client is joined to the Domain (at which time the user authenticates to the Domain and ...


0

The security prompt was actually due to some sort of internal Excel file linking. Creating and testing anew file works fine.


0

After some investigations, the problem was really a configuration problem : following the guide here I managed to authenticate using Kerberos. To sum up all the actions, you need to : Enable windows authentication on IIS Create an account service Create SPN for the hosts address you're gonna use associate this service to the application pool used to ...


2

Edit: Based on the contents of the provided account stack, it looks like pam_krb5.so will be skipped if pam_localuser.so succeeds. This is the most likely cause of the password aging restrictions not being applied. Here's what we know so far: The logged messages confirm that the user's password has expired. pam_krb5 succeeds in authentication despite ...



Top 50 recent answers are included