Tag Info

Hot answers tagged

4

You register your domain name with only external, publicly available name-servers. No discussion about it. There might be a reason1 to have authoritative name-servers in your internal network for the top of your domain (the whole of example.com) but they shouldn't be listed in your public DNS. That breaks stuff, as you've already experienced. Your ...


3

I recommend iterative changes. Create the new desired structure (groups first) and add existing items there. You can then unit test removing the legacy groups one or two at a time, while knowing exactly where to look if things break. A cut-over approach will likely be a huge headache for an organization of any size. I will say that OUs are probably ...


3

Without a credentials cache any offline authentication will fail. Add the sss_cache -E to your startup scripts. If you do wipe the cache on reboot then until the domain servers can be contacted no users will be able to authenticate to that machine using domain credentials until it is able to.


2

This is very hard to find out. I'm not entirely sure if it's possible to find out if a particular group is being called. Regardless, even if you did manage to find out if a specific group is being used, and from where, most applications don't actually use the group name. They use the SID of the group. Chances are if you were to find out exactly where all ...


2

I found the solution to the problem. By running sssd -i -d 4 and trying to log in on a different console, I saw that START TLS was where the login failed. Apparently Red Hat and Fedora by default use TLS. The server does not have TLS (we don't have enough time right now). To disable TLS edit /etc/sysconfig/authconfig on the client machine and update ...


2

Yes, if you use Red Hat or any other RHEL-based distro (Feodra, CentOS, Scientify, Oracle Linux to name a few): $ authconfig-tui This would walk you through the setup. Use: User information: LDAP Authentication: Kerberos (with Shadow and Local authorization being set as well) This should get you up and running pretty quickly.


1

I often see this kind of thing when I have a problem with the the connection to LDAP. Make sure you have the correct URL for your server. Personally, I avoid the ldapi:// URL. It has only caused problems in the past. Make sure that the binddn can bind. Check both secret files, if you are using password authentication and bind manually from the box to ldap. ...


1

It's pretty annoying to do with old commandline tools but the ActiveDirectory Powershell module that you get with the Remore Server Administration Tools has an easy way of returning all nested group members: Get-ADGroupMember "groupname" -recursive Here's a kb article that explains the command: https://technet.microsoft.com/de-de/library/ee617193.aspx ...


1

The most straight forward way at this time is for someone (you) to write either a SASL plugin or pam module to be used by OpenLDAP's Pass-Through authentication. Straight forward isn't necessarily the same as easy.


1

SSHA is a salted SHA-1. By default the last 4 Bytes are the salt. The output of slappasswd is '{<Hash Method>}<base64 converted hash and salt>' So in order to test, whether a plain text password is equal to the salted SHA, you need to: strip the hash method-specifier with e.g. sed. decode the base64 string extract the last 4 bytes, this is ...


1

While the solution provided by @Mircea_Vutcovici worked for me, my only criticism is that people may get squeamish when they see bitwise operators in use. For instance, I'll be handing over an Apache Bloodhound installation, that uses Apache HTTPd as the front end with AD group auth, to a group of fellow developers. They're going to have issues coming to ...


1

because the sssd cache is not stored in ram, so it survives reboots; do as Brian recommends and add that command to the rc.local, for instance. For more info about the sssd caches read man sssd.conf on your system.



Only top voted, non community-wiki answers of a minimum length are eligible