Tag Info

New answers tagged

0

The protocol you use when sending test packets to the server is RADIUS-PAP. This protocol will work if the password in your ldap directory is hashed. The protocol you are using when performing authentication using the access point is likely EAP-PEAP over RADIUS. PEAP will not work if the RADIUS server doesn't have access to the NT-Password or Cleartext ...


0

The ldap filter that will do as you describe (prevent access from users with location set to either of those values) is: ldap_filter = (!(|(location=secure)(location=sysadm)))


0

At first glance, in the manual, Kerberos with SPNEGO is supported out of the box: Similarly to Hadoop RPC, Hadoop HTTP web-consoles can be configured to require Kerberos authentication using HTTP SPNEGO protocol (supported by browsers like Firefox and Internet Explorer).


0

That problem is usually solved by extra caching layers like PAM ccreds or more advanced solution like RHEL's sssd . For pam ccreds the config file /etc/pam.d/common-auth will be somewhat like auth sufficient /lib/security/pam_unix.so auth [authinfo_unavail=ignore success=1 default=2] /lib/security/pam_ldap.so use_first_pass auth [default=done] ...


0

This is how we did it on our boxes, so be warned, it might not apply to your setup. A few caveats: Our server has a valid CA-signed certificate, be sure to modify ldap_tls_cacert if yours has a self-signed certificate (which is bad (tm) anyway). We use LDAP to provide sudo rules, to leave that out if you don't want it. You might want to set ...


1

Do i need a new bind to the server referred to? Yes. If so, is it neccessary, that the username and password i used for the root system will also work for the subsystem? No. Is there an easier way to tell an ldap search to chase referrals on its own? There are various OpenLDAP slave replication configuration options about that. Depending on ...


1

If you haven't consider sniffing the traffic between the LDAP server and the WebLogic server. I suspect you're going to see a failure similar to Google Chrome's failures of TLS 1.2 key exchange. You might try removing the new cipher suites that MS14-066 adds to see if that changes the behavior. Microsoft has updated the MS14-066 patch to remove these ...


0

Have you tried setting those parameters in ldap.conf? # Search timelimit #timelimit 30 # Bind/connect timelimit #bind_timelimit 30 # Reconnect policy: hard (default) will retry connecting to # the software with exponential backoff, soft will fail # immediately. #bind_policy hard


0

Ok. It was a problem with the certificates. While testsaslauthd gave no useful output for debugging (no matter how much I tried to get more info) ldapsearch gave me a hint. So. Ensure that in /etc/openldap/ldap.conf the certificate directory entry exists TLS_CACERTDIR /etc/openldap/certs and also download the certificate from the ldap server (the ...


0

I got it figured out. I didn't have the ldapauth module actually loading from the configuration file. Once it's loaded I am only able to login using ldap authentication.


0

Yes. Get the operational attribute pwdPolicySubentry from the user entry and retrieve the entry at that DN. If the attribute is absent or empty they are using the default policy, which is also in the DIT but you would have to know where, from the slapd.conf or slapd.d configuration of the ppolicy overlay. If it's an online configuration and you have access ...


4

Active Directory is unusual among LDAP directories in that it is not uncommon to have very large payloads. In fact, the largest payload you can send is 12 Mbytes. This seems outlandishly large, but there you go. On the input side, it's possible someone may send a query like (|(samAccountName=jsmith)(samAccountName=jdoe)(...)(samAccountName=zsmith)) and ...


0

Yes, you can use LDAP for handling permissions with a wide range of options, depending on what your app supports. If you use LDAP as an NSS source for users and groups, you can hand out sudo rights to it just like users coming from /etc/passwd.


0

No, the internal CA's root cert should be trusted by the LDAPS client, not the individual entity certificates for the domain controllers. This trust is automatic in a default configuration, assuming that the web server's a member of that domain.


1

You don't mention the specifics of the web server software. That's what this really depends on. If the web server software isn't validating the certificates used for LDAPS against a CA root certificate then you don't need to do anything. That defeats the purpose of using LDAPS to some extent (since you're opening yourself up to MiTM attacks) so it makes ...


1

You're "it works" example works because the DN of the object is cn=LaCroix\, Jay,OU=My Group,OU=Site-Users,DC=mycompany,DC=local. The second doesn't work because the DN of the object isn't cn=jlacroix,OU=My Group,OU=Site-Users,DC=mycompany,DC=local. It's not that you're binding with the "Last Name, First Name", rather the CN of the object is set to " Last ...


3

Your terminology like "using LDAP to log in" makes me think that you're not really very familiar with Windows Server. I think you'd do well to look at hiring an outside consultant to help you get this put together. Active Directory Group Policy can do what you're looking for in a fairly simple manner. You'd create Organizational Units (OUs) to house the ...


1

Given that Google's main use case is to get you to abandon on-premise directory services I think you're going to have a tough time finding any canned examples. The Google Directory API has functionality to retrieve all users and the output should be reasonably easy to parse (since it's just JSON). You might be able to cobble something together with this API ...


0

There is a more recent tutorial here, works for Mac OS 10.7 / 10.8. http://linsec.ca/Using_FreeIPA_for_User_Authentication#Mac_OS_X_10.7.2F10.8


0

I guess, you dont quite understand how a memberof works. http://www.openldap.org/doc/admin24/guide.html#Reverse%20Group%20Membership%20Maintenance you should create cn=Udo as inetOrgPerson in 'cn=users,dc=indunet,dc=it', then you should create cn=plainuser as groupOfMembers or groupOfUniqueMembers in 'cn=groups,dc=indunet,dc=it', then you should add ...


0

That sounds like the basic "hosts allow" or "hosts deny" options, which can be set on specific shares as well as globally. You could do something like: [global] ... [sensitive share] hosts allow = 192. ... [VPN Friendly Share] hosts allow = 192. 172. ... Does that achieve what you're looking for?


0

the ldapserver needs to be the first entry in /etc/hosts 192.168.1.5 fqdn.of.your.ad.server some.other.name and.another If everything is correctly in dns, then remove the line from /etc/hosts all together.


0

Use -S parameter (in your case, -S gid) in ldapsearch command. From the ldapsearch man page: -S attribute Sort the entries returned based on attribute. The default is not to sort entries returned. If attribute is a zero-length string (""), the entries are sorted by the components of their Distinguished Name. See ldap_sort(3) for more details. ...


0

Folks, Thanks for all. I found these links : https://bugzilla.redhat.com/show_bug.cgi?id=895513 and this one : http://www.unixmen.com/rhel-centos-6-4-ldap-md5-certificate-error-caused-by-nss-3-14-update/ I've got one problem for testing this solution, how to put this following line in GRUB2 systemd.setenv=NSS_HASH_ALG_SUPPORT=+MD5 So, I 've got ...


2

Make this a part of the user creation process, where it belongs. If you want/must do it in a separate way, I would simply either add a custom schema with a field like WelcomeSent or (ab)use an unused field for this purpose and set it to true if the mail has been sent. You then write a simple cron job searching for user records with this field not set to ...


3

On Active Directory domain controllers, LDAPS support is optional, and needs a proper certificate to be enabled; otherwise, only LDAP services are provided. A quick way to check if your server supports LDAPS is to try a connection to its TCP port 636 (or run netstat on the server itself): if it's closed, LDAPS is not enabled and you should either enable it ...


2

I think this bit is probably the key: certificate is not valid - error -8016:The certificate was signed using a signature algorithm that is disabled because it is not secure My guess is that the server that refuses the cert might be configured not to accept SHA-1 based signatures. I'm no cryptographer, but of the other SSL issues that have come to my ...


0

You did not indicate how you installed the CA cert file. When using RH or derivatives you could just use the info in man update-ca-trust, the tldr; version is: copy the CA cert file to /etc/pki/ca-trust/source/anchors/ run update-ca-trust enable && update-ca-trust profit! update-ca-trust comes with the package ca-certificates which is in the ...


1

Besides deploying the certificate, you may need to create a symbolic link for the certificate. The c_rehash utility is provided for this. You can also use a command openssl x509 -noout -hash -in vsignss.pem to get the hash value for the certificate. The symlinks have a .0 suffix. Alternatively, you can add the certificate to your LDAP configuration. ...


1

I also ran into the same problem. After reading a lot of docs I came up with the following "solution": To workaround the name clashes I renamed User Private Groups by adding a "g" character at the beginning. For example: User=erik, Group=erik. Now on active directory I named the group "gerik". This way I can continue concentrating on AD migration without ...


3

You can modify the default permissions in Active Directory (AD) to accommodate this requirement, but it won't be particularly easy or "clean". The default permissions in AD are, arguably, very "open". To accomplish what you're looking for you're going to need to enable List Object Mode in your Active Directory (to limit object visibility). You should use a ...


0

We just had this problem happen. It turned out that all we had to do was restart Apache. I have no idea what the cause was (I don't administer the server) but it was most likely security updates.


0

First off, I'd stop using su to provide root access. I'd immediately switch to using sudo for a variety of reasons. For one of the best, the root password is not exposed and it is wonderfully configurable to allow users either run just like the root user or limit the subset of commands needed. You can provide access via a group as well. One thing that ...


4

Don't open services on your domain controllers to the Internet. Configure a VPN between your digital ocean footprint and your on-prem Active Directory and query AD over the VPN.


0

I think the syntax you want is: ldapdelete -xW -D 'your account dn' 'object to delete'



Top 50 recent answers are included