Tag Info

New answers tagged

-1

you are in o=Mindlandcollege ConsoleOne is deprecated at this point for any function and the export tool was never all that, iManager is the current tool from Novell. That being said, I would use Apache Directory Studio as it talks directly to the LDAP and has a more easily understandable toolset. Save consoleone and imanager for actually manipulating the ...


3

Not out of the box, but using Net::LDAP and a little bit of your own printf magic, you too can have a tree-like LDAP representation.


3

Update LDAP to include the OpenSSH-LPK schema We first need to update LDAP with a schema to add the sshPublicKey attribute for users: dn: cn=openssh-lpk,cn=schema,cn=config objectClass: olcSchemaConfig cn: openssh-lpk olcAttributeTypes: ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey' DESC 'MANDATORY: OpenSSH Public key' EQUALITY ...


0

Seems that I ask same question at: http://stackoverflow.com/questions/27571558/how-was-authentication-built-on-ldap See to http://thecarlhall.wordpress.com/2011/01/04/ldap-authentication-authorization-dissected-and-digested/ : Get a connection to the LDAP server. Bind as the application user. Search for the DN (distinguished name) of the user to be ...


0

Rather than specifying the SSL port after the IP address, use the ldaps protocol in the URI with the -H switch. ldapsearch -x -H ldaps://127.0.0.1 -D cn=[base DN] -d1 If you are connecting to a server with a self-signed certificate, you may also need to modify ldap.conf to disable certificate verification: HOST 127.0.0.1 PORT 636 TLS_REQCERT ALLOW


1

After many tries I've found the solution. The problem was in incorrect VirtualHost configuration for git-http-backend. Here's my working config: <IfModule mod_ssl.c> <VirtualHost _default_:443> DocumentRoot /git/myrepos SetEnv GIT_PROJECT_ROOT /git/myrepos SetEnv GIT_HTTP_EXPORT_ALL ScriptAlias /myrepos/ ...


0

How to disable the local group file (forever)? This is not a Good Idea(tm). Attempts to do this would be very "impactful" Or is there any other workaround? You mention the following, which sounds like this occurs whenever the servers are patched and rebooted. "...whenever a package is updated that has something to do with groups..." One "least impactful" ...


0

Got it: the IPv4 port was attributed to portreserve.


1

the GidNumber is unlimited. The GID number is defined as an integer in the schema definitions attributetype ( 1.3.6.1.1.1.1.1 NAME 'gidNumber' DESC 'An integer uniquely identifying a group in an administrative domain' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) According to RFC 4517 LDAP: Syntaxes and ...


0

Check the man page for smbldap-useradd, it sounds like you need to set -B 0 in your script. According to this, it will clear the "User must change password" flag on the account. You may want to review your smb.conf to make sure you don't have any unexpected smbldap-useradd settings.


1

Items are "entries". The "path" to an item is its DN, or Distinguished Name. References: Relative article on Microsoft's MDSN Link from RHEL7 documentation


0

Isn't phone-based auth an option? I prefer that because it's much less of a maintenance burden than certs. For example, to allow someone new to use VPN, you just fill his/her phone number in LDAP, then maybe add him/her to the VPN-enabled users group (if you do that kind of filtering at all), and that's it. Whereas with certs you have to generate a cert, ...


0

I solved the problem I just went in and disabled selinux by going into /etc/selinux/config and set SELINUX=disabled I did a quick reboot, and I could log in, no problem


0

The culprit seems to be systemd. Try running nslcd yourself will see it working. When you start nslcd using systemctl, it spawns a new process when you try to query nslcd. In messages I see: Dec 3 19:53:33 myhostname nslcd[2227]: [8b4567] <passwd="myuser"> problem closing server socket (ignored): Bad file descriptor Dec 3 19:53:33 myhostname ...


1

There are actually two disabled states for an Exchange mailbox. What many people consider "disabling" occurs when the Disable-Mailbox cmdlet is run. This actually removes most of the Exchange attributes from the account, and disconnects the mailbox. There is however an AD attribute msExchUserAccountControl. If this is set to 2, the mailbox is ...


3

This is a normal behavior. UserAccountControl refers only to the user in the directory. Exchange add many attributes with which you can determine if a LDAP user has a mailbox. I'd say that msExchMailboxGuid would be the best, since every active mailbox must have one, and exchange delete the value when the mailbox is disabled (Tested on Exchange 2010 with ...


0

Since Apache2 starts as root and reads config file before dropping root. Assuming your current file config is owned by root and group is root, like so: -rw-r--r-- 1 root root 1.4K 2014-10-15 14:43 vhostconf You can just drop read/write/execute from the file to "other users": sudo chmod o-rwx /etc/apache2/sites-available/vhostconf You should end up with: ...


1

You need to have all of the following for LDAPS to work: Configure the client to trust the CA that issued the certificate (or if using a hierarchical PKI, the root CA) Configure the client to access the Domain Controller server via FQDN The FQDN of the Domain Controller server must resolve correctly in DNS The FQDN of the Domain Controller server ...


0

I was not able to resolve this completely. However, inspection of the /var/log/sssd/sssd_DOMAIN.log revealed that SSS is working but likely issue with improperly specified DN? (Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing! (Tue Nov 25 16:21:16 2014) [sssd[be[LDI.LAN]]] [sdap_process_result] ...



Top 50 recent answers are included