Tag Info

New answers tagged

0

Your approach is entirely reasonable. You may lose clout to migrate legacy clients, and in my limited experience (Oracle DS) proxy LDAP brings new challenges, but this is a known way of handling such a transition.


0

First may i salute you for successfully doing sssd-ad the hard way. The simplest fix for your setup is to treat AD groups as "ldap" groups, not netgroups - remove the @ from the start of the group name + : DL-MyCompany-MyTeam : ALL I'm not sure if nested groups will work as expected. In addition, make sure pam_access is in use in /etc/pam.d


0

Solved. The issue was in the LocationMatch block: Order deny,allow Deny from all was causing the 403 error. Change it to be permissive as in the Directory block and it changes to a 401, which turned out to be a problem with the LDAP authentication. I changed the AuthBasicProvider to 'external' and used pwauth as per (pyxzl.net/store/authnz.php)


0

Figured it out. I had everything set properly except for /etc/pam.d/password-auth sigh... Now that it's working I can go continuously reapply forehead to desk for missing something so simple. Thanks for the help everyone! :)


1

No, you don't need to restart any services after changing PAM configs. Maybe you could run tail -f /var/log/messages /var/log/secure /var/log/audit/audit.log on both systems while trying to access your LDAP server.


0

During my time in Univention's Professional service I worked on multiple similar projects and the one thing missing from the problem description is, what the LDAP is actually used for. The first question you would need to check is whether or not your services are fault tolerant enough to survive a short outage Is the LDAP base hardcoded into any place ...


0

Just Add the User into your local login User For Ex : useradd smbuser smbpasswd -a smbuser Then only you can able to add the user as samba user


0

Determining nested group membership can be tricky with pure LDAP queries. Note that memberOf is a constructed attribute. Further note that primaryGroupID is only that, an ID. While the MMC will show primary groups in the membership tab of an account, the distinguished name of an object is not actually placed in the member attribute of that group. As ...


0

First, SSSD 1.8 is very old and not supported by upstream anymore. I hope this is a vendor-supported distribution. About sudo, I didn't see a request coming from sudo in the sssd_sudo log. In this old version you had to manually install libsss_sudo IIRC, you might want to check if that's the case on ubuntu, too. Finally, I don't understand why do you use ...


1

The most straight forward way at this time is for someone (you) to write either a SASL plugin or pam module to be used by OpenLDAP's Pass-Through authentication. Straight forward isn't necessarily the same as easy.


1

because the sssd cache is not stored in ram, so it survives reboots; do as Brian recommends and add that command to the rc.local, for instance. For more info about the sssd caches read man sssd.conf on your system.


3

Without a credentials cache any offline authentication will fail. Add the sss_cache -E to your startup scripts. If you do wipe the cache on reboot then until the domain servers can be contacted no users will be able to authenticate to that machine using domain credentials until it is able to.


1

It's pretty annoying to do with old commandline tools but the ActiveDirectory Powershell module that you get with the Remore Server Administration Tools has an easy way of returning all nested group members: Get-ADGroupMember "groupname" -recursive Here's a kb article that explains the command: https://technet.microsoft.com/de-de/library/ee617193.aspx ...


0

You have 'encrypt passwords = yes'. From smb.conf (Samba 3): ... In order for encrypted passwords to work correctly smbd(8) must either have access to a local smbpasswd(5) file (see the smbpasswd(8) program for information on how to set up and maintain this file), or set the security = [server|domain|ads] parameter which causes smbd to authenticate ...


0

The problem was that I used the IP address when trying to connect, while the certificate was issued for a DNS name. Now it works.


0

OK, got it. We're using Hamachi for our VPN and it was conflicting with our DNS. Hat tip to @EdFries; when I pinged the server it resolved to the Hamachi-supplied IP and not our internal LAN IP (Hamachi does this to avoid internal IP conflicts). In this case, however, the faux IP was causing trouble. Hamachi has a configuration setting Disable members ...


0

When you setup a nss to fetch information from ldap by adding the necessary info to /etc/ldap.conf and enabling ldap in /etc/nsswitch.conf then you should be all set. The location of the home directory is not affected by whether the information comes from /etc/passwd or from your ldap server. To make authentication work you also need to update the pam ...


0

You could use Virtual Hosts to that match against Locations, whether via Location or LocationMatch. Here's an example that's been updated for Apache 2.4 and is run on a Windows 2012 Server that queries ActiveDirectory (Focus on the LocationMatch section): <VirtualHost *:80> WSGIScriptAlias /bloodhound ...


0

I recently had to perform a PCI audit of a very similar nature (who can log in to these systems and what are their permissions), so have a good feel for what you're trying to accomplish here. The methodology varies from environment to environment depending on how PAM and LDAP are configured. The following factors seem to apply to your environment: The ...


1

While the solution provided by @Mircea_Vutcovici worked for me, my only criticism is that people may get squeamish when they see bitwise operators in use. For instance, I'll be handing over an Apache Bloodhound installation, that uses Apache HTTPd as the front end with AD group auth, to a group of fellow developers. They're going to have issues coming to ...


0

First export your users to a file on wood - pdbedit -e smbpasswd:/tmp/sambausers.bak Then import users to to stone - pdbedit -i smbpasswd:/tmp/sambauses.bak


1

SSHA is a salted SHA-1. By default the last 4 Bytes are the salt. The output of slappasswd is '{<Hash Method>}<base64 converted hash and salt>' So in order to test, whether a plain text password is equal to the salted SHA, you need to: strip the hash method-specifier with e.g. sed. decode the base64 string extract the last 4 bytes, this is ...


0

Simply use `pam_check_host_attr yes` pam_check_host_attr to yes in /etc/pam_ldap.conf file. Man page: # Check the 'host' attribute for access control # Default is no; if set to yes, and user has no # value for the host attribute, and pam_ldap is # configured for account management (authorization) # then the user will not be allowed to login.


0

This can't be done with just ldapmodify, but you can string a couple things together to do what you're asking. The following runs ldapmodify against an ldif file that we build on the fly from an ldapsearch plus the desired modifications. ldapmodify -f <(ldapsearch -LLL -b ou=People,dc=example,dc=com -s one uid=* dn | sed 's/^$/add: ...


1

I often see this kind of thing when I have a problem with the the connection to LDAP. Make sure you have the correct URL for your server. Personally, I avoid the ldapi:// URL. It has only caused problems in the past. Make sure that the binddn can bind. Check both secret files, if you are using password authentication and bind manually from the box to ldap. ...


0

It seems that one (or more) attribute for uid=doctor.lcl,ou=People,dc=domain,dc=lcl contains duplicate value with an already existing LDAP entry, for an attribute defined as unique. First, check your slapd.conf to search for attributes marked as unique. e.g : # index since the unique overlay will search for matching mail attributes index mail eq overlay ...


0

There's a pretty simple setup that just requires samba and pam_mkhomedir.so (use apt-get install) Then create a new file to configure authentication with the contents below. Edit the variables at the top of the file. The first entry (workgroup) is the NETBIOS name of your domain. #!/bin/bash ADSWorkgroup="yourdomain" ADSDomain="yourdomain.com" ...


0

Policies on the LDAP server don't necessarily equate to policies within the OS. You seem to be picturing a framework where you set this overflay property and the OS becomes aware of the need for a password change, but as you can see that's not how it works. To trigger a prompt within the operating system, an accounting module (typically PAM) has to notice ...


2

Yes, if you use Red Hat or any other RHEL-based distro (Feodra, CentOS, Scientify, Oracle Linux to name a few): $ authconfig-tui This would walk you through the setup. Use: User information: LDAP Authentication: Kerberos (with Shadow and Local authorization being set as well) This should get you up and running pretty quickly.


4

You register your domain name with only external, publicly available name-servers. No discussion about it. There might be a reason1 to have authoritative name-servers in your internal network for the top of your domain (the whole of example.com) but they shouldn't be listed in your public DNS. That breaks stuff, as you've already experienced. Your ...


0

I want to make my LDAP Port accessible inside my private network. Is it possible? Yes. You'll need to resolve the fact that your LDAP server only listens at the loopback interface as indicated by the netstat output: tcp 0 0 **127.0.1.1:389** 0.0.0.0:* LISTEN 1096/slapd and make it accept remote connections as well. Possibly you ...



Top 50 recent answers are included