Tag Info

New answers tagged

0

The smartcard authentication on the client side performs a normal challenges response. I.e. the ssh server encrypts a challenge with the public ssh key from the .ssh/authorized_keys. You smartcard decrypts this challenge using the private key on the smartcard. But at this point no x509 certificates are involved. If you want to include x509 certificates and ...


0

I don't believe puttysc can. But I think this is what you are looking for https://www.risacher.org/putty-cac/


0

From what I recall loginwindow:login is actually used in spawning the GUI login window, similar to builtin:policy-banner. So it is logical to be spawned before the rest of the actions. So the GUI window is the one that is actually irrelevant/bypassable, not the credentials themselves. What exactly would you like to modify and towards what purpose ? For ...


1

I followed this DigitalOcean guide and from what you've posted, you need to copy the jail.conf file to jail.local in order for it to work. From the guide: There is a file with defaults called jail.conf. Since this file can be modified by package upgrades, we should not edit this file in-place, but rather copy it so that we can make our changes ...


0

After working through some things in the Augeas IRC room, it appears that my issue was simply a syntax error. When using "augtool print" directly (without dropping into the augtool> prompt), paths must be quoted. Meaning, augtool print /files/etc/pam.d/*/*/argument[. = 'nullok_secure'] Will not work, but: augtool print '/files/etc/pam.d/*/*/argument[. = ...


1

First, the two expressions you list are not stricly equivalent. /files/etc/pam.d/*/*/argument[../argument = 'nullok'] selects argument nodes 2 levels under /files/etc/pam.d that have an argument sibling node (or themselves) with a value set to nullok, whereas /files/etc/pam.d/*/*/argument[. = 'nullok'] selects argument nodes 2 levels under ...


0

At the moment, SSSD only handles system users, that is, users with IDs. The ID can either be defined in LDAP directly or derived from SID. Your use-case is not supported by SSSD at the moment, sorry.


0

You should properly configure not only krb5.conf but also sssd.conf -- either hard-code your server host names with krb5_server/ldap_server/whatnot or point resolv.conf at a server that can resolve the proper SRV records for you. See also http://jhrozek.wordpress.com/2014/11/04/how-does-sssd-interact-with-tools-like-kinit/ for an overview of how sssd ...


1

I had a very similar problem on RHEL 6. I was already connected to the domain, but I kept seeing the error kinit-succeeded-but-ads_sasl_spnego_krb5_bind-failed in my logs. This was the resolution for me, and I thought that it could be beneficial to you as well. When I was looking in /var/log/samba I noticed two log.wb-* files. In my environment we ...


1

Lot's of Googling lead me to https://bugs.launchpad.net/percona-server/+bug/1274821 which describes a similar problem. As documented there, this worked: auth requisite pam_google_authenticator.so forward_pass auth required pam_unix.so use_first_pass account required pam_unix.so audit account required pam_permit.so Although why that works remains a ...


0

Try this configuration: auth requisite pam_google_authenticator.so forward_pass auth sufficient pam_unix.so use_first_pass It's really hard to tell, though, without seeing all auth entries in your pam config file.



Top 50 recent answers are included