Tag Info

Hot answers tagged

48

This is a chronic problem with large Identity Management systems attempting to glue together heterogeneous systems. Invariably, you'll be limited to the lowest common denominator, which all too often is an 8-character ASCII-alpha-numeric limit thanks to some (probably legacy) Unix-like system somewhere in the bowels of the datacenter. Those fancy modern ...


35

One central component of Active Directory is LDAP, which is available on Linux in the form of OpenLDAP and 389DS (and some others). Also, the other major component Kerberos is available in the form of MIT Kerberos and Heimdal. Finally, you can even connect your machines to AD.


28

In the case of Debian and its related distros, adduser is a friendlier interactive frontend to useradd.


26

Open up "Control Panel | System and Security | System" In the dialog click on "Advanced system settings" (requires Admin rights) The "System Properties" dialog will be displayed Make sure you are in the "Advanced" register In the "User Profiles" section click on "Settings" The "User Profiles" dialog is displayed Select the account. Hit Delete. Faster: ...


23

You can try with puppet for managing user: Why Use Puppet to Manage User Accounts? (and not NIS, LDAP, etc) One of the benefits to managing user accounts in puppet is the fact that it is decentralized. Each user account is just a normal user account on the managed server. There is nothing special about the user accounts puppet creates other ...


21

Your questions specifically: What is the best username length limit to use to maintain compatibility across all uses? There's no such thing. There's only "your" uses, which may include your future uses. We have no idea what those are. What characters should be avoided? This will depend on what computer systems you're dealing with. Windows, for ...


19

The one place I can see it being justified is on service accounts. Typically you don't want a service account password to simply expire which could cause all the processes that account runs to fail. Interactive user accounts should always have passwords follow the password policy. You have to make sure if you do set service accounts to not expire that you ...


18

I'm at a Tier 1 PCI vendor. We have something like this in place, with a few differences. The auditors are actually attempting to describe a very real problem, but doing an incredibly poor job explaining the implications and needs analysis. It is now more effective to compromise a system by using a hash of a password or an existing token. Put plainly, ...


16

My advice to you is to follow the standard recommended by the default NAME_REGEX. You can actually put nearly anything in a user name under *NIX but you may encounter odd problems with library code that makes assumptions. Case in point: http://blog.endpoint.com/2008/08/on-valid-unix-usernames-and-ones-sanity.html My question to you: do you have a lot of ...


16

My experience has been that, for a sufficiently large enterprise, any decision you make will always have problems. Even if it works today, there's always the system you implement tomorrow that has problems with the prior standard (length issues, character problems, etc). Be sure to find out if the push for Firstname.Lastname relates to email and not ...


14

dsquery user -name "user name"|dsget user -samid -email -display


14

On Ubuntu, useradd simply creates an entry in the user database (/etc/passwd etc.). adduser on the other hand also creates a home directory for the user, populates it with the content of /etc/skel and lets you set the password interactively.


13

Assuming you have an Active Directory environment: I believe the backslash format DOMAIN\USERNAME will search domain DOMAIN for a user object whose SAM Account Name is USERNAME. The UPN format username@domain will search the forest for a user object whose User Principle Name is username@domain. Now, NORMALLY a user account with a SAM Account Name of ...


13

FreeIPA is probably what you're looking for. It's to Linux what Active Directory is to Windows. (It can also talk to AD if you have a heterogeneous environment, but shouldn't be used to manage Windows machines directly. Use AD for that.) Red Hat's documentation (they call it Identity Management) is very thorough and easy to follow, and should be mostly ...


12

Under Linux, the usermod command changes user names. It modifies the system account files to reflect the changes that are specified on the command line. To change just the username: usermod -l new_username old_username To change the username and home directory name: usermod -l new_username -m -d /new/home/dir old_username You may also want to change ...


11

I may get corrected on this, but there's not really much of a difference. Domain\User is the "old" logon format. Not sure if there's really a concise term for it. SAMAccountName or pre-Windows 2000 logon name doesn't seem to really encapsulate it. User@Domain.com is a UPN - User Principal Name - It's the "preferred," newer logon format. UPNs are discussed ...


11

This has thrown me for a loop in the past as well, as I had read (and experienced) this first hand. The answer is that Microsoft changed the behaviour of store.exe with 2 hotfixes. The 2 hotfixes that modify this behavior is 916783 and 903158. More information on the change can be found : ...


11

There are many ways that would help: remove the complete home directory and copy all files from /etc/skel back to the homedir. Change permissions afterwards. put the system in a virtual machine, make a snapshot and revert to the snapshot after lesson 1 find something like a kiosk mode in RHEL. Ubuntu has something like that, which automatically restores ...


10

Use a .wgetrc file (GNU manual, example) in which you can set username and passwords for either or both ftp and http. To use the same credentials for both specify user=casper password=CasperPassword or individually ftp_user=casperftp ftp_password=casperftppass http_user=casperhttp http_password=casperhttppass


10

It's a limitation of legacy Unix systems, and the NIS directory service in particular. Usually, this restriction is just in place if the organization is trying to keep usernames consistent across all applications (which is generally a good idea).


10

The environment variable SUDO_USER should work as a replacement for USER. Since you are setting the ownership to USER:USER I assume there is always a group with the same name as the user? A more strict solution might otherwise be to use SUDO_UID and SUDO_GID. Two possible solutions would then be: chown "${SUDO_USER}:${SUDO_USER}" dir or chown ...


10

In AD Users and Computers, inspecting the Object tab of the user account, there is a Created field. You would need to select View menu > Advanced to be able to see the Object tab.


10

You're correct, the Power Users group does not do anything at all in Windows Vista and later. From http://technet.microsoft.com/en-us/library/cc771990.aspx: By default, members of this group have no more user rights or permissions than a standard user account. The Power Users group in previous versions of Windows was designed to give users specific ...


10

Q:How can I test that their account is being correctly redirected without logging into it? A: You can't. You'll have to test it with the user present. There's no way to test whether or not GPO, Folder Redirection, Roaming Profiles, etc. actually work correctly for the user without logging in as the user. You could certainly run GP Modeling from the GPMC to ...


9

The data is in the SAM but it doesn't appear to be publicly documented by Microsoft and I'm not finding an official API to retrieve it. I can see, looking at the source code for the chntpw utility that the value is stored in the "F" registry key for each account. Quoth the source code: #define USER_F_PATH "\\SAM\\Domains\\Account\\Users\\%08X\\F" struct ...


9

No. You can't do this. It would be horrible security practice to do anyway since you'd be collecting a very long list of usernames and passwords that your user likely use for other services. What you can do is enforce a minimum password length of 9 characters in Group Policy, which seems like a sensible thing to do, given the problem at hand.


9

Microsoft Baseline Security Analyzer 2.2 - Run, "Check for weak passwords", Start Scan...


8

Using Puppet virtual resources is the right way to do it - but if you can't change the user definitions and need a workaround fix meanwhile, the following is horrible and hacky, but will work: exec {"foo somegroup membership": unless => "grep -q 'somegroup\\S*foo' /etc/group", command => "usermod -aG somegroup foo", require => User['foo'], } ...


8

Sounds like you want the Account Lockout tools http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=18465 Allows you to run a query against a domain controller's security logs to search for particular users - for example, to show where the failure audits are coming from.


8

Your question is not stated very clearly... howewer, here's how it basically works: Each process running on a Windows machine runs in the context of a user account; this can be one of the three machine accounts (more on this later), a local user account or a domain user account. A process can be started either by a logged on user, or as a service. A ...



Only top voted, non community-wiki answers of a minimum length are eligible