Tag Info

Hot answers tagged

48

This is a chronic problem with large Identity Management systems attempting to glue together heterogeneous systems. Invariably, you'll be limited to the lowest common denominator, which all too often is an 8-character ASCII-alpha-numeric limit thanks to some (probably legacy) Unix-like system somewhere in the bowels of the datacenter. Those fancy modern ...


35

One central component of Active Directory is LDAP, which is available on Linux in the form of OpenLDAP and 389DS (and some others). Also, the other major component Kerberos is available in the form of MIT Kerberos and Heimdal. Finally, you can even connect your machines to AD.


29

oldserver$ mysqldump mysql > mysql.sql newserver$ mysql mysql < mysql.sql newserver$ mysql 'flush privileges;' Should do it, remember to add -u $USER and -p$PASSWORD as required


29

In the case of Debian and its related distros, adduser is a friendlier interactive frontend to useradd.


28

Open up "Control Panel | System and Security | System" In the dialog click on "Advanced system settings" (requires Admin rights) The "System Properties" dialog will be displayed Make sure you are in the "Advanced" register In the "User Profiles" section click on "Settings" The "User Profiles" dialog is displayed Select the account. Hit Delete. Faster: ...


23

You can try with puppet for managing user: Why Use Puppet to Manage User Accounts? (and not NIS, LDAP, etc) One of the benefits to managing user accounts in puppet is the fact that it is decentralized. Each user account is just a normal user account on the managed server. There is nothing special about the user accounts puppet creates other ...


21

Your questions specifically: What is the best username length limit to use to maintain compatibility across all uses? There's no such thing. There's only "your" uses, which may include your future uses. We have no idea what those are. What characters should be avoided? This will depend on what computer systems you're dealing with. Windows, for ...


19

The one place I can see it being justified is on service accounts. Typically you don't want a service account password to simply expire which could cause all the processes that account runs to fail. Interactive user accounts should always have passwords follow the password policy. You have to make sure if you do set service accounts to not expire that you ...


18

I'm at a Tier 1 PCI vendor. We have something like this in place, with a few differences. The auditors are actually attempting to describe a very real problem, but doing an incredibly poor job explaining the implications and needs analysis. It is now more effective to compromise a system by using a hash of a password or an existing token. Put plainly, ...


17

Assuming you have an Active Directory environment: I believe the backslash format DOMAIN\USERNAME will search domain DOMAIN for a user object whose SAM Account Name is USERNAME. The UPN format username@domain will search the forest for a user object whose User Principle Name is username@domain. Now, NORMALLY a user account with a SAM Account Name of ...


16

My experience has been that, for a sufficiently large enterprise, any decision you make will always have problems. Even if it works today, there's always the system you implement tomorrow that has problems with the prior standard (length issues, character problems, etc). Be sure to find out if the push for Firstname.Lastname relates to email and not ...


16

My advice to you is to follow the standard recommended by the default NAME_REGEX. You can actually put nearly anything in a user name under *NIX but you may encounter odd problems with library code that makes assumptions. Case in point: http://blog.endpoint.com/2008/08/on-valid-unix-usernames-and-ones-sanity.html My question to you: do you have a lot of ...


14

dsquery user -name "user name"|dsget user -samid -email -display


14

On Ubuntu, useradd simply creates an entry in the user database (/etc/passwd etc.). adduser on the other hand also creates a home directory for the user, populates it with the content of /etc/skel and lets you set the password interactively.


14

FreeIPA is probably what you're looking for. It's to Linux what Active Directory is to Windows. (It can also talk to AD if you have a heterogeneous environment, but shouldn't be used to manage Windows machines directly. Use AD for that.) Red Hat's documentation (they call it Identity Management) is very thorough and easy to follow, and should be mostly ...


13

Under Linux, the usermod command changes user names. It modifies the system account files to reflect the changes that are specified on the command line. To change just the username: usermod -l new_username old_username To change the username and home directory name: usermod -l new_username -m -d /new/home/dir old_username You may also want to change ...


12

In AD Users and Computers, inspecting the Object tab of the user account, there is a Created field. You would need to select View menu > Advanced to be able to see the Object tab.


12

I may get corrected on this, but there's not really much of a difference. Domain\User is the "old" logon format. Not sure if there's really a concise term for it. SAMAccountName or pre-Windows 2000 logon name doesn't seem to really encapsulate it. User@Domain.com is a UPN - User Principal Name - It's the "preferred," newer logon format. UPNs are discussed ...


12

It's a limitation of legacy Unix systems, and the NIS directory service in particular. Usually, this restriction is just in place if the organization is trying to keep usernames consistent across all applications (which is generally a good idea).


12

Whilst a dump of the mysql database would probably work, in my experience, properly documenting all the access and setting it up again with GRANT statements is much better. There are two benefits to doing it this way: You will understand your database security and how it is implemented. You will get to remove access that is no longer required.


12

I would take a look at the Percona Toolkit. The description of the pt-show-grants tool says it all... pt-show-grants extracts, orders, and then prints grants for MySQL user accounts. Why would you want this? There are several reasons. The first is to easily replicate users from one server to another; you can simply extract the grants ...


11

This has thrown me for a loop in the past as well, as I had read (and experienced) this first hand. The answer is that Microsoft changed the behaviour of store.exe with 2 hotfixes. The 2 hotfixes that modify this behavior is 916783 and 903158. More information on the change can be found : ...


11

There are many ways that would help: remove the complete home directory and copy all files from /etc/skel back to the homedir. Change permissions afterwards. put the system in a virtual machine, make a snapshot and revert to the snapshot after lesson 1 find something like a kiosk mode in RHEL. Ubuntu has something like that, which automatically restores ...


10

Use a .wgetrc file (GNU manual, example) in which you can set username and passwords for either or both ftp and http. To use the same credentials for both specify user=casper password=CasperPassword or individually ftp_user=casperftp ftp_password=casperftppass http_user=casperhttp http_password=casperhttppass


10

The environment variable SUDO_USER should work as a replacement for USER. Since you are setting the ownership to USER:USER I assume there is always a group with the same name as the user? A more strict solution might otherwise be to use SUDO_UID and SUDO_GID. Two possible solutions would then be: chown "${SUDO_USER}:${SUDO_USER}" dir or chown ...


10

Using Puppet virtual resources is the right way to do it - but if you can't change the user definitions and need a workaround fix meanwhile, the following is horrible and hacky, but will work: exec {"foo somegroup membership": unless => "grep -q 'somegroup\\S*foo' /etc/group", command => "usermod -aG somegroup foo", require => User['foo'], } ...


10

You're correct, the Power Users group does not do anything at all in Windows Vista and later. From http://technet.microsoft.com/en-us/library/cc771990.aspx: By default, members of this group have no more user rights or permissions than a standard user account. The Power Users group in previous versions of Windows was designed to give users specific ...


10

Use the query user command Query User Command http://technet.microsoft.com/en-us/library/bb490801.aspx


10

Q:How can I test that their account is being correctly redirected without logging into it? A: You can't. You'll have to test it with the user present. There's no way to test whether or not GPO, Folder Redirection, Roaming Profiles, etc. actually work correctly for the user without logging in as the user. You could certainly run GP Modeling from the GPMC to ...


9

The data is in the SAM but it doesn't appear to be publicly documented by Microsoft and I'm not finding an official API to retrieve it. I can see, looking at the source code for the chntpw utility that the value is stored in the "F" registry key for each account. Quoth the source code: #define USER_F_PATH "\\SAM\\Domains\\Account\\Users\\%08X\\F" struct ...



Only top voted, non community-wiki answers of a minimum length are eligible