New answers tagged ldap
1
vote
ldap_group_search_base is not working as intented
You are not filtering for that group, so every user is allowed.
You can add a filter like this:
ldap_access_filter = memberOf=cn=authorized,ou=rona,ou=servers,ou=groups,dc=yolo,dc=com
Check if ...
- 22.5k
0
votes
Lock user account in LDAP (without using ppolicy)
The proper way to handle this is two-fold:
make sure all services do authentication and a separate authorization check
SSH can bypass the login-shell and LDAP password authorization (by specifying a ...
- 544
0
votes
What are all the certificates mandatory to be provide while setting TLSVerifyClient option to demand
By setting TLSVerifyClient to anything different than never you allow mutual TLS.
As implied already in the name: mutual SSL/TLS requires that both client and server authenticate themselves with ...
- 75k
0
votes
Accepted
Debian 11 + ProFTPd and LDAPS
I couldn't find a way to make LDAP over SSL working but I managed to get LDAP over TLS working.
Not what I was looking for but better than unsecure connection!
<IfModule mod_ldap.c>
...
- 33
1
vote
LDAP replication to server with Let's Encrypt certificate fails, "unable to get issuer certificate"
the error message indicates:
unable to get issuer certificate
which points to a PKI trust issue for the LDAP service and possibly the system.
I would add and trust all the issuers in the chain of ...
- 11
0
votes
Setup SSO : openldap, kerberos, nfs(truenas) :
a) Use sec=ldap , root_squash in nfs export. Setup ldap_pam auth in nfs server also. Does this approach provide any extra security ? As I understand, nfs_client provides nfs_server with uid/gid (which ...
- 9,703
0
votes
Which attributes does Active Directory currently use for POSIX compatibility?
uid is also often used for dual mode access to file systems (Windows/Linux). uid is unusual in that it is a multivalue attribute.
- 101
1
vote
Strange hash lengths in OpenLDAP
Some more research yielded the correct answer:
The password hashes are stored in binary format, not ASCII, doubly base64-encoded. Checking the length in that case leaves us with 24 and 28 bytes, which ...
- 11
0
votes
pam_unix(sshd:auth): authentication failure because of encrypted password from PAM stack
What you're seeing here isn't an encrypted password, it's from sshd, specifically:
const char junk[] = "\b\n\r\177INCORRECT";
Before sshd tries to authenticate with PAM, it calls getpwnam() ...
0
votes
Unable to bind to server: Can't contact LDAP server
I was getting an error like this on Red Hat Server due to selinux.
Running this on the server fixed the issue:
setsebool -P httpd_can_connect_ldap on
- 127
Top 50 recent answers are included