473183469
  • Member for 6 years, 2 months
  • Last seen this week
ldap_modify: Insufficient access (50) when changing password
Accepted answer
7 votes

In order to admin the 'cn=config' database you need the 'cn=config' admin, not the admin of the data DB. In debian such admin is root with SASL TLS External. Try sudo ldapsearch -H ldapi:/// -Y ...

View answer
How to get SASL authentication to work with DIGEST-MD5 for OpenLDAP?
Accepted answer
5 votes

My recipe is for OpenLDAP to check directly /etc/sasldb2. First step: ensure the /etc/sasldb2 is owned by slapd user. Next step: have slapd not to look for credentials in directory tree, which is ...

View answer
Where is systemd script for mysql.service located?
5 votes

The default location for systemd init script is: /lib/systemd/system But the preferred way to modify them is to create a custom script in: /etc/systemd/system scripts in the latter folder override ...

View answer
sssd and ldap authentication cache
5 votes

From the man page (sssd.conf): NSS configuration options These options can be used to configure the Name Service Switch (NSS) service. enum_cache_timeout (integer) ...

View answer
HTTPS server certificate fails
Accepted answer
2 votes

I would give a try to an online tool like: ssllabs ssltest. Another similar tool can be found on Digicert home page.

View answer
OpenLDAP ACL stored as hash?
Accepted answer
2 votes

Please try: echo "your_hash" | openssl enc -d -base64 you will see what is inside the hash. You can confirm what @Sven said (a trailing space at the end of the line, very likely).

View answer
SSSD & LDAP authentication
2 votes

ldap_id_use_start_tls = true is definitely wrong. In order to crypt your network traffic to LDAP you have to choices: Older SSL on port 636 Newer StartTLS on port 389 (connection starts in plain ...

View answer
LDAP and privacy
1 votes

If you use sssd as the middleware tool to fetch users from LDAP and turn them to Unix users, default configuration doesn't allow users to fetch all the users' list. On the other hand, as Sven wrote, ...

View answer
ldapmodify can't contact LDAP server for cn=config
1 votes

The slapi connection to LDAP is based on the presence of a pipe file on the filesystem to bind client and server toghether. Of course the location of the pipe file is installation-dependent. If the ...

View answer
Password expires 45 days even though 'Password Must Change' is set to 'never' (Samba+LDAP)
1 votes

In my opinion it has to do with a default setup of samba. Even if you overrode on the single users'record, still a general default is enforcing the max age. Would you please explore the sudo ./bin/...

View answer
Internal Server Error 500 Apache 2.4 with LDAP authentication on CentOs 7
1 votes

Can you try the following three changes? SSLRequireSSL removed valid-user changed to ldap-user START_TLS re-enforced (see AuthLDAPURL) , require # the following two directives have to be OUTSIDE ...

View answer
How to migrate Samba User Accounts to a new linux server?
1 votes

passdb backend = tdbsam means you have your samba accounts in a passdb.tdb file in SAMBA_DIR/private. As long as you copy it with rsync you are fine. There are two caveats: Unix users: a samba ...

View answer
ldap_add: Invalid DN syntax (34)
1 votes

Missing automount schema: you need to import beforehand rfc2307bis.schema which defines automountMapName attribute.

View answer
Parsing log4j log files with logstash
1 votes

Do you really need the multiline? Isn't multiline used to join together again a single log which has been splitted by rsyslog? The typical example is the java stack error trace message. If rsyslog ...

View answer
Disable https for a single file in apache
Accepted answer
1 votes

On your default vhost, try the following: RewriteEngine on RewriteCond %{HTTPS} !=on RewriteCond %{REQUEST_URI} !^/path/to/your_single_file.html$ RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI}...

View answer
Splunk SAML SSO from an IdP with Apache mod_mellon fails
1 votes

Stage a debug web page with the following: <?php header('Content-Type: text/plain'); foreach($_SERVER as $key=>$value) { if(substr($key, 0, 7) == 'MELLON_') { echo($key . '=' . $value . "...

View answer
How do I find the cause of http to https redirect loop?
1 votes

The reported configurations are fine. Is it possible other virtual host definitions are hiding? Would you like to make sure with: sudo apache2ctl -t -DDUMP_VHOSTS then? A sane output is: ...

View answer
Weird used/free space view of network drives with Samba and XFS
1 votes

It is possible to have quota information on xfs with samba, but you need to have the xfs quota libraries installed when you compile samba.

View answer
SSSD for LDAP user authentication only (just bind) on Ubuntu, local databases for uid and groups
1 votes

The file which controls which datasource contact for each search is nsswitch.conf. You need something as: passwd: compat group: compat shadow: compat sss passwd means users ...

View answer
ldap_add: Other (e.g., implementation specific) error (80) when adding pw-sha2.la module
Accepted answer
1 votes

I am quite confident the following will be inserted without errors: dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/local/libexec/openldap/ olcModuleLoad: pw-...

View answer
Passwords not working after migration from /etc/shadow to LDAP
1 votes

No, the correct tag for SHA-512 is {SHA-512} but you have to enable a module and to apply an overlay to your data database. Why not simply generating user passwords with: sudo ldappasswd -H ldapi:///...

View answer
Using Shibboleth with ADFS doesn't work
Accepted answer
1 votes

There are really too many questions here! I would like to address the first one: generate the shibboleth SP metadata. You can use the tool: shib_metagen (in Debian it is in the shibboleth-sp2-...

View answer
Active Directory Multi Site. Choose nearest DCs into Linux/Not-Microsoft applications
1 votes

Do the unix servers have knowledge of the site they are in? Does the AD controller has correctly updated the SRV DNS records (it does by default)? If the unix server is aware to be, for example, in ...

View answer
Master is Dead - Promote LDAP Slave to Master
1 votes

It could be as easy as deleting whole syncrepl section on one slave, than modify provider setting on the other slave to point to the first one. As I understand, the syncrepl bind user, cn=sssd,dc=...

View answer
apache - Is hosting same website on different ports possible?
Accepted answer
1 votes

Redirection from http to https indeed works with apache and mod_rewrite: <VirtualHost *:80> DocumentRoot /var/www RewriteEngine On RewriteCond %{HTTPS} !on RewriteRule ^/(.*) https://...

View answer
Openldap - ldap user can't add entry: Insufficient access (no write access to parent)
1 votes

From OpenLDAP ACL documentation: To add or delete an entry, the subject must have write access to the entry's entry attribute AND must have write access to the entry's parent's children attribute. ...

View answer
PAM - LDAP authentication interaction
1 votes

Just to name one, what about posixAccount objectClass? In OpenLDAP is included in the nis schema file: olcObjectClasses: {0}( 1.3.6.1.1.1.2.0 NAME 'posixAccount' DESC 'Abstraction o f an account ...

View answer
How to configure Tomcat WebApp to accept credentials from Apache
1 votes

It's not possible to mix Tomcat role base authorization with authentication done in Apache. Either you do all in tomcat (authentication and authorization) or -- a lot more sensible -- stage ...

View answer
Emails are bounced with 'user unknown' when using LDAP in Postfix virtual config
1 votes

pass_attrs = mail=user,userPassword=password is probably wrong. It means "use mail as username ldap attribute name and userPassword as password attribute name". I believe it should read: pass_attrs ...

View answer
Moving from LDAP to LDAPS - Ubuntu 14.04 Winbind, Samba
0 votes

Give a try to the smb.conf settings: ldap ssl = start tls ldap ssl ads = yes unfortunately I never tried them myself. I think you would not need to explicitely enforce encryption for winbindd. If ...

View answer