search for: princpal

...ssh/TrustedUserCAKeys Match User www AuthorizedKeysFile /etc/ssh/empty AuthorizedPrincipalsFile /etc/ssh/www_authorizedPrincipals <snip> $ cat /etc/ssh/www_authorized_principals alice bob and alice and bob just have regular user certificates with 'alice' or 'bob' in the princpals

...10/10/18 19:15, Reinaldo Souza Gomes wrote: > This issue right here told me exactly what I needed to understand this > authentication process: > https://pagure.io/SSSD/sssd/issue/3228 > > > - The client talks to the DC to try and get a cifs ticket for my samba > server's princpal name; > - In case the client can't get the ticket for any reason, it falls > back to NTLM <- windows client decision, nothing can be done about it > by Samba/SSSD; > > Once I realized this, I investigated the windows machines which > couldn't access my Samba server,...

This issue right here told me exactly what I needed to understand this authentication process:https://pagure.io/SSSD/sssd/issue/3228 - The client talks to the DC to try and get a cifs ticket for my samba server's princpal name;- In case the client can't get the ticket for any reason, it falls back to NTLM <- windows client decision, nothing can be done about it by Samba/SSSD; Once I realized this, I investigated the windows machines which couldn't access my Samba server, and I found out that they were aut...

The domain controler is Windows. The file Server is Linux/Samba. The clients are Windows. I've tested the access on a dozen different windows machines. Three of them used NTLM and failed. All the others used kerberos and succeeded. They're all in the same network, same domain. Maybe it's the windows version? But they're all Window 8 or 10, not a great deal of a difference between

Hello, I am trying to work out the best way to issue SSH certificates in such way that they only allow access to specific usernames *and* only to specific groups of host. As a concrete example: I want Alice to be able to login as "alice" and "www" to machines in group "webserver" (only). Also, I want Bob to be able to login as "bob" and

...10/10/18 19:15, Reinaldo Souza Gomes wrote: > This issue right here told me exactly what I needed to understand this > authentication process: > https://pagure.io/SSSD/sssd/issue/3228 > > > - The client talks to the DC to try and get a cifs ticket for my samba > server's princpal name; > - In case the client can't get the ticket for any reason, it falls > back to NTLM <- windows client decision, nothing can be done about it > by Samba/SSSD; > > Once I realized this, I investigated the windows machines which > couldn't access my Samba server,...

...omes wrote: > > This issue right here told me exactly what I needed to understand this > > authentication process: > > https://pagure.io/SSSD/sssd/issue/3228 > > > > > > - The client talks to the DC to try and get a cifs ticket for my samba > > server's princpal name; > > - In case the client can't get the ticket for any reason, it falls > > back to NTLM <- windows client decision, nothing can be done about it > > by Samba/SSSD; > > > > Once I realized this, I investigated the windows machines which > > couldn'...