Questions tagged [authorization]
Questions about either authorization policy (who should be given access to what) or mechanisms (how to enforce the policy, how to grant or deny access).
66
questions
0
votes
1
answer
63
views
How does kpasswd change password?
When you change password via kpasswd, does it change your password that is stored on the Kerberos server, or does it change your password that is stored in the OpenLDAP server?
- 137
0
votes
0
answers
23
views
Connect to the same $HOME directory with two different users and same authorized_key
I would like to accomplish the following thing:
I have two users and I want both users to connect to the same $HOME directory. In this $HOME directory there is also the .ssh/authorized_keys file ...
- 101
1
vote
0
answers
36
views
Implementation of groups in the linux kernel
Question:
Are there any further sources to catch up on the implementation of groups in the linux kernel.
The man page about credentials helped me out so far, but I like to delve deeper (though still ...
- 347
0
votes
0
answers
61
views
Using OpenBSD /usr/libexec/auth/login_* from command line or other program
This may be an x-y problem and please feel free to point me in other directions as well.
I'm trying to write a login mechanism to dovecot's passdb, using either a Lua plugin or a CheckPassword program....
- 768
0
votes
1
answer
107
views
client-certificate authentication for SSH
My servers are incessantly being brute-force attacked on my SSH port.
I am using non-standard SSH port, firewall blacklist for port-scanners, and I am also using custom fail2ban-like script to ban ...
- 483
0
votes
1
answer
542
views
how to enable access to files on the linux server via URL with password protection
I have a Linux centos 7 server. On that server, I started one script which should save images into one folder /images and inside the CSV file.
Is there any chance that I can make CSV file and folder ...
- 3
0
votes
1
answer
125
views
ssh authorization from id only, without authentication credentials
Numerous sources provide instructions for key-based authentication to an SSH server, rather than password based.
In some isolated environments, it is preferable for a server to authorize a user ...
- 330
0
votes
1
answer
34
views
Authorize and Unauthorize by adding and remove user to a group
I want to authorize (or unauthorise) by adding (or removing) user to a group. Is it possible to have the changes be effective immediately without having to reboot?
I just want to give one time access ...
- 1,792
0
votes
1
answer
253
views
Why do the following netstat, ps, and auth.log have such output?
I seem to be getting a lot of different connections (ssh) on this Ubuntu server I am sshed into. Are these just brute force attempts?
When running netstat -tnpa | grep 'ESTABLISHED.*sshd' why do I get ...
- 3
1
vote
1
answer
210
views
Fallback for authorized_keys
I'm working on a piece of automation that generates a list of allowed public keys and overwrites a server's user ~./ssh/authorized_keys. Is there a way to prevent a mistake in the automation to ...
- 113
0
votes
0
answers
44
views
How to limit user to only cat & exit commands? [duplicate]
I would like to limit a user to only two commands: cat and exit.
I've tried to edit visudo but it does not work.
My OS version is CentOS 8.
- 11
1
vote
0
answers
173
views
How to generate a self signed certificate from openssl having the SPIFFE URI
I have a requirement of generating a SPIFFY Cert from the openssl similar to this here Local SSL Certificates in Chrom(e/ium) 63 can any one suggest on what need to be added to generate the spiffe uri ...
- 21
3
votes
2
answers
710
views
Does the root user bypass capability checking?
Does the root user bypass capability checking in the kernel, or is the root user subject to capability checking starting with Linux 2.2?
May applications check for and deny access for the root user, ...
- 4,203
3
votes
0
answers
706
views
linux mint very slow boot and authorization
I installed linux Mint. But it's booting too slow (20-30 seconds). Even during authorization it takes 3-5 seconds. Windows, for example, loaded for 5 seconds max. (I have an SSD and mint was also ...
- 153
0
votes
1
answer
820
views
How to prevent my additions to authorized keys from being overwritten by puppet?
At my company all employees are given a private key, which get's renewed each year, that they should use to connect to VMs. The SA here have a puppet script which will look up my public key and save ...
- 794
-1
votes
1
answer
373
views
how to enable root ssh public key login with no root account and sshpass and sudo?
I have created an azure vm server which is ubuntu 1804 and I need to enable root ssh public key login with it. Azure do not want me to enable root ssh public key login when the server is created, so I ...
- 115
16
votes
3
answers
17k
views
Is it possible to have 2 ports open on SSH with 2 different authentication schemes?
I'm currently trying to set up an SSH server so that access to it from outside the network is ONLY allowed using an SSH Key and does not allow access to root or by any other username/password ...
- 471
3
votes
2
answers
175
views
If I change a user's username and password on a server, should I still be able to remotely SSH in as this user without any other changes? [closed]
My work has set up an Ubuntu server for my team to host a project on. They set up a sudo user for me with my name as the username, and a default password. I was able to SSH into the server using these ...
- 253
3
votes
2
answers
515
views
sudo escalation password fails - /etc/shadow hash ok, group ok, /etc/sudoers ok
After system update/upgrade, I cannot escalate with sudo using correct password:
user $ sudo -s
[sudo] password for user: ********************
Sorry, try again.
[sudo] password for user: *************...
- 644
2
votes
0
answers
2k
views
whoami returns user, but usermod complains it doesn't exist
I have Linux (Ubuntu) on a VM provided by corporate IT in my organization,
and I have a user "myuser".
whoami is able to return the username:
myuser@host:/home/myuser$ whoami
myuser
id returns info ...
- 21
0
votes
1
answer
437
views
How to deny access from just one host in a domain
In apache 2.4.6, I would like to deny access to an entire domain, except for one (or maybe more) specific hosts (and the rest of the world). sort of like:
Require not host xxx.com ## nobody from ...
- 21
3
votes
2
answers
263
views
Why do I have to use "sudo" when I am in the super user group?
[martin@A08-R32-I196-2-FZ1RLP2 anaconda3]$ groups martin
martin : martin wheel
I am under my own home directory:
[martin@A08-R32-I196-2-FZ1RLP2 anaconda3]$ pwd
/home/martin/anaconda3
But when I ...
- 129
0
votes
2
answers
154
views
How do I activate time based admin login to a Linux system using windows active directory?
I have set up a solution where the login to our linux systems is regulated by microsoft active Directory and group memberships. Now i want the access time based so that the ad user will be kicked out ...
- 1
2
votes
2
answers
561
views
block scripted sudo
I don't like typing the password for sudo so I disabled it with
%sudo ALL=(ALL) NOPASSWD: ALL
Now I have a bad side effect that any shell script I run can silently execute sudo on my behalf.
The ...
- 245
6
votes
1
answer
18k
views
Trying to run "service nginx restart" from a non root user
I'm pretty new to the deployment world but this is what's going on. I have a new Ubuntu (Ubuntu 16.04.4 LTS) droplet from DigitalOcean. I installed and configured nginx and everything is working ...
- 163
1
vote
1
answer
7k
views
Restrict access to subdirectory in Apache
I've a very easy question. However I have been digging all the manuals for an answer for a full day already.
What I want is to configure Apache to give anyone read access to /var/www but restrict /...
- 168
0
votes
1
answer
98
views
samba share mount owner is colord
My hair is falling out already on the account of samba share issues.
I have an ext4 samba share on a raspberry pi, with a mask 0777 specified.
Only myuser on raspberry can authenticate via samba.
...
- 133
2
votes
2
answers
137
views
Multiple ssh access types from a given user1/client to the same user2/server
I want to access from one user/client combination (say, user1@cl) to a user/server combination (say, user2@srv) via ssh, with two different types of Access:
Access type #1 would be restricted to ...
3
votes
0
answers
2k
views
Show a web page, once connected to an open wifi hotspot
I'm trying to create a wifi hotspot without encryption on my Raspberry Pi 3, by using Hostapd.
How can I show a window with my own web page every time someone connects to it?
I think the closest ...
- 199
8
votes
2
answers
56k
views
Where are NFS v4 logs under systemd?
My error is:
mount.nfs4: access denied by server while mounting fileserver:/export/path/one
My question is:
where would the detailed log information be on the server (under systemd)?
More ...
- 17.5k
0
votes
1
answer
2k
views
Add public key to remote server authorized keys without saving file there
I'm trying to write a script to place my public key into the authorized_keys of a remote host, but I'm not sure how to do it without copying the file to the remote host or overwriting the ...
- 677
3
votes
0
answers
1k
views
Apache group authorization with mod_lookup_identity
I need to have some users authenticated against an Active Directory database, and I'd like to use mod_authnz_pam over mod_authnz_ldap for that. The users will have access to certains folders, ...
5
votes
2
answers
27k
views
SCP command keeps asking password
I've been struggling for days with this now and can't find what I'm doing wrong.
I've got a website on a VPS server. Every night I make a backup of the database. It gets stored on my VPS server. I ...
- 153
8
votes
2
answers
4k
views
Explanation of file - org.freedesktop.login1.policy
I am using Ubuntu 16.04.
There is a file located at /usr/share/polkit-1/actions/org.freedesktop.login1.policy which seems to control the permissions regarding shutdown/suspend/hibernate options.
...
1
vote
1
answer
110
views
Root password is asked for anything after dist-upgrade [closed]
I'm using Debian Stretch and today I did apt-get upgrade && apt-get dist-upgrade. After that, nearly every action is started to ask root password, including external monitor plug/unplug, USB ...
- 2,271
4
votes
3
answers
13k
views
How can I keep rsync from using encryption and compression for the file transfers after the connection is authorized?
I understand that a secure connection (i.e. ssh) is needed to authorize a connection to the remote server. But after that is authorized can the data be transmitted without encryption and compression ...
- 7,371
5
votes
1
answer
2k
views
Debian stretch asks for root password in order to mount usb disks after upgrade
After apt-get upgrade && apt-get dist-upgrade, Debian Stretch started to ask for root password for external usb disks.
Creating a /etc/polkit-1/localauthority/50-local.d/55-usb-mount.pkla ...
- 2,271
4
votes
1
answer
7k
views
What is the default password on ubuntu for users created with useradd?
In order to install a service on Ubuntu 14.04 like "openemm" I have created a user name and group:
sudo sudo useradd openemm -m -G openemm -d /home/openemm
Now I want to login with that username
su ...
- 159
2
votes
2
answers
6k
views
'+' and 's' in permission strings
If the ls -l command gives me a permission string like
rwsr-s--x
What does the 's' mean? The only sources I found mention that it can be present sometimes but do not elaborate.
What does a '+' ...
- 31
1
vote
1
answer
2k
views
Set a password on Damn Small Linux
I'm running Damn Small Linux. When you open the command prompt, you are automatically logged in as the default user called dsl and granted root privileges (with sudo). How can I set a password for the ...
- 23
17
votes
1
answer
15k
views
D-Bus authentication and authorization
I'm trying to set up remote access to D-Bus, and I don't understand how authentication and authorization are (not) working.
I have a D-Bus server listening on an abstract socket.
$ echo $...
11
votes
3
answers
71k
views
What is difference between pbrun and sudo command?
What is difference between pbrun and sudo command?
I have seen people executing pbrun sudo su - what this means?
I know su -, it will try to switch to root user.
What speciality pbrun gives to sudo ...
- 2,482
1
vote
2
answers
7k
views
curl authentication works but I cannot reach other pages
I'm trying to use cURL to automate some processes that we usually do using a website.
I was able to login to the website using curl and the following command:
curl -k -v -i --user "[user]:[password]"...
- 11
1
vote
1
answer
961
views
Server Authorization directory incorrect ownership during linux mint installation
When installing linux mint 17.1 from a bootable usb onto a hard drive I get the following message:
'Server Authorization directory (daemon/servAuthDir) is set to /var/lib/mdm but is not owned by ...
- 11
0
votes
1
answer
854
views
Authconfig doesn't find all ldap groups
My (soon to be) admin account is in two groups:
# ldapsearch \
> -v \
> -H ldaps://localhost:636 \
> -D "${l_dirmgr}" \
> -w $(cat ${f_dirmgr_passphrase}) \
> -b "ou=groups,${l_basedn}...
- 1,458
7
votes
1
answer
3k
views
Apache Authorization for the Allowed Users?
I have read the answer to this question:
https://stackoverflow.com/questions/4102763/apache-basic-authentication-except-for-those-allowed
It helped me understand how to not authenticate some users (...
- 8,926
1
vote
2
answers
2k
views
Shell Script - how to scp into remote server and download files and protect password
I have a remote server that I need to download Apache logs from.
I can manually scp into the server and get the files, but I'd like to put this in crontab. The only way to automate it is to include ...
- 341
2
votes
1
answer
1k
views
Creating a linux user with limited privileges for ssh tunnelling
I am following this post to create ssh tunnel to mysql. The details description of my application scenario is given in my other SOQ.
I exactly followed these steps to create a user:
useradd -s /bin/...
- 319
5
votes
0
answers
2k
views
Is there an alternative to OpenLDAP / Kerberos? [closed]
Are there ways to do centralized secure network-based authentication & authorization and user management that aren't OpenLDAP and Kerberos?
Frankly, Kerberos is a nightmare to configure, leaving ...
- 917
2
votes
1
answer
2k
views
Why is bluetooth-agent getting stuck on authorizing?
I am trying to manually connect between my laptop and phone. I have bluez-utils version 4.98-2ubuntu7 installed. When I run the agent on the terminal, I get:
asheesh@U32U:~$ sudo bluetooth-agent 4835
...
- 1,917