@ScottPack I heard the others using context such as "I did a glassdoor and it wasn't good" which had me thinking there was some new method of sneaking by an office and trying to peep in the windows or something.
@Tanner Can you break down precisely what steps you're going through to install/share this printer? Your description's kind of vague, so It's hard to tell where you're going wrong.
@Jacob I hated highschool with a passion, but uni/tertiary education is awesome. You do about 10 hours a week of real work and just fuck around thed rest of the time
@Jacob Having no friends at highschool sucks. But you also need to remember that highschool students suck and are generally the worst people on the planet, next to war criminals and people who use OSX in corporate environments
I literally get home, and try to work on stuff until 11 or so, and I get poor marks because I can get 100s all day long on assessments, but HW is over-weighted.
@MattBear He had to get a GED to start working and college, and he was never happy with it.
@MDMarra Not only the fee, I bet it will take them 7 days plus while they keep the money in a holding acct. My business account transfers much faster than personal ever did.
@MarkHenderson It does? Because I was gonna say that I long for the time when a "whole day's work" was 6 hours of napping in class and not having any bills or responsibilities beyond waking up for the occasional test.
@Jacob if you'd like a word of advice about school from someone that coasted through HS and then fucked around in college, dropped out and then finished 5 years later at nights: just do the boring shit like homework and do it right the first time. If you think it's menial now, imagine how it'll feel when you're 26 in a class with 18 year olds doing group work
@MarkHenderson For the record, OSX makes for a fantastic desktop. I get a linuxy backend without having to deal with cygwin garbage, I get real Office, a VDI client, all with a pretty interface that's fucking stable.
@MDMarra I found out about a security consulting firm nearby that I had never heard of. Their website wasn't overly helpful so I wanted to see if anything else could be said of them.
@MarkHenderson I think that learning to deal with those people is one of the best things someone can take with them after graduation. Before I graduated I imagined a perfect world, no drama. Now I face worse - Adult drama, and middle age people that act like higschool students.
@mossy The students I went to highschool with represent the cesspit of society that I do everything i can to avoid, and thus don't have to, nor wish to, deal with
@MDMarra I did have a bit of a crankfest today. I was trying to authorize our new student to access the internal wiki and kept failing miserably at setting up mod_ldap. Turns out throwing ?uid to the end of your ldap search path is only good if their user object has a uid. I had to change that shit to sAMAccountname
@jscott Only those users who actually get shell logins to unix systems have the unix attributes populated. Which works out great since she's the first user in the security office who hasn't had those attributes.
@MDMarra Also, sAMAccountname is indexed. Unlike cn or uid.
@Jacob if you're in charge, you have to rely on people that are probably less talented than you are. If you're not in charge you have to deal with following people that you'll probably feel that you're smarter than. Managing those two situations to an acceptable result is how you get to a Sr or Engineering role instead of toiling away with no promotions ever
@MDMarra I didn't say they were +- intelligent, I said they didn't want to do the work. However I will agree I have a issue I need to fix with working with people that might be less intelligent than me.
@MDMarra If we did pam_ldap that would definitely happen. If you'll recall we have 250-300k user objects in People. Instead we do pam_krb for auth and local accounts for authz.
So what's so fubar in pam_ldap? I've not used it, but I've done simply stupid ldap queries (granted only ~18K objects) in Linux, and the worst just took a long time to return.
Is it just iterating a shit load of un-index attributes?
@jscott The time is the problem. If you are attempting to search on, or load in, un-indexed fields then the ldap query takes longer than the pam timeout.
My understanding is that without indexing or a narrow search base, it enumerates the whole directory every time any logon happens. Even non-interactive
Mark's assessment is correct. In order to set up pure ldap with pam you have to be very explicit with your base DN, your search path, exactly which fields, etc, etc.
Let's say you set this up in your search ldaps://dc1.domain.com/
That will completely enumerate every object in the directory until it matches the one you're filtering on (typically cn or uid)
So you get a little smarter and do this, ldaps://dc1.domain.com/ou=People,dc=domain,dc=com?sAMAccountName
That will recursively enumerate the sAMAccountName attribute of every object under the People container until it finds one that matches.
You're not having to list every single goddamn attribute of every object, but if you're storing your user objects all in that OU? Fuck me that's still a lot.
I have been told by a non-authoritative source (but one that I generally trust) that current "Best Practices" is to construct OUs in such a way that they map to your org chart and have the user objects live in within the leaf OU that matches their position in the organization. Does that make sense and/or correct, Mark?
@jscott The indexing is all done at the AD side, and is a black box as far as I'm concerned. All I know is that the AD people tell "This attribute is indexed, this one isn't." and that searching based on non-indexed fields is non-optimal.
@jscott In that case the failure isn't so much pam, since it's just doing the query and waiting for the result, but on the filter author for searching on a non-indexed field.
@MDMarra Ours is much more hierarchical than that, but all user objects that map back to real people exist within People and any type of departmental or person type classification is handled with group membership. User objects that are service accounts are stored elsewhere.
I got to watch debugging of a student who couldn't log into a computer. We tested using 3 different methods of displaying her user account and got different numbers and sets of group memberships for each.
@MDMarra The whole reason she couldn't log in was because her token was being truncated to the point that 'Domain User' wasn't being included.
@MDMarra Pretty much. That was fun to watch the Windows guys fuck with.
I'm not sure how all they were searching on her account, but I know they used 3 or 4 different tools, and each one was providing back a different (but internally consistent) set of groups. Only one of which included Domain Users.
@ScottPack That's actually pretty magic, as Domain User is the primary group (unless you screw with it) and most DS queries (ya, not LDAP) won't even return "Domain Users"
Whoami / groups will show your current membership based on your token. Get-ADUser -properties memberof will show what AD says you're a member of. I've never had someone in enough groups for them to disagree
