Tagged Questions
0
votes
0answers
30 views
IIS: NTLM authentication works, Negotiate does not
We develop a web application that is installed on-site on customers' servers. In the past months, we've had a curious problem occurring every now and then. We also know how to workaround it, but I'm ...
1
vote
0answers
42 views
Kerberized SSH Failed
I want to authenticate ssh login with Kerberos, however fail. The following is a snippet of ssh debug information with the command ssh -vvv localhost.
debug3: Wrote 80 bytes for a total of 1125
...
0
votes
1answer
52 views
Lag between PAM password acceptance and session open on CentOS5
I have a very interesting situation. I have a server running CentOS5.5, and whenever I try to ssh in using any external interface, there is a 4+ second delay, consistently. There is no such delay ...
1
vote
1answer
89 views
What is the kerberos keytab file used for in UNIX/AD kerberos authentication?
I have proved that UNIX/AD Kerberos authentication works without the presence of a keytab file so I'd like to know whether I should worry about it (given I'll need an individual keytab for each server ...
0
votes
0answers
69 views
F5 authentication using kerberos keytab
Our network gear use tacplus for authentication and authorization. tac itself authenticates using kerberos. For one of the projects we need automated login to a F5 device using a script. Does anyone ...
1
vote
0answers
96 views
Mixing Redmine and custom authentication method in a single apache virtualhost for Redmine
I developed on Redmine a plugin to automatically log users using the REMOTE_USER given by Apache when its Kerberos ticket is accepted.
This plugin works as long as the user has a corporate login, but ...
0
votes
1answer
78 views
Kerberos Authentication for workstations not on domain
I have a base understanding of how Kerberos works in an Active Directory environment and the methods it uses to authenticate users and workstations onto the network, but my question is.. since ...
0
votes
0answers
72 views
Multi- authentication scenario for a public internet service using Kerberos [closed]
I have a public web server which has users coming from internet (via HTTPS) and from a corporate intranet.
I wish to use Kerberos authentication for the intranet users so that they would be ...
1
vote
1answer
195 views
Linux Client Active Directory Authentication stops working when failover
I have an issue with Linux clients trying to AD authentication by targeting a DNS name (corp.example.com). I have 2 Domain Controller servers DC1(10.0.0.3/24), DC2(10.1.0.3/24) both domain controllers ...
1
vote
0answers
222 views
heimdal kerberos in openldap issue
I think I posted this on the wrong 'sister site', so here it is.
I'm having a bit of trouble getting Kerberos (Heimdal version) to work nicely with OpenLDAP. The kerberos database is being stored in ...
2
votes
0answers
145 views
issue with heimdal kerberos in ldap backend
I'm having a bit of trouble getting Kerberos (Heimdal version) to work nicely with OpenLDAP. The kerberos database is being stored in LDAP itself. The KDC uses SASL EXTERNAL authentication as root to ...
1
vote
1answer
432 views
How to cache authentication in Linux using PAM/Kerberos authentication (for CVS)?
We have several Linux servers that authenticate Linux user passwords on our Windows Active Directory Server using PAM and Kerberos 5. The Linux distro we use is CentOS 6.
On one system, we have ...
1
vote
2answers
223 views
How to automate kinit process to obtain TGT for Kerberos?
I'm currently writing a puppet module to automate the process of joining RHEL servers to an AD domain, with support for Kerberos.
Currently I have problems with automatically obtain and cache ...
2
votes
4answers
3k views
How can I check if my IIS site is using NTLM or Kerberos?
How can I check if my IIS site is using NTLM or Kerberos? And how can I change authentication from Kerberos to NTLM? I'm using IIS 7.5 and I couldn't find any answer to this question, can help me a ...
0
votes
1answer
257 views
How can I set up an authentication system with single instance storage of credentials and several authentication methods/interfaces?
Background: I have a collection of Linux-based servers (let's say a few dozen) that are hosted in different locations. Some servers are lone satellites while others are hosted together in the same ...
0
votes
0answers
219 views
Kerberos and multiple SPN on the same account
I have Squid service on the linux box named SERV, and I successfully configured Kerberos authentication with AD (windows server 2008), by simply setting SPN HTTP/serv.domain.com on the computer ...
1
vote
3answers
813 views
How can I disable Kerberos authentication for only the root of my site?
I have Kerberos-based authentication and I want to disable it on only root url: http://mysite.com/. And I want it to continue to work fine on any other page like http://mysite.com/page1.
I have such ...
0
votes
1answer
551 views
Cannot get to configure Kerberos for Reporting Services
Context
I am trying to configure Kerberos in the domain for double-hop authentication. So here are the machines and their respective roles:
client01: Windows 7 as client
dc01: Windows Server 2008 ...
2
votes
1answer
88 views
Can UNIX/MSAD LDAP/Kerberos authentication work without matching usernames?
It looks as though there is a solid requirement for usernames on the UNIX client and in the MSAD to match for kerberos authentication to function (I think LDAP authentication too).
Is this absolutely ...
4
votes
1answer
700 views
Google Chrome and kerberos authentication against Apache
I've managed to get kerberos authentication to work now with Apache and Likewise Open but so far, Google Chrome doesn't seem to play fair.
Unless I start it with chrome.exe ...
0
votes
2answers
134 views
Kerberos unknown code krb 147, failed to verify krb5 credentials with LikeWise Open
I've followed this guide to get Apache Single-Sign-On to work, but so far all I get is strange kerberos errors.
...
1
vote
1answer
280 views
Squid Authentication & streaming
I've got squid setup using Kerberos authentication. I'm also using squidguard as an URL redirector to block out the usual nastiness of the web. There are some sites though that we allow certain users ...
7
votes
2answers
1k views
How does Kerberos work with SSH?
Suppose I have four computers, Laptop, Server1, Server2, Kerberos server:
I log in using PuTTY or SSH from L to S1, giving my username / password
From S1 I then SSH to S2. No password is needed as ...
0
votes
1answer
104 views
Error on trying to ssh to a prgmr box when using PuTTY like utility KiTTY
I recently got a box on prgmr. Excited, I tried to login using my username password in KiTTY (which is basically an improved PuTTY) and got the following error, shown in the screenshot.
Now, I can ...
0
votes
1answer
983 views
Unable to Login to kadmin from Kerberos Client
I have a small problem of getting my client to authenticate to a kerberos server that I just setup. Whenever I run:
[root@localhost log]# kadmin -r KERBEROS.MONZELL.COM -p host/kerberos.monzell.com
...
0
votes
1answer
261 views
RSH connection problem while running MPI program
I'm trying to run MPI programs on 8 machines, but I get the error
connect to address 127.0.0.1 port 544: Connection refused
Trying krb4 rsh...
connect to address 127.0.0.1 port 544: Connection ...
6
votes
1answer
106 views
Time taken for authentication to work again after changing system time
One of our domain controllers clock drifted way out of sync with the rest of the network (thanks to me forgetting to turn off VMWare's time synchronisation), which caused a whole bunch of servers to ...
2
votes
1answer
73 views
Any way to make cross-realm logins case insensitive?
I've got a demo cross-realm setup between MIT Kerberos and AD. Users can log in just fine as long as the machine is properly configured and the user knows that the realm is all uppercase and case ...
0
votes
2answers
91 views
Domain authentication used for kerberos based authentication of users on my server
Suppose a user process has authenticated itself against domain's directory server via kerberos, and then attempts opens a network socket to my server application.
My server application has a ...
2
votes
1answer
525 views
Moving my website to different server changes authentication from Kerberos to NTLM
I have a webservice that is configured for Windows Authentication. The client code that invokes the WS passes along the credentials to the WS as follows:
myWebService.Credentials = ...
0
votes
1answer
759 views
DCOM Authentication Fails to use Kerberos, Falls back to NTLM
I have a webservice that is written in Classic ASP. In this web service it attempts to create a VirtualServer.Application object on another server via DCOM. This fails with Permission Denied. However ...
2
votes
2answers
251 views
iis' Basic Authentcation with Kerberos?
A friend tells me that he uses Basic authentication of IIS for authentication of his web app. This system uses Kerberos too, but how can Basic Authentication and Kerberos work together?!
I know that ...
2
votes
1answer
137 views
OpenLdap configuration
Simple enough question; is there a way you can configuare your ldap server so it only accepts kerberos authentication and rejects any other type.
I'm almost 100% certain this can be done, i just do ...
1
vote
1answer
67 views
When I log on to my company desktop, I log on to a domain. How is this domain name installed? [closed]
When I have to work on my machine in company, I have noticed that I log on to a domain (named on the basis of company name) and not really on that computer. From, what I understand, this has a few ...
7
votes
4answers
2k views
Linux Central Authentication/Authorization Methods
I have a small but growing network of Linux servers. Ideally I'd like a central place to control User Access, change passwords, etc... I've read a lot about LDAP servers, but I'm still confused about ...
0
votes
1answer
361 views
FreeBSD 7.0 Kerberos Login over SSH, But Not Console
I assume there is an easy solution to this, but I prefer to ask before mucking up our intranet server. During a support session, my co-worker and I realized we could login in with our Kerberos ...
0
votes
1answer
1k views
Kerberos Authentication for Webservers
Before I blindly jump on "trial an error" tests, I'd like to ask some general questions on Kerberos Authentication for Webservers. I want to evaluate what's possible with Kerberos. The main benefit ...
1
vote
3answers
3k views
.htaccess requires password in chrome but not other browsers?
We have .htaccess on our site http://subdomain.site.com/:
AuthType Kerberos
AuthName "Internet ID"
require valid-user
order deny,allow
deny from all
allow from all
On a sub directory of the ...
1
vote
2answers
787 views
Kerberos authentication in IIS with .NET app under domain identity not working
Having a hell of a time trying to get a .NET web app to use Kerberos auth successfully, and would appreciate some assistance from the SF community.
Currently there is a Win2003/IIS6 server hosting a ...
11
votes
2answers
2k views
The Story of secure user-authentication in squid
once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network:
<the Internet>
...
2
votes
1answer
143 views
Linux domain - central auth and laptops with cred caching
I need to set up a linux network: central authentication server and laptops (maybe desktops). Laptops must cache credentials. What is the current best way to do that? Can kerberos be coerced into ...
1
vote
2answers
191 views
Developer Laptop with SQL Server 2008 can't login to SSIS when offsite
When I bring my Windows XP (SP3) laptop home I can still login as my domain account because Windows caches the info necessary to authenticate me when the domain controller isn't around.
However, when ...
3
votes
3answers
3k views
Authenticating Windows 7 against MIT Kerberos 5
I've been wracking my brains trying to get Windows 7 authenticating against a MIT Kerberos 5 Realm (which is running on an Arch Linux server).
I've done the following on the server (aka dc1):
...
1
vote
2answers
2k views
Authenticating with Exchange WebDAV / Outlook Web Access
I'm having issues accessing Exchange WebDav / OWA from any machine but the IIS & Exchange server.
We've got a small development domain running Windows 2003. One server (which we'll call IIS_box) ...
2
votes
2answers
142 views
General-purpose unix-based network authentication tool?
I want something that'll integrate auth across SSH, web (ideally including SSL, with the option of authenticating with either client-side cert or password, like they do at MIT), and whatever ...
1
vote
3answers
1k views
IIS time is different from server time
I have ASP.NET 2.0 site configured to perform Windows Integrated Security using Kerberos delegation. The servers including DC are running on Windows 2003 and the delegation is raised to Windows 2003 ...
0
votes
1answer
105 views
In SASL authentication, are the messages between a particular client and server the same every time it connects?
I wrote a test client and server using the Cyrus SASL library, and I'm manually forcing it to select GSSAPI as the mechanism. While debugging, I printed the md5sum of each message as it was passed ...
1
vote
3answers
657 views
Moving from OpenLDAP/Kerberos to Active Directory
I have a well working setup using OpenLDAP for user information and Kerberos for authentication, but we need to have windows integration too, and for this we have decided that moving into Active ...
2
votes
2answers
845 views
Apache mod_auth_kerb asking 2 authentication
I've configured Apache to use mod_auth_kerberos. So far everything is working nicely for client thats connected to Active Directory and have their browser to ntlm enabled.
When clients are not in the ...
0
votes
1answer
207 views
Unknown Kerberos authentication pattern on SQL Servers
One of our admins noticed a strange pattern of login messages in the Windows event log on one of our SQL Servers, and after some investigation, I've found that it the same pattern can be found on most ...
