The tag has no usage guidance.

learn more… | top users | synonyms

1
vote
1answer
24 views

Wrong user mapping in kerberized NFSv4 automounted homedirs

Short problem description This question is about id mapping in NFSv4 going wrong. NFS server: a Synology DS, with DSM 5.2. Client: A regular FC22 machine, which automounts as /home one of the ...
0
votes
0answers
59 views

kdm and ssh detecting different fully qualified domain name when using kerberos authentication

I'm attempting to setup Kerberos login support (Windows AD domain providing the kerberos) for Kubuntu 12.04 Linux workstations at the company I'm at. It's almost completely working but I can't get ...
0
votes
1answer
29 views

Does “Kerborised” NFSv4 securely protect against a malicious client spoofing the user

I have read conflicting statements about whether shares exported via NFSv4 with sec=krb5 are cryptographically protected against a malicious client mounting the share and then spoofing the user to ...
0
votes
1answer
104 views

Mongodb + Kerberos BadValue SASL mechanism GSSAPI is not supported

I am trying to run an instance of mongodb with the authentication mechanism GSS-API. This is the command: mongod --dbpath /home/ec2-user/db/node2/data --auth --setParameter ...
2
votes
1answer
280 views

Why is sshd engaging PAM still?

Background/Behavior is: if you ssh to box via and GSSAPI/Kerberos succeeds and you have a local user in /etc/passwd, you login fine per below PAM config. All Good there. But if you don't have a ...
3
votes
3answers
2k views

Putty Kerberos/GSSAPI authentication

I configured a few Linux servers to authenticate with Active Directory Kerberos using sssd on RHEL6. I also enabled GSSAPI authentication in hopes of passwordless logins. But I can't seem to get ...
4
votes
0answers
309 views

Cannot enable GSS-TSIG updates from Active Directory in BIND 9.10

I’m with a problem trying to enable GSS-TSIG with BIND 9.10. Before I start describing what I’ve done, I would like to say that I’ve already done this in in another domain without any problems. So I ...
2
votes
1answer
1k views

problems creating a keytab file on win server

I am trying to create a keytab file. i see a warning WARNING: pType and account type do not match. This might cause problems. The command i use is ktpass -princ ...
0
votes
1answer
72 views

Mail client with support for gssapi

I have configured Postfix and Cyrus Imap to enable SSO using Kerberos and GSSAPI. I use Thunderbird as a mail client which supports GSSAPI but I wanted to try some other client also. I tried ...
4
votes
2answers
695 views

Is there a way to have tortisesvn use Windows 7 kerberos tickets to auth against an apache svn server?

I have putty able to use gssapi on my Windows 7 x64 clients against kerberos logins for SSH. I.e. it forwards the ticket you get when you log in to windows. I can't figure out how to get tortiseSVN to ...
0
votes
0answers
173 views

Use gssapi with Microsoft office outlook.

Currently in windows computer I have installed Kerberos for Windows. This allowed me to use sso with Thunderbird against a Cyrus IMAP. Thunderbird has the option of using GSSAPI. Is possible to ...
2
votes
2answers
4k views

Apache SSO through Kerberos using Machine Account

I'm attempting to get Apache on Ubuntu 12.04 to authenticate users via Kerberos SSO to a Windows 2008 Active Directory server. Here are a few things that make my situation different: I don't have ...
0
votes
1answer
649 views

Strange Change in ssh behavior + LDAP

We have a cluster with a front node that admits normal users and LDAP users. Two days ago the ssh show a strange behavior: The LDAP users can't login in the front node using password but, The LDAP ...
1
vote
1answer
2k views

Can't get postgres and kerberos (gss) working together

I am trying to get postgres and kerberos, via GSSAPI, working together. Having trouble at this point. It does not help that I am really a newbie for both technologies. I have both postgres and ...
2
votes
1answer
494 views

SSH - slow authentication

This is more of a curiosity question then a problem at this point. I have resolved my problem which i'll post the solution that worked for me. problem I was getting rather slow authentication times ...
1
vote
1answer
427 views

Can one config LDAP to accept auth from ssh-agent instead of from Kerberos?

[This question is not about getting your LDAP password to authenticate you for SSH logins. We have that working just fine, thank you :-) ] Let's suppose you're on a Linux network (Ubuntu 11.10, slapd ...
0
votes
1answer
107 views

Cyrus-IMAP, GSSAPI and auxprop

I'm setting up a mail system using Postfix (OpenLDAP backend) and Cyrus-IMAP on Debian. Goal: I'd love to go ahead with GSSAPI authentication. I've tested the whole setup on virtual machines on my ...
1
vote
1answer
2k views

Openldap/Sasl/GSSAPI on Debian: Key table entry not found

The goal: to make an OpenLDAP server to authenticate using Kerberos V via GSSAPI Setup: several virtual machines running on freshly installed/updated Debian Squeeze A master KDC server ...
2
votes
3answers
6k views

Wrong principal in request (SSH/ GSSAPI/Kerberos/Debian)

I've set up two VMs on an "internal" (in VirtualBox meaning) network, one being a DNS server (dns1.example.com) and the other - a KDC and Kerberos admin server (kdc.example.com). The default and the ...
1
vote
1answer
841 views

OpenSSH + Kerberos SSO: No key table entry found for host/localhost.localdomain

SSO not working with OpenSSH - I have not been able to get GSSAPIAuthentication to work with Kerberos. Everytime I attempted to login, I kept getting prompted for the password. During the ...
0
votes
1answer
135 views

Error on trying to ssh to a prgmr box when using PuTTY like utility KiTTY

I recently got a box on prgmr. Excited, I tried to login using my username password in KiTTY (which is basically an improved PuTTY) and got the following error, shown in the screenshot. Now, I can ...
1
vote
2answers
2k views

How do I use ldapsearch with a cross-realm ticket?

kinit user@DOMAIN.TLD klist -afe Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: user@DOMAIN.TLD Valid starting Expires Service principal 08/04/11 13:14:53 08/05/11 ...