Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

0
votes
1answer
37 views

Active Directory authentication without Kerberos?

A friend of my has a Linux machine hosting Jenkins and a Windows 2008 Domain Controller. He uses Active Directory authentication in Jenkins and only specified the domain name and domain controller in ...
-1
votes
0answers
7 views

Kerberos security [closed]

I'm a total newbie at this, but I need to set up kerberos on my 10 client/server network. Where there is raspberry pi that would be running as the main server. My question is, how can I set it up?
0
votes
1answer
19 views

Track down source of event 4771: Kerberos pre-authentication failed

Some process on a remote server is generating failed log-on attempts for a specific user account. I want to know what process it is. The account in question started generating these bad password ...
2
votes
0answers
28 views

Use Kerberos ticket to access WebDAV

Using Apache's mod_dav as the server, Samba 4.1.17 as the server and any version of Windows from 7 upwards as the client how can I mount a WebDAV share using Kerberos for the authentication? ...
7
votes
1answer
65 views
+250

Kerberos service login only possible for 30 minutes after running ktpass.exe

I'm trying to Kerberize an Apache-server, and allow the created server principal to sign on to the Active Directory. I've followed one of the numerous tutorials available online, and it seems to work ...
1
vote
0answers
32 views

Obtain Kerberos ticket automatically (on boot) in CentOS 7?

I'm using Ansible to administer a group of Windows servers, with my control machine running CentOS 7.1. I've set up my /etc/krb5.conf file to authenticate to a domain controller so I can use one ...
1
vote
1answer
24 views

Wrong user mapping in kerberized NFSv4 automounted homedirs

Short problem description This question is about id mapping in NFSv4 going wrong. NFS server: a Synology DS, with DSM 5.2. Client: A regular FC22 machine, which automounts as /home one of the ...
0
votes
1answer
15 views

Is it possible for two legs of a service to have the same SPN? Or at least clients refer to a single identity?

For a WCF service "SuperService", installed on two separate servers "Server1" and "Server2" - is it possible to have a single SPN identity string to which the WCF client "SuperClient" can refer? Such ...
0
votes
1answer
32 views

Scalability of multiple keytabs, Linux NFS client/server and Windows AD KDC

I have kerberized NFSv3 working with a generic Linux NFS server and multiple Linux clients with a Windows AD 2012 domain for the Kerberos Realm. Windows KDC requires that when you create a keytab for ...
0
votes
0answers
19 views

Kerberos key version number mismatch in Apache, even though kvno and klist -k return the same numbers

I don't know if anyone had this issue. I am trying to implement single-sign-on through Kerberos and I get the following Apache error: [Thu Aug 13 12:08:54.219420 2015] [auth_kerb:error] [pid 1829] ...
0
votes
1answer
55 views

LDAP + KERBEROS + NFS. Why do I need idmapd?

What I am trying to do I have a freeIPA domain, with a few clients and a Synology NAS (also enrolled in freeIPA). I created a shared folder on the NAS, with NFSv4 + krb5 support. From the client, I ...
0
votes
1answer
40 views

krb5.conf is not readable by httpd process

I have an issue regarding kerberos / httpd / RHEL System 1 This is the problematic system. OS: RHEL 6.6 Kernel: 2.6.32-431.29.2.el6.x86_64 CPU: Intel Xeon X5570 There is a kerberized website ...
0
votes
1answer
21 views

automate kinit while login using sssd

I'm searching and trying this for a few weeks. What I've done so far: I'm authenticating for login using sssd with ldap. This works actually great! We need to authenticate via sssd with ldap, ...
0
votes
0answers
27 views

LDAP Kerberos authentication on linux

I have configured my RHEL linux machine to be authenticated against active directory without being joining it to domain, using nss-pam-ldapd pam_ldap samba-winbind openldap-devel krb5-devel. I am able ...
0
votes
0answers
20 views

Is it possible to configure different AuthType for directory and proxy in Apache?

I want to configure different AuthType for directory and proxy in Apache HTTPD server: https://httpd.apache.org/docs/2.2/mod/core.html#authtype I want to configure in directory Kerberos AuthType ...
1
vote
1answer
47 views

List all kerberized SPN's in Linux

Is there a way to list/show all SPN's in an kerberized AD using a Linux Client? In Windows one can use setspn -T <domain> -Q */* to get them. Is there something similar? Haven't found anything ...
0
votes
0answers
17 views

kerberos cross realm authentication

I want to do setup for kerberos cross realm service authentication using active directory. My question is that should I create a different domain (I read somewhere that realm is a domain) or should I ...
1
vote
1answer
61 views

Kerberos master server to slave server automation?

I've set up Kerberos in my workplace running on Centos 6 boxes, and successfully propagated the master server database to the slave and also set up a cron job to update it automatically every 5 ...
2
votes
1answer
15 views

how can I restrict kerberos service tickets by group?

I have multiple Linux servers all configured to allow kerberos authentication with active directory. All other user and group attributes reside in a separate directory server (389). I am able to log ...
1
vote
1answer
20 views

kadmind error - krb5_recvauth: start_seq_get is not supported in the HDBGET keytab type

I'm trying to migrate a heimdal KDC with an OpenLDAP backend from a Debian 5.x server (heimdal 1.2.dfsg.1-2.1) to a Ubuntu 14.04 server (heimdal 1.6~git20131207+dfsg-1ubuntu1.1), and am running into ...
0
votes
1answer
65 views

Using SSH Keys with Kerberos

So there's an issue that we've been having at our company causing me to pull my hair out for the past week: We have hundreds of server boxes (a mix of CentOS6/7, if it matters) that need to quickly ...
2
votes
1answer
85 views

Joining Linux host to Active Directory fails to update Microsoft DNS

I am joining Linux hosts (CentOS 6) to Active Directory using a special bind account. I've granted delegate permissions to this user and when I join on the default Computers OU, a computer object is ...
0
votes
0answers
31 views

'Kerberos Method' on Samba 3.0

When running sudo net ads join -U admin to add my domain to the realm, I get the error: Unknown parameter encountered: "kerberos method" I found out that kerberos method is not supported by Samba ...
0
votes
2answers
19 views

How can I audit Ip adresses of users logging into system?

I have a group of servers which use Kerberos for authentication. We distribute keytabs to users but want to ensure that a user never pass their keytab to someone else. Essentially we need to audit the ...
1
vote
1answer
22 views

Privileges when doing sudo to another domain user

Suppose I have a corporate domain mydomain using MS Active Directory. In the domain I have the users myuser and youruser. Now, on one specific Ubuntu machine mymachine, myuser has sudo rights, and ...
0
votes
0answers
10 views

Privileges when doing sudo to another domain user [duplicate]

Suppose I have a corporate domain mydomain using MS Active Directory. In the domain I have the users myuser and youruser. Now, on one specific Ubuntu machine mymachine, myuser has sudo rights, and ...
2
votes
1answer
70 views

Windows 7 versus 8 Access CNAME'd Share

Here's a situation that came up yesterday: we have a share on a machine we have to access using an alias (CNAME). The machine is running Windows Server 2012 R2, and services Windows 7 and 8 clients. ...
0
votes
0answers
58 views

kdm and ssh detecting different fully qualified domain name when using kerberos authentication

I'm attempting to setup Kerberos login support (Windows AD domain providing the kerberos) for Kubuntu 12.04 Linux workstations at the company I'm at. It's almost completely working but I can't get ...
1
vote
1answer
116 views

How to avoid frequent KVNO increases, when using Apache HTTPD with mod_auth_kerb talking to AD?

I've setup Apache HTTPD 2.4 with mod_auth_kerb, created a service account on Active Directory, added a SPN for my http hostname, created a keytab file on the linux machine, and had SSO start working ...
4
votes
0answers
134 views

Samba authentication and LDAP

I have an OpenLDAP server that I use for authentication and authorization for various services. All users are of object type inetOrgPerson and my groups are groupOfNames. Now I want to configure ...
1
vote
1answer
146 views

Ubuntu 14.04 Failing to join domain for Integration with Active Directory (winbind & samba)

I've followed the tutorial at this link https://help.ubuntu.com/community/ActiveDirectoryWinbindHowto Everything seems to be configured somewhat correctly, net rpc join worked and the realm is listed ...
1
vote
1answer
49 views

Active Directory: Permissions to get Kerberos Service Ticket

I have an Active Directory with a KDC running on Windows Server 2012. At the moment, every user can request service tickets for every service from the TGS. I'm looking for a solution where the KDC ...
0
votes
1answer
29 views

Does “Kerborised” NFSv4 securely protect against a malicious client spoofing the user

I have read conflicting statements about whether shares exported via NFSv4 with sec=krb5 are cryptographically protected against a malicious client mounting the share and then spoofing the user to ...
0
votes
2answers
114 views

Apache 2.2 mod_auth_kerb SSO stopped working

I'm all out of ideas why has it just stopped working, here's what I checked: httpd-error.log: [Thu Jun 11 18:04:21 2015] [debug] src/mod_auth_kerb.c(1758): [client 10.105.5.131] ...
3
votes
1answer
56 views

Windows client damage authorization header (Kerberos) => IIS 400 (Bad Request)

We are facing strange behavior on about 5% of Windows (7 Pro and XP Pro, both 32 and 64 bits) client computers. These computers gets randomly error from IIS server - 400 Bad request. We are using ...
2
votes
1answer
68 views

Changing login-formats for Linux and Active Directory

On CentOS, I run realm list and see login-formats: %U@mydomain.local I'd like to change login-formats: %U@mydomain.local to login-formats: %U How would I go about doing this? I'm assuming there is a ...
2
votes
1answer
225 views

Linux AD integration, unable to login when using Windows Server 2012 DC

I am trying to integrate my CentOS 6.6 servers into Active Directory. I've followed this guide from Red Hat using configuration 3 (SSSD/Kerberos/LDAP). When using a Windows Server 2008 R2 server as ...
4
votes
0answers
127 views

Windows Authentication to a Remote Server within an Intranet Environment

I have several servers (all on the same DC) within an Intranet environment at my company. For simplicity, I'll focus my question on the IIS and SQL Servers. I have an IIS 7.5 web server and a remote ...
0
votes
0answers
24 views

Kerberos PuTTY from non-domain machine via VPN

Feels like I'm missing something fundamental here... Have a non-domain machine (personal machine off site) from which I VPN into our work network. Once connected, from 'klist', it appears my VPN ...
0
votes
1answer
68 views

Kerberos SSO virtualhost different domain

I have a running centos6.6 server who authenticates against a windows 2008 AD with realm EXAMPLE.LOCAL. I have successfully configured an apache webserver for authentication through kerberos keytab ...
0
votes
0answers
58 views

Kerberos constrained delegation

There is a small problem with the setting Kerberos constrained delegation in Active Directory. The scheme works as follows: 1. Client workstation. 2. Web server with Windows 2008 Ent installed IIS ...
0
votes
1answer
59 views

SCOM: SQL Server cannot authenticate using Kerberos

For past few months, we are getting these kind of alert in SCOM stating SQL Server cannot authenticate using Kerberos. One thing to note here is that this alert is coming from only one server not ...
0
votes
1answer
105 views

Samba4 and Kerberos configuration on a dedicated server

I try to set up Samba 4 on a dedicated server from kimsufi.com but I have difficulties configuring Kerberos and Samba4. I am very confused about IP, Realm, Domain, NetBIOS, DNS etc. in Kerberos and ...
0
votes
1answer
29 views

unable to change environment variable using setenv()

I have an a member server with a windows PDC with active directory. Security=ads. I am trying to set an environment variable(credential cache) using C: setenv("CCACHE","cache_name",1); However, ...
0
votes
1answer
568 views

Security-Kerberos Error, event ID 4

I have two new Domain Controllers on new Forest. Servers have DFS and IIS services installed. Everything seemed to go Ok for a While. After updating servers I got new errors. Now once in hour ...
1
vote
1answer
87 views

Unable to join AD domain using Kerberos from kickstart

I am trying to join to the Windows domain in the %post chroot section of my kickstart script using kinit and net commands after setting up the samba, kerberos and sssd configurations in %pre. My ...
2
votes
2answers
244 views

OpenSSH two factor authentication combined with Kerberos / public key

I'm trying to implement two-factor authentication for OpenSSH. The environment is Centos 7 (kernel: 3.10.0-229.1.2.el7.x86_64) with OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013. We have Active ...
1
vote
2answers
113 views

LDAP syncrepl with kerberos authentication

I'm trying to set up a replication server for LDAP using syncrepl. I would like to use Kerberos to authenticate the consumer, because we have it set up, and it seems more secure. The database ...
0
votes
0answers
26 views

Kerberos transitive trust and Auth to local

I need to connect users belonging to a realm to services that resides to another realm. These two realms are not trusted together, but realm A (where users are) is trusted by realm B. This one is ...
0
votes
1answer
249 views

Kerberos constrained delegation using Citrix NetScaler

I'm currently evaluating Citrix NetScaler VPX (NS10.5 56.12.nc) as a potential replacement for Microsoft TMG server. Kerberos Constrained Delegation is at the top of my list of mandatory features. ...