Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

1
vote
1answer
60 views

wbinfo -u does not show AD users (is empty)

We have a problem on a Ubuntu Server 14.04 (fileserver) connected to AD on a Windows Server 2008 R2 using Samba (version 4.3.8)/WinBind and Kerberos. The problem is that users do not have writing ...
0
votes
1answer
22 views

Forward service records from main DNS to IPA server

I have a production DNS server (dns1.local) in Data Center environment, I build recently IPA server (ipa.example.com) that runs DNS as well in the same environment and it forwards requests to ...
0
votes
1answer
22 views

Kerberos and LDAP login

I want to manually login to a ldap-server. For authentication Kerberos is used. I am registered there with username and pw. kinit username@servername It works fine and a valid TGT is created which ...
1
vote
2answers
22 views

Initialise Kerberos ticket on ssh login using PAM

Right, so I am struggling a bit with PAM in Centos7. I have no idea how to configure it manually and make the changes permanent so that I get a kerberos ticket after a successful ssh login. The ...
3
votes
2answers
78 views

creating an SPN from a linux build server

I'm setting up a process which would automatically create the SPNs for newly exposed service URLs. I am aware of how to create an SPN with Windows using the setspn -A command with the right ...
3
votes
0answers
67 views

Questions about ktpass/kerberos with Active Directory

I got a few questions about Kerberos with Active Directory, specifically about the ktpass tool. The example AD I'm using (everything is on 2012R2 level): Active Directory Domain Name: ...
-1
votes
0answers
21 views

Kerberos-based SSH login requires local user account

I've recently set up a linux system (Debian-Jesse) which has joined an MS-Based Kerberos domain and been set up to allow Kerberos-based authentication for remote access. The only issue is, ...
-1
votes
1answer
70 views

Samba file server as domain member: error when joining domain

I would like to set up samba 4 to share a local directory, so that domain users are allowed to mount the directory. I don't want domain users to be able to log in the linux machine, they should only ...
0
votes
0answers
12 views

What changes with Kerberos Authentication in IPv6 when using NAT? [duplicate]

How should Kerberos Authentication be setup with IPv6? Of you're using NAT for IPv6 where there is a single public IPv6 address and it translates to the machines inside in the ULA range?
0
votes
1answer
24 views

What changes with Kerberos authentication in IPv6 when everyone has a public IPv6 Address?

How should Kerberos authentication be set up with IPv6? What implications are there when client devices each use a public, globally routeable IPv6 IP address? What changes when setup this way ...
0
votes
2answers
39 views

Build a production IPA server without integrate DNS and NTP with client

We are going to deploy a centralized authentication Linux server (RHEL6) for our RedHat/CentOS servers in Data Center environment. I made some search I believe Free IPA is the best choice since it's ...
3
votes
2answers
108 views

Are SPNs specific to Windows and Active Directory?

Are Service Principle Names specific to Active Directory on Windows? Or do they exist in Linux OpenLDAP / Kerberos KDC servers too?
0
votes
1answer
23 views

What kind of SPN is required to delegate client credentials to a SMB Share?

I'm trying to delegate KERBEROS authentication from an SQL Server to a file server over OLEDB. Is there a particular Service Principle Name that is used to delegate credentials from an SQL Server ...
6
votes
1answer
144 views

Joining AD domain with Windows 10 using smart card

My Windows "domain-centric" company has abruptly decided to make the switch from Windows 7 to Windows 10, and it has become my job to make their prepared image join our domain with our smart ...
1
vote
0answers
20 views

Unspecified GSS failure. after setting up krb5/ldap authentication

new here, so I recently setup ldap/krb5 authentication on an centos7.2 vm. Krb5/ldap is working correclty as I can login using ldap user account. However, when I check the logs in the client machine ...
0
votes
0answers
20 views

Mounting NFS v4 on Linux with Username

I'm trying to mount a NFS v4 share on a Redhat Linux machine where the share is restricted to a particular user account. I have a kerberos ticket for the server and SSSD with LDAP used to populate ...
0
votes
0answers
28 views

Kerberos authentication failure with strange account name [closed]

Recently, I observed a lot of authentication failures(about 600 failures per day) coming from one of my company servers with account name "@@CyBAAAAUBQYAMHArBwUAMGAoBQZAQGA1B...."(about 150 characters ...
1
vote
0answers
32 views

Client to IIS to SQL Server Kerberos authentication

I would like to have a setup where my IIS web server sits on a different virtual server from where my SQL Server is installed, and Windows Authentication should be used for all connections. I am ...
0
votes
1answer
30 views

Apache not finding the kerberos principal in keytab file

Virtual host has been configured with these options; AuthType Kerberos AuthName "Kerberos Login" KrbMethodNegotiate On KrbMethodK5Passwd Off KrbAuthRealms EXAMPLE.COM KrbAuthoritative On ...
0
votes
0answers
31 views

SSO, Kerberos, multiple domains, multiple Linux servers

I have successfully implemented SSO for one production application running on Centos 6 + apache 2.2. connecting to Windows 2008 AD server. Users are coming from 2 different domains: a.com and b.net, ...
0
votes
1answer
15 views

NFSv4 with Kerberos - idmap stops working after ~35 minutes

All machines are running CentOS 6.5. We have about 85 client machines doing a Kerberized NFSv4 mount (sec=krb5p) to a server. This weekend, the server was changed (serverA changed to serverB). ...
2
votes
0answers
75 views

Forward Kerberos Authentication on Ansible

I have an ansible control machine (host-A) that need to talk with host-C, an Windows machine that doesn't have local users (It's an Active Directory). host-A doesn't have network access to host-C, ...
3
votes
0answers
33 views

Kerberos keytab file not working

I have two AD domains and I'm trying to use NFS with Kerberos to both of them. Part of the procedure requires creating keytab files for the host and nfs principals for the client and server ...
0
votes
0answers
17 views

Why do i need freeradius's keytab?

I'm trying to set up 802.1x for the wifi. I'm working with freeradius an windows server 2012. I need SSO ... help :) Currently I'm not able to set up freeradius krb. 'radtest' doesn't make it trough. ...
1
vote
0answers
35 views

Does FTP service (IIS 7.5) on Windows 2008 R2 support kerberos authentication?

I have configured http service on IIS 7.5 for kerberos authentication. And it works fine. I have checked from linux box # klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: alex@EXAMPLE.NET ...
1
vote
1answer
20 views

Having a Kerberos issue, and can't trace the traffic in NetMon

I'm trying to get Kerberos to work for a new Sharepoint server I'm installing. It works fine for the server name, but not the FQDN. I've done setspn for both, and I've added the domain to trusted ...
0
votes
0answers
60 views

kinit pre-authentication fails

I have a centos 6.4 that someone setup a while back. The admin is not sure how he installed it, but it works very well with Kerberos. I used authconfig to set the domain and the Kerberos settings. I ...
1
vote
3answers
143 views

CentOS7 Kerberos Auth: Improper format of Kerberos configuration file;

I'm working on setting up a Squid 4.0 explicit proxy for group based AD authentication against a Active Directory domain (Server 2012 R2) with SSL bumping on a minimal CentOS 7 (64b) install. The ...
2
votes
1answer
67 views

Integrating squid with active directory

I am trying to integrate squid as a web proxy for my users in active directory. I have followed the tutorial in the squid site in here. When i run the command : msktutil -c -b "CN=Administrator" -s ...
0
votes
0answers
50 views

Cross Domain NTLM / Kerberos Auth with Chrome on Mac OS X / Linux

I'm trying to configure Chrome on my MacBook Pro to use kerberos to authenticate to web sites so I don't get prompted to enter my username and password constantly. I've added the AuthServerWhitelist ...
4
votes
2answers
164 views

Do Linux servers using AD/Kerberos for authentication/authorization need computer accounts?

I am confused about whether Linux servers using Active Directory (AD) and Kerberos need computer accounts created? Does the Linux server as a machine need to join and AD domain and in doing so have a ...
0
votes
1answer
34 views

Error trying to enable LDAP with kerberos authentication with GPFS

I have 3 RHEL7 nodes with GPFS / Spectrum Scale 4.2.0.0 installed. The 3 nodes have been setup with GPFS as a cluster with a GPFS filesystem created. I am trying enable LDAP based authentication ...
0
votes
1answer
39 views

gssapi/kerberos/active directory/ubuntu - Wrong principal in request

I'm trying to setup a Clientserver with a Webservice to which Users of an Active Directory should be able to login with SSO. I'm using SPNEGO with Kerberos on a Ubuntu 14.04 Server and nginx proxy to ...
0
votes
0answers
21 views

SSO for hybrid browser and API authentication

My organization is testing a SAML2 environment made up of a Shibboleth Service Provider and a SimpleSamlPHP Identity Provider. The idP obtains auth information from a custom REST API (no LDAP or AD). ...
0
votes
1answer
121 views

Kerberos 5 won't install on Debian 8.2 or 8.3

I've been running some VMs in VirtualBox and cannot get Kerberos5 installed. I keep receiving the error: Reading package lists... Done Building dependency tree Reading state information... Done Some ...
0
votes
0answers
23 views

Migrate logcal windows users to FreeIPA ones

We have several Windows machine (running 7, 8, and 10, but that should not be relevant) with local users. Most of those local users are the same login name but might have different UID/GID based on ...
1
vote
0answers
31 views

Migrate logcal linux users to FreeIPA ones

We have several Linux machine (running various versions of Fedora and CentOS, but that should not be relevant) with local users. Most of those local users are the same login name but might have ...
1
vote
0answers
30 views

Apache External access

I am wondering if anyone can help me. I am trying to setup SSO. I have it working inside a domain, where the kerberos ticket is passed and they sign on works and the user is able to login correctly. ...
1
vote
1answer
72 views

Clients can't update dNSHostName attribute after DNS suffix change

We have a bunch of Windows 7 and Windows Vista clients that belong to domain contoso.com. The clients are registered in DNS to client.contoso.com. We have changed the DNS suffix via GPO from ...
0
votes
0answers
18 views

What is GNOME doing at login that the console doesn't?

I have a series of lab machines running CentOS 7.2, authenticating via Kerberos and getting user data from NIS, then with home directories on NFS. When logging in, very often, the user puts in their ...
0
votes
1answer
37 views

Multi-factor auth with Kerberos and RADIUS

I am looking for a solution in order to allow a multi-factor authentication for a Kerberos-based logon service. By reading some articles, I found some good references about RADIUS, that provides a set ...
-1
votes
1answer
22 views

keytab file between Windows 2003 server Windows 2008 R2 [closed]

My organization currently is migrating Windows 2003 server domain controllers to Windows 2008. The process may finish in next half year or so. Meanwhile we also want our Oracle database (on AIX 7.1) ...
1
vote
1answer
37 views

Determine usage of UPN for logon inside MS AD forest / domain

maybe somebody can give me a hint on this. I am evaluating the prerequisites for changing all (human) user's UPN in a large Microsoft AD environment to the recommended MS format (aligned with the ...
0
votes
0answers
33 views

kerberos authentication to linux from windows

We have mostly unix/linux server in our data center. We access them from our workstations running windows using putty. All the workstations are part of an AD domain but the servers are not. Kerberos ...
0
votes
1answer
124 views

sudo and Kerberos on AWS Linux issues

We have an issue on some of our AWS machines, running Amazon's hacked Fedora/RHEL linux where newer-in-AD users can login with password but cannot autheticate for sudo. Users that were created in AD ...
2
votes
0answers
146 views

Windows - Kerberos SSO from outside the domain

I've tried to figure it out myself, but to no avail. Google offers many tutorials but I couldn't find any for the below case. We have an external cooperating employee with VPN access to our LAN and ...
1
vote
1answer
91 views

Is LDAP used by Active Directory for anything if I only use Kerberos for authentication?

In my windows only domain, Kerberos is used for all authentication. The domain controllers I understand replicate & authenticate using RPC. Is LDAP used for anything else? Should I close the ...
6
votes
1answer
131 views

Is it possible to use Kerberos over TLS through sssd?

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with Kerberos and ...
4
votes
2answers
154 views

AWS Simple AD: “KDC has no support for encryption type” for users created with adtool, but not with MS Management Console

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with kerberos and ...
2
votes
2answers
297 views

How to add principals to a keytab when using realmd on CentOS

I joined a server to a MS Active Directory using realmd/sssd. I installed apache with mod_auth_kerb and created a keytab on a windows server. But, I need to add more SPNs to the keytab. I have tried ...