Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms

1
vote
2answers
33 views

Kerberos ktutil, what kinds of encryption are available?

I am attempting to make a keytab using ktutil. I get to choose the encryption type, but the ktutil man page does not offer a list of possible choices. I also don't know which encryption method is the ...
4
votes
1answer
29 views

Does Active Directory's Kerberos implementation support per-user ticket lifetime settings?

With MIT Kerberos, the kadmin utility supports the creation of principals that have an explicit maximum ticket lifetime and renewal lifetime (-maxlife and -maxrenewlife arguments for add_principal) ...
0
votes
2answers
16 views

How to clear kerberos config

I am setting my machine as a kerberos client. I have a question on how the kerberos config file actually take effect and how to clear its effect. My experiment is as follow. Step 1, without editing ...
0
votes
0answers
39 views

Browser (SPNEGO) kerberos authentication on Windows Phone 8 IE

Is there a way to make Internet Explorer on Windows Phone 8 authenticate to a site using Windows Integrated Security Authentication with Kerberos through the Negotiate (SPNEGO) protocol? It seems to ...
0
votes
0answers
55 views

squid authentication error kerberos - windows active directory

I use squid on RHEL6 and I want that authentication is via AD windows 2008, I already joined the server to the windows domain and all users is already seen by wbinfo -u wbinfo -g but wbmin -t show ...
1
vote
1answer
27 views

BCP/xp_cmdshell access denied - but only when running procedure from outside the server

I've been attempting to run some of my team's database deployment code to a SQL 2014 server on a Windows 7 test box. Part of this code is a procedure that pulls in data from a file using BCP from a ...
1
vote
1answer
59 views

Why don't Active Directory user accounts automatically support Kerberos AES authentication?

I'm playing around with a test domain on Windows Server 2012 R2. I'm operating at the highest possible functional level and have no backwards-compatibility issues in my small test environment. ...
0
votes
0answers
42 views

Kerberos and SSH login

I've just configured a RHEL 7 for windows authentication (idmap_ad). Every check works but if i try to ssh with a domain user i get the error: Connection closed by ::1 Here follows the ssh log in ...
1
vote
2answers
64 views

IE HTTP Kerberos issues authenticating to site on FQDN not matching AD Domain

I have a site on a corporate domain that authenticates using Kerberos auto-login from IE and Chrome just fine, as long as the DNS being used to access it falls under the AD FQDN The AD domain is not ...
0
votes
2answers
506 views

kinit: Cannot contact any KDC for realm 'UBUNTU' while getting initial credentials

I am installing Kerberos5-1.12.1 on ubuntu machine by following the link: http://techpubs.spinlocksolutions.com/dklar/kerberos.html#krb-install Whenever i am trying to do : kinit user1 I am ...
1
vote
1answer
215 views

Unable to setup Kerberos on Ubuntu 14.04 - krb5kdc: No such file or directory - while initializing database for realm myrealm

I'm attempting to follow the guide on the Ubuntu wiki for installing and setting up Kerberos. I am running Ubuntu 14.04 (LTS) 64-bit. I have setup avahi-daemon in order to provide .local DNS names. I ...
1
vote
1answer
30 views

Is the Kerberos SPN FQDN significant to the server, or is the keytab enough?

I spend most of my time as a developer, so I'm not familiar with all the details... I have a service running on a linux host. I want to use Kerberos to transmit identity information to the service. ...
0
votes
1answer
25 views

Password reset is not working

I am using krb5 authentication to authenticate users in my machine. I am trying to change my password using passwd command but it failed. ~:$ passwd ~:$ Changing Password for bharathi ~:$ Kerberos 5 ...
0
votes
1answer
128 views

Issues with Kerberos trying to log on Samba 4 Active Directory Domain Controller from Windows

I'm trying to setup an Ubuntu Server with Samba 4 as Active Directory Domain Controller and I'm getting an error when I try to connect from a Windows machine. Here's Samba's log of the error (I've ...
0
votes
0answers
27 views

User under windows server AD access Linux server using kerberos

I installed AD on windows 2008 r2 sp1 server . And had configured all things follow the issue http://msdn.microsoft.com/en-us/library/ms995329.aspx ...
1
vote
1answer
230 views

FreeIPA: command-line tools do not work, 'No Kerberos credentials available'

We have a working FreeIPA installation, it's in production since February. Almost everything works as expected but when we try to run command-line FreeIPA-related tools none of them work: [admin@ipa ...
1
vote
0answers
26 views

kinit error: Realm not local to KDC, DC is in a subdomain

I have a user: oneuser@EXEMPLE.COM as principal and the next krb5.conf: [libdefaults] default_realm = EXEMPLE.COM default_tkt_enctypes = arcfour-hmac-md5 default_tgs_enctypes = ...
1
vote
1answer
153 views

Can't change password of FreeIPA admin - “Current password's minimum life has not expired”

We have a FreeIPA-based system, admin's password has expired and needs to be changed but the standard password changing procedure over SSH fails: sashka@cellar ~ ssh admin@ipa.xxxxxxxxxx.com ...
2
votes
0answers
44 views

Kerberos, .k5login and sudo

Background: I am using a Debian 7 system which I have integrated with an LDAP+Kerberos system using libnss-ldap, libpam-krb5 and nscd. I have modified sudoers to permit an LDAP group the right to sudo ...
2
votes
1answer
120 views

MSSQLSvc Service Principal Names, Kerberos, and NTLM

Was recently helping a DBA with an issue that appeared to be related to an invalid SPN. Discovered that a good number of SQL service accounts simply don't have an SPN set, resulting in NTLM ...
1
vote
2answers
199 views

nfs4 and kerberos: Wrong principal in request

My client/servers are both running Ubuntu 14.04 and kerberos user authentication works as intended. regular nfs4 mounts also work fine. All machines are running heimdal libraries. I haven't been able ...
3
votes
1answer
43 views

SSH authentication mode selection

I am trying to figure out the SSH mechanism used while I try to ssh onto a production host. I see that the SSH client can choose among the available modes. But I'm not sure which mode is chosen and ...
1
vote
2answers
186 views

Kerberized nfs4 mounts ERROR: No credentials found for connection to server

My client/servers are both running ubuntu 14.04 and kerberos user authentication works as intended. regular nfs4 mounts also work fine. All machines are running heimdal libraries. I haven't been able ...
2
votes
2answers
62 views

NFS client keytab: multiple machines

How should one go about setting up client-side keytab files for each client machine to access network services? My working example is NFSv4, which requires each client to have a Kerberos keytab ...
0
votes
0answers
60 views

bugzilla authenticate with kerberos + ldap + SSO

I want to set up bugzilla with SSO, i cannot find any good documentation on how to do this. I have managed to set up ldap login which works fine. now I have set up kerberos on apache which works fine, ...
3
votes
2answers
222 views

Why should I not run setspn.exe on the domain controller?

I found several references (see below) on blogs that the setspn.exe utility should be run from either a client or server machine in the domain, but not from the domain controller itself. ...
2
votes
1answer
201 views

Retreive the current Kerberos KVNO from Active Directory

I have a Kerberos problem with a Linux host connecting to a Windows KDC. I suspect that Kerberos key with the wrong version is to blame. One way to be shure would be to delete the SPN and create it ...
0
votes
1answer
73 views

Clustered instance - kerberos double hop woes

We've recently migrated our virtualised SQL databases to a bare metal solution in an active/active cluster. Everything is working great except SQL Reports. Ok, so a rundown of our setup here as it ...
1
vote
0answers
19 views

Kerberos credentials cache dates reported differently in Debian Squeeze and Debian Wheezy

I have two Debian servers which use same LDAP/Kerberos server, but dates in output of klist on them shown in different format - mm/dd/yyyy on squeeze vs dd/mm/yy on wheezy. Looks like they just use ...
4
votes
1answer
753 views

How to integrate Active Directory with FreeBSD 10.0 using security/sssd?

What are the required steps to authenticate users from an Active Directory running on Windows Server 2012 R2 in FreeBSD 10.0 using sssd with the AD backend with Kerberos TGT working?
4
votes
1answer
200 views

How to remotely generate Windows AD Kerberos keytab from a Unix machine?

I would like to know if it’s possible to create a keytab file direct from a client machine without using the ktpass utility in the Windows Server side. The main reason I would want this, is to ...
1
vote
1answer
49 views

Have Kerberos use AD groups instead of netgroups

Currently we are able to have kerberos authenticate users who are in active directory (AD) and added to ldap created netgroups. We also set their unix attributes and add them to the netgroup. IT ...
0
votes
0answers
53 views

NFS4 and NFS3 mount proble with sec=krb5

I am having a problem when mounting the NFS server share using sec=krb5 The error is WARNING: Failed to create krb5 context for user with uid 0 for server YYY WARNING: Failed to create machine krb5 ...
3
votes
1answer
173 views

“net ads join” fails in puppet exec but runs OK directly from command line

I have the following exec that joins a Linux (CentOS 6) host to an Active Directory domain. When run as root from the bash terminal, it runs successfully and the host is joined to the AD domain ...
6
votes
2answers
446 views

NetApp erroring with: STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT

Since a sitewide upgrade to Windows 7 on desktop, I've started having a problem with virus checking. Specifically - when doing a rename operation on a (filer hosted) CIFS share. The virus checker ...
2
votes
1answer
327 views

Why is MS SQL Server Using NTLM Authentication?

Windows Server 2008 R2. SQL Server 2008 R2 installed. MSSQL Service runs as Local System. Server FQDN is SQL01.domain.com. SQL01 is joined to an Active Directory domain named domain.com. The ...
4
votes
3answers
162 views

Multiple Realms and Multiple TGTs under MIT Kerberos for Windows

My local computer uses Windows 7 Pro and belongs to realm LR, managed by AD servers. I login to my computer while attached to that realm's network. I can view the TGT with MIT Kerberos for Windows ...
1
vote
0answers
114 views

Testing NTLM\kerberos against a public url

I am creating a java open source package that makes it easy to connect with httpclient 3.1 to resources that are protected by ntlm v1/v2 and kerberos. I need to test this tool against real world ...
0
votes
1answer
68 views

LAMP server kerberos config to authenticate against a read only Windows KDC in a dmz

Background: We have a number of AD networks (domains) that are connected through VPNs and have established AD trust relationships. We have an externally hosted web server and have configured ...
0
votes
2answers
346 views

Completely uninstall Kerberos on Ubuntu Server

I am experimenting with Kerberos and messed up the installation. I've tried editing the config files but have had no joy in resolving my problems which currently consist of not being able to ...
0
votes
1answer
137 views

cannot login to domain - kerberos issue?

We cannot login as domain admin on one server but can on others. When I looked at Active Directory, I can see that the computer object doesn't exist for the server we can't login to. There is, however ...
1
vote
0answers
78 views

Samba Authentication

I know it's going to seem like I haven't done the research here, because I have done it, and I know how many related questions and tutorials there are. I have read every tutorial I can find online for ...
1
vote
0answers
46 views

Why does MIT Kerberos kinit warn “Your passwod will expire” when your principal is what is about to expire?

While doing some experimenting I noticed that the MIT Kerberos version 5 "kinit" program will warn you when either your password is about to expire (within 7 days) or when your principal is about to ...
7
votes
1answer
90 views

Kerberos: Separating AS and TGS

In Kerberos, the Authentication Server (AS) and the Ticket Granting Server (TGS) are generally implemented on the same server. This machine is called the Key Distribution Center (KDC). Surely, it ...
2
votes
0answers
19 views

Keberos clock skrew, although the clocks are synchronized

We have an issue during a backup (run every night). This backup is managed by Veeam Backup&Replication : copy 7 virtual machines from one VMware ESXi host. This host is linked to a vCenter server. ...
1
vote
1answer
208 views

Windows Authentication KRB5KRB_AP_ERR_MODIFIED

Let me preface by saying, I've been on this issue for about a week and a half now and I can't figure it out. I think I'm close, but every time I've thought that so far, I was wrong. I've looked at ...
0
votes
0answers
42 views

Any other option than HTTPS + Basic auth for reverse proxied IIS site that uses double hop authentication to SQL server

We've been struggling for a while to get, what I had assumed would be a relatively common scenario to work and would appreciate any pointers. We have 2 x Windows 2012 Servers running IIS Server SQL ...
1
vote
0answers
330 views

Why is my OSX client having so much trouble connecting to our SMB server?

I'm asking this here because I think I'm more likely to find SMB/kerberos experts here than in Ask Different, which seems to be mostly related to OSX client issues. When I first connect to our SMB ...
2
votes
2answers
81 views

Integrated Windows Authentication not working on PC bound to AD network

Background: Web server running LAMP stack Web server has VPN tunnel to AD network at HQ Multiple AD networks around the globe with VPN tunnels and trust relationships to HQ network Kerberos ...
0
votes
0answers
15 views

Change apache config based on connecting OS

I'm looking for a way to add an "if statement" to an Apache httpd.conf file. I would like to know if it is possible to do something like this: -if OS is Linux- EnableKerberosAuth true ...