Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

0
votes
0answers
14 views

Is it possible to configure different AuthType for directory and proxy in Apache?

I want to configure different AuthType for directory and proxy in Apache HTTPD server: https://httpd.apache.org/docs/2.2/mod/core.html#authtype I want to configure in directory Kerberos AuthType ...
1
vote
1answer
26 views

List all kerberized SPN's in Linux

Is there a way to list/show all SPN's in an kerberized AD using a Linux Client? In Windows one can use setspn -T <domain> -Q */* to get them. Is there something similar? Haven't found anything ...
-1
votes
0answers
9 views

Enable kerberos on windows server 2008

I have installed active directory domain services and DNS server on windows server 2008. Now How can I enable kerberos related services(KDC and AS) on server? So that I can start authentication using ...
0
votes
0answers
12 views

kerberos cross realm authentication

I want to do setup for kerberos cross realm service authentication using active directory. My question is that should I create a different domain (I read somewhere that realm is a domain) or should I ...
1
vote
1answer
40 views

Kerberos master server to slave server automation?

I've set up Kerberos in my workplace running on Centos 6 boxes, and successfully propagated the master server database to the slave and also set up a cron job to update it automatically every 5 ...
2
votes
1answer
11 views

how can I restrict kerberos service tickets by group?

I have multiple Linux servers all configured to allow kerberos authentication with active directory. All other user and group attributes reside in a separate directory server (389). I am able to log ...
1
vote
1answer
17 views

kadmind error - krb5_recvauth: start_seq_get is not supported in the HDBGET keytab type

I'm trying to migrate a heimdal KDC with an OpenLDAP backend from a Debian 5.x server (heimdal 1.2.dfsg.1-2.1) to a Ubuntu 14.04 server (heimdal 1.6~git20131207+dfsg-1ubuntu1.1), and am running into ...
0
votes
1answer
55 views

Using SSH Keys with Kerberos

So there's an issue that we've been having at our company causing me to pull my hair out for the past week: We have hundreds of server boxes (a mix of CentOS6/7, if it matters) that need to quickly ...
1
vote
1answer
44 views

Joining Linux host to Active Directory fails to update Microsoft DNS

I am joining Linux hosts (CentOS 6) to Active Directory using a special bind account. I've granted delegate permissions to this user and when I join on the default Computers OU, a computer object is ...
0
votes
0answers
24 views

'Kerberos Method' on Samba 3.0

When running sudo net ads join -U admin to add my domain to the realm, I get the error: Unknown parameter encountered: "kerberos method" I found out that kerberos method is not supported by Samba ...
0
votes
2answers
16 views

How can I audit Ip adresses of users logging into system?

I have a group of servers which use Kerberos for authentication. We distribute keytabs to users but want to ensure that a user never pass their keytab to someone else. Essentially we need to audit the ...
1
vote
1answer
18 views

Privileges when doing sudo to another domain user

Suppose I have a corporate domain mydomain using MS Active Directory. In the domain I have the users myuser and youruser. Now, on one specific Ubuntu machine mymachine, myuser has sudo rights, and ...
0
votes
0answers
8 views

Privileges when doing sudo to another domain user

Suppose I have a corporate domain mydomain using MS Active Directory. In the domain I have the users myuser and youruser. Now, on one specific Ubuntu machine mymachine, myuser has sudo rights, and ...
2
votes
1answer
37 views

Windows 7 versus 8 Access CNAME'd Share

Here's a situation that came up yesterday: we have a share on a machine we have to access using an alias (CNAME). The machine is running Windows Server 2012 R2, and services Windows 7 and 8 clients. ...
0
votes
0answers
52 views

kdm and ssh detecting different fully qualified domain name when using kerberos authentication

I'm attempting to setup Kerberos login support (Windows AD domain providing the kerberos) for Kubuntu 12.04 Linux workstations at the company I'm at. It's almost completely working but I can't get ...
1
vote
1answer
65 views

How to avoid frequent KVNO increases, when using Apache HTTPD with mod_auth_kerb talking to AD?

I've setup Apache HTTPD 2.4 with mod_auth_kerb, created a service account on Active Directory, added a SPN for my http hostname, created a keytab file on the linux machine, and had SSO start working ...
4
votes
0answers
86 views

Samba authentication and LDAP

I have an OpenLDAP server that I use for authentication and authorization for various services. All users are of object type inetOrgPerson and my groups are groupOfNames. Now I want to configure ...
1
vote
1answer
73 views

Ubuntu 14.04 Failing to join domain for Integration with Active Directory (winbind & samba)

I've followed the tutorial at this link https://help.ubuntu.com/community/ActiveDirectoryWinbindHowto Everything seems to be configured somewhat correctly, net rpc join worked and the realm is listed ...
1
vote
1answer
41 views

Active Directory: Permissions to get Kerberos Service Ticket

I have an Active Directory with a KDC running on Windows Server 2012. At the moment, every user can request service tickets for every service from the TGS. I'm looking for a solution where the KDC ...
0
votes
1answer
24 views

Does “Kerborised” NFSv4 securely protect against a malicious client spoofing the user

I have read conflicting statements about whether shares exported via NFSv4 with sec=krb5 are cryptographically protected against a malicious client mounting the share and then spoofing the user to ...
0
votes
2answers
83 views

Apache 2.2 mod_auth_kerb SSO stopped working

I'm all out of ideas why has it just stopped working, here's what I checked: httpd-error.log: [Thu Jun 11 18:04:21 2015] [debug] src/mod_auth_kerb.c(1758): [client 10.105.5.131] ...
3
votes
1answer
45 views

Windows client damage authorization header (Kerberos) => IIS 400 (Bad Request)

We are facing strange behavior on about 5% of Windows (7 Pro and XP Pro, both 32 and 64 bits) client computers. These computers gets randomly error from IIS server - 400 Bad request. We are using ...
1
vote
0answers
46 views

Changing login-formats for Linux and Active Directory

On CentOS, I run realm list and see login-formats: %U@mydomain.local I'd like to change login-formats: %U@mydomain.local to login-formats: %U How would I go about doing this? I'm assuming there is a ...
2
votes
1answer
103 views

Linux AD integration, unable to login when using Windows Server 2012 DC

I am trying to integrate my CentOS 6.6 servers into Active Directory. I've followed this guide from Red Hat using configuration 3 (SSSD/Kerberos/LDAP). When using a Windows Server 2008 R2 server as ...
4
votes
0answers
73 views

Windows Authentication to a Remote Server within an Intranet Environment

I have several servers (all on the same DC) within an Intranet environment at my company. For simplicity, I'll focus my question on the IIS and SQL Servers. I have an IIS 7.5 web server and a remote ...
0
votes
0answers
20 views

Kerberos PuTTY from non-domain machine via VPN

Feels like I'm missing something fundamental here... Have a non-domain machine (personal machine off site) from which I VPN into our work network. Once connected, from 'klist', it appears my VPN ...
0
votes
1answer
47 views

Kerberos SSO virtualhost different domain

I have a running centos6.6 server who authenticates against a windows 2008 AD with realm EXAMPLE.LOCAL. I have successfully configured an apache webserver for authentication through kerberos keytab ...
0
votes
0answers
47 views

Kerberos constrained delegation

There is a small problem with the setting Kerberos constrained delegation in Active Directory. The scheme works as follows: 1. Client workstation. 2. Web server with Windows 2008 Ent installed IIS ...
0
votes
1answer
51 views

SCOM: SQL Server cannot authenticate using Kerberos

For past few months, we are getting these kind of alert in SCOM stating SQL Server cannot authenticate using Kerberos. One thing to note here is that this alert is coming from only one server not ...
0
votes
1answer
67 views

Samba4 and Kerberos configuration on a dedicated server

I try to set up Samba 4 on a dedicated server from kimsufi.com but I have difficulties configuring Kerberos and Samba4. I am very confused about IP, Realm, Domain, NetBIOS, DNS etc. in Kerberos and ...
0
votes
1answer
27 views

unable to change environment variable using setenv()

I have an a member server with a windows PDC with active directory. Security=ads. I am trying to set an environment variable(credential cache) using C: setenv("CCACHE","cache_name",1); However, ...
0
votes
1answer
255 views

Security-Kerberos Error, event ID 4

I have two new Domain Controllers on new Forest. Servers have DFS and IIS services installed. Everything seemed to go Ok for a While. After updating servers I got new errors. Now once in hour ...
1
vote
1answer
69 views

Unable to join AD domain using Kerberos from kickstart

I am trying to join to the Windows domain in the %post chroot section of my kickstart script using kinit and net commands after setting up the samba, kerberos and sssd configurations in %pre. My ...
2
votes
2answers
174 views

OpenSSH two factor authentication combined with Kerberos / public key

I'm trying to implement two-factor authentication for OpenSSH. The environment is Centos 7 (kernel: 3.10.0-229.1.2.el7.x86_64) with OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013. We have Active ...
1
vote
0answers
36 views

Nagios Apache publishing

I am deploying a NagiosXI server (CentOS 6.6) and I would like to publish the site externally to allow team members to use the mobile app without the need for a VPN client. I have worked out the ...
1
vote
2answers
98 views

LDAP syncrepl with kerberos authentication

I'm trying to set up a replication server for LDAP using syncrepl. I would like to use Kerberos to authenticate the consumer, because we have it set up, and it seems more secure. The database ...
0
votes
0answers
23 views

Kerberos transitive trust and Auth to local

I need to connect users belonging to a realm to services that resides to another realm. These two realms are not trusted together, but realm A (where users are) is trusted by realm B. This one is ...
0
votes
1answer
197 views

Kerberos constrained delegation using Citrix NetScaler

I'm currently evaluating Citrix NetScaler VPX (NS10.5 56.12.nc) as a potential replacement for Microsoft TMG server. Kerberos Constrained Delegation is at the top of my list of mandatory features. ...
0
votes
0answers
14 views

How to authenticate RHEL 6.6 to Windows Server 2012 Active Directory and LDAP? [duplicate]

Need help with setting up LDAP on Windows Server 2012 R2, I have AD setup already, but not sure what all I need to do to get LDAP running. Then I can't find any good resources online to authenticate ...
0
votes
0answers
62 views

What is the authentication flow when Exchange 2013 proxies to Exchange 2010?

Issue Outlook users, who are on LAN, and have an email address that is different from the UPN get prompted for authentication. Topology 1,000 clients connect to a central DAG & CAS array on ...
0
votes
1answer
434 views

Client not found in kerberos database while getting initial

I am installing Squid3 on Ubuntu 14.10 and I want to integrate it ADDS on windows server 2012 using kerberos 5. My infrastructure are as follows: Default Gateway: 192.168.1.1 DNS & Domain ...
0
votes
1answer
116 views

Integrate Squid Kerberos auth and Squidguard ldapusersearch into AD

I'm having trouble with Squid Kerberos auth and the Squidguard ldapusersearch that I use to apply ACLs by Active Directory groups membership. The problem is : Squid and Squidguard see my user as : ...
5
votes
3answers
443 views

Check Primary Authentication Protocol for Active Directory (NTLM or Kerberos?) [duplicate]

How can I check, from a client machine (in Global Group)(also is local admin), whether the domain controller is authenticating my login request to the domain using NTLM or Kerberos? I know that ...
0
votes
0answers
30 views

What are the implications of removing Negotiate as a Windows Authentication provider?

A single user of our internal website is getting the following message when using IE9 to access one of our internal websites hosted on IIS 7.5: 401 - Unauthorized: Access is denied due to invalid ...
2
votes
0answers
135 views

Kerberos KDC has no support for encryption type while getting credentials

I am configuring an apache/SSO authentication with an AD with Kerberos. My http server is a Debian Wheezy and the AD is a Windows Server 2012. I generated keytabs files on WS2012 with kpass command ...
0
votes
1answer
70 views

AWS EC2 Server can not access a fileshare over a VPC VPN using the machine name

I have a windows server on EC2 that is connected to my office via VPN. I'm having an issue connecting to file shares over the VPN. I'm able to connect if I use the IP address for example if I use ...
0
votes
0answers
200 views

Troubleshooting kerberos problems with Samba

I've run into an odd problem with Samba 3.6.23. Right now I have a Windows 2008 R2 machine that has trouble accessing shares on a domained Samba box. \\example_serv\my_share : Fails with LOGIN ...
0
votes
1answer
82 views

Mongodb + Kerberos BadValue SASL mechanism GSSAPI is not supported

I am trying to run an instance of mongodb with the authentication mechanism GSS-API. This is the command: mongod --dbpath /home/ec2-user/db/node2/data --auth --setParameter ...
0
votes
0answers
39 views

Error while integrating OpenLDAP and Kerberos

I am trying to set up Kerberos with OpenLDAP backend. I followed this doc http://web.mit.edu/Kerberos/www/krb5-1.12/doc/admin/conf_ldap.html and this ...
4
votes
2answers
3k views

March 10th Patch Tuesday appears to cause SQL Server client connection problems

Since applying the full set of patches on a Win 7.1 Pro desktop and a Windows 2012 R2 Datacenter Azure server running SQL 2014, SQL Management Studio (2008 and 2014 versions) won't connect to the SQL ...