Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

0
votes
0answers
17 views

Kerberos constrained delegation using Citrix NetScaler

I'm currently evaluating Citrix NetScaler VPX (NS10.5 56.12.nc) as a potential replacement for Microsoft TMG server. Kerberos Constrained Delegation is at the top of my list of mandatory features. ...
0
votes
0answers
12 views

How to authenticate RHEL 6.6 to Windows Server 2012 Active Directory and LDAP? [duplicate]

Need help with setting up LDAP on Windows Server 2012 R2, I have AD setup already, but not sure what all I need to do to get LDAP running. Then I can't find any good resources online to authenticate ...
0
votes
0answers
9 views

What is the authentication flow when Exchange 2013 proxies to Exchange 2010?

Issue Outlook users, who are on LAN, and have an email address that is different from the UPN get prompted for authentication. Topology 1,000 clients connect to a central DAG & CAS array on ...
1
vote
0answers
28 views

permission for accessing files are denied and some sessions are killed [migrated]

I ssh to a Linux server which runs kerberos. This is the first time I met Kerberos. After some time of being idle or loging out and loging in, I found some strange things, which I am not sure if are ...
0
votes
1answer
31 views

Client not found in kerberos database while getting initial

I am installing Squid3 on Ubuntu 14.10 and I want to integrate it ADDS on windows server 2012 using kerberos 5. My infrastructure are as follows: Default Gateway: 192.168.1.1 DNS & Domain ...
0
votes
0answers
22 views

Integrate Squid Kerberos auth and Squidguard ldapusersearch into AD

I'm having trouble with Squid Kerberos auth and the Squidguard ldapusersearch that I use to apply ACLs by Active Directory groups membership. The problem is : Squid and Squidguard see my user as : ...
5
votes
3answers
134 views

Check Primary Authentication Protocol for Active Directory (NTLM or Kerberos?) [duplicate]

How can I check, from a client machine (in Global Group)(also is local admin), whether the domain controller is authenticating my login request to the domain using NTLM or Kerberos? I know that ...
0
votes
0answers
14 views

What are the implications of removing Negotiate as a Windows Authentication provider?

A single user of our internal website is getting the following message when using IE9 to access one of our internal websites hosted on IIS 7.5: 401 - Unauthorized: Access is denied due to invalid ...
2
votes
0answers
40 views

Kerberos KDC has no support for encryption type while getting credentials

I am configuring an apache/SSO authentication with an AD with Kerberos. My http server is a Debian Wheezy and the AD is a Windows Server 2012. I generated keytabs files on WS2012 with kpass command ...
-1
votes
0answers
46 views

Kerberos Active Directory Domain Failure (uBuntu)

I try to join Active Directory and Samba 4 in Ubuntu 12.04.05. When I run host -t SRV _kerberos._udp.test.sg I get the error: Host _kerberos._udp.test.sg not found: 3(NXDOMAIN) meanwhile $# host ...
0
votes
1answer
34 views

AWS EC2 Server can not access a fileshare over a VPC VPN using the machine name

I have a windows server on EC2 that is connected to my office via VPN. I'm having an issue connecting to file shares over the VPN. I'm able to connect if I use the IP address for example if I use ...
0
votes
0answers
47 views

Troubleshooting kerberos problems with Samba

I've run into an odd problem with Samba 3.6.23. Right now I have a Windows 2008 R2 machine that has trouble accessing shares on a domained Samba box. \\example_serv\my_share : Fails with LOGIN ...
0
votes
0answers
21 views

Mongodb + Kerberos BadValue SASL mechanism GSSAPI is not supported

I am trying to run an instance of mongodb with the authentication mechanism GSS-API. This is the command: mongod --dbpath /home/ec2-user/db/node2/data --auth --setParameter ...
0
votes
0answers
17 views

Error while integrating OpenLDAP and Kerberos

I am trying to set up Kerberos with OpenLDAP backend. I followed this doc http://web.mit.edu/Kerberos/www/krb5-1.12/doc/admin/conf_ldap.html and this ...
4
votes
2answers
2k views

March 10th Patch Tuesday appears to cause SQL Server client connection problems

Since applying the full set of patches on a Win 7.1 Pro desktop and a Windows 2012 R2 Datacenter Azure server running SQL 2014, SQL Management Studio (2008 and 2014 versions) won't connect to the SQL ...
0
votes
0answers
9 views

KCD and CIFS: strange behavior

I'm trying to use Kerberos Constrained Delegation in order to access to some CIFS folder, below the environment: DC is windows 2003 User "111" under OU "/aaa/users" User "222" under OU "/bbb/users" ...
3
votes
3answers
2k views

SQL Server Windows Authentication fails after tonight's security updates: The login is from an untrusted domain

We have the following setup: One Domain Controller (DC, Server 2003 R2 Standard x64) One SQL Server (SQL, Server 2008 R2 Standard x64) some clients. All machines are in the same domain. All user ...
0
votes
0answers
52 views

Samba AD DC Authentication Problems

I'm trying to setup an AD PDC using Samba4 on Ubuntu 14.04. My endgame here is to have an AD domain with users created by LDAP that can login to the domain and use roaming profiles, so that any users ...
0
votes
0answers
35 views

kprop: Client not found in Kerberos database while getting initial ticket

I tried to set up two kdc with Kerberos 5: a master and a slave. I followed the instructions from the official docs: http://web.mit.edu/kerberos/krb5-latest/doc/admin/install_kdc.html But ...
0
votes
0answers
32 views

Obtain krb ticket for another user

I have a system account in my domain (DOM\sys) and it has access to service cifs/server@DOM. I want to obtain a ticket for this service using my own account (DOM\user). In other words I need sudo-like ...
1
vote
1answer
49 views

Kerberos keytab permissions

Can you share some thoughts on whether a Kerberos keytab should be readable only by root - under all circumstances? Or are there exceptions to this rule? I am setting up a Squid proxy on Debian ...
1
vote
1answer
72 views

Ldap+kerberos authentication through AD

Is it possible to configure ldap+kerberos authentication on a linux machine without joining it to windows domain? I have to create a pool of VMs using RHEVM with a pretty short lifetime and I do not ...
0
votes
1answer
17 views

Slave Kerberos behind NAT - kprop fails: Incorrect net address while decoding database size from client

I want to synchronize MIT Kerberos database from master to slave, which is in a different geographical location. kprop synchronization fails because of a NAT. Is there any solution to have kprop ...
1
vote
1answer
62 views

Kerberos, Active Directory, and Linux/Unix Servers

I have done some research on the topic, but I can't quite find a straight answer to my question. Please tell me if my understanding is correct. Kerberos can be used as the bridge between a ...
1
vote
1answer
65 views

Ubuntu 14.04 Active Directory auth fails after static ip config

I'm having 6 Ubuntu 14.04 servers that are joined to active directory (2003 domain functional level 2008r2 schema) All of the servers work's fine when network interface is configured to use DHCP. But ...
0
votes
0answers
13 views

give serverprincipalname read write permissions to security group members

What are the settings for the group to make the following change? I need to create a group that can be used to grant: serviceprincipalname SELF Read serviceprincipalname SELF Write to its members. ...
0
votes
2answers
102 views

Authentication fails when using ARR to load balance Lync 2013 internal web services

I'm using Application Request Routing 3.0 on Windows Server 2012 R2 to load balance the internal web services on a Lync 2013 front-end pool; I'm not using it to reverse proxy the external web services ...
4
votes
1answer
39 views

At which point becomes a changed computer group membership active?

When adding a computer object to an AD group, at which point in time does the group membership become active? Is there some kind of kerberos refresh interval (similar to group policy refresh)? I ...
0
votes
1answer
30 views

Client not requesting Kerberos authentication

My client is not requesting Kerberos tickets, but does when using fiddler. I was then advised not to use fiddler and use Wireshark, using this I can see that the client is sending an NTLM ...
0
votes
0answers
40 views

Establish FAST encrypted channel between linux client and windows server

I am trying to setup windows server for FAST encrypted channel support to test OTP pre authentication in kerberos. I have already tested on linux machine by deploying KDC using krb5-1.12.1 source ...
0
votes
3answers
131 views

Alternatives to Kerberos for passwordless server access

I have a bunch of Linux servers and three Windows servers 2008 R2. I would need a solution which would enable passwordless SSH login from each of those servers to all others. I could do this by ...
0
votes
2answers
48 views

kadmin cannot list principals “requires list privileges”

I can authenticate fine via kadmin however cannot list principals? [root@server ~]# kadmin -p admin Authenticating as principal admin with password. Password for admin@org.domain.com: kadmin: ...
2
votes
1answer
122 views

Why is sshd engaging PAM still?

Background/Behavior is: if you ssh to box via and GSSAPI/Kerberos succeeds and you have a local user in /etc/passwd, you login fine per below PAM config. All Good there. But if you don't have a ...
0
votes
1answer
72 views

Setting up Secure Hadoop Cluster - Kerberos security

I setup a HDP 2.2 cluster successfully (1 NM, 3 DNs and 1 client). User accounts to access HDP cluster are created in client and checked these users can submit jobs, by SSH to client node and run ...
0
votes
1answer
145 views

[root@pcm-ipa-01 tmp]# klist klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0)freeipa kadmin admin principal not found

I have installed freeipa on centos and after restarting the service seems to have lost authentication for "kadmin" [root@pcm-ipa-01 ~]# kadmin init Authenticating as principal root/admin@MY.DOMAIN T ...
1
vote
0answers
50 views

JBoss SPNEGO Authentication Renewing Server Kerberos Tickets

We have successfully configured SPNEGO with our webapp on JBoss EAP 6.2, Windows Server 2008, and IE10 using JBoss Negotiation. What is best operational practice for renewing the ticket issued to ...
0
votes
0answers
11 views

Why does the server ID need to be sent in AS-REQ?

In the kerberos protocol, in the AS-REQ, you send your username and the server you want to use. The AS doesn't seem to use the server ID in the AS-REP, and in the TGS-REQ, the client sends the ...
0
votes
0answers
35 views

Kerberos and SQL server connection string

I am working on a project to migrate a legacy ASP program (NOT .NET!!) from W2k3 to W2K12 R2 (also from SQL server 2K -> 2K12). The ASP program file has a config for SQL server connection string which ...
1
vote
1answer
23 views

Password Delegation with Windows 2008 Server Trusts?

I have a trust setup between two Windows 2008 Active Directory forests. My domains are "local.ad" and "remote.ad". All of my corporate users belong to the remote.ad forest. I have to add the ...
1
vote
0answers
37 views

Kerberos Errors

Need help with the below error. I haven't been able to find much that has helped. Event Source: Security-Kerberos Event ID: 4 Qualifiers: 16384 Version: 0 Level: 2 Task: 0 Opcode: 0 Keywords: ...
0
votes
0answers
27 views

Reporting Services 2008 and kerberos delegation/impersonation

I've spent quite some time configuring the use of Kerberos and Windows 2008 SQL Reporting Services - I've registered all the SPNs, configured the various authentication options in the XML files and ...
0
votes
2answers
95 views

Windows Integrated Authentication with IIS Farm and subapplications

Assume the following site layout www.contoso.com - runs as CONTOSO\sitePool www.contoso.com/subSite1 - runs as CONTOSO\subPool1 www.contoso.com/subSite2 - runs as CONTOSO\subPool2 The pages should ...
1
vote
2answers
309 views

Possible to authenticate Samba via Kerberos but without domain-join?

With a Kerberos config file... [realms] DOMAIN.COM = { kdc = dc1.domain.com admin_server = dc1.domain.com } ...it is possible for Linux to talk to Active Directory for password ...
0
votes
2answers
84 views

Apache/mod_auth_gss authentication failure

Sorry if this is the wrong stackexchange site for this. Based upon the documentation (for reference I also used this blog post) I have this in httpd.conf: # Increase max size of HTTP request headers ...
2
votes
0answers
164 views

IIS 8.5 / Windows Authentication - 401 response on certain clients

We are running a Tomcat application behind a IIS 8.5 Windows Authentication Proxy, the redirect is via the tomcat AJP connector. We now have the problem that on certain clients, the authentication ...
1
vote
0answers
17 views

Kerberized root user on RHEL 5/6

I'm currently involved with getting NFSv4 and Kerberos. We've decided to bite the bullet and try and make the transition. Our environment is: Windows AD LDAP auth on Linux against said AD. ...
0
votes
0answers
110 views

kinit won't connect to samba4 domain controller, cannot resolve hostname

i have set up a domain controller on my virtual machine. At first i will post all important configs, so you know what works already. Hostname: affenhirn2 Domain Name: example.affenhirn2.local (i am ...
1
vote
0answers
19 views

Setting environment variables based on passing Require directive

I finally succeed on configuring Apache as a SPNEGO reverse proxy for my app, and I'm using the AUTHORIZE_SAMACCOUNTNAME, AUTHORIZE_CN and AUTHORIZE_MAIL to figure out some information about the ...
0
votes
0answers
49 views

Why does Hyper V differs in authentication methods for live-migration and replication

Hyper-V provides different authentication methods for replication and live migration (2012 R2 based). Live Migration is using CredSSP and Kerberos and replication Kerberos or PKI-based authentication. ...
1
vote
0answers
11 views

Kerberized NFSv4 share (deleted) after token expiry

I set up a NFSv4 server with Kerberos authentication and it runs well. However, some users stay logged in for long times such that they have to renew their tickets after some days. If during the time ...