Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...
2
votes
0answers
30 views
How to enable Kerberos Authentication Service auditing on 2008 server
I have a 2008-level Windows domain running 5 x 2008 (non-R2) DCs (it's on the roadmap to migrate to R2 or possibly 2012 in the next 9-12 months, but this project needs to be working first), and I need ...
0
votes
0answers
16 views
kerberos cifs multiuser mount from AD PDC
I'm trying to mount a cifs folder on a ubuntu server with multiuser support from a windows DC.
I can get user kerberos tickets as root on the server and mount the directory with kerberos without any ...
-2
votes
0answers
31 views
Which /etc/hosts is correct for kerberos & ldap? [closed]
While following the instructions on the tutorial at http://www.danbishop.org/2012/06/02/ubuntu-12-04-ultimate-server-guide/#part-1-dhcp-and-dns I am choosing to use BIND9 instead of dnsmasq since it ...
0
votes
0answers
12 views
Active Directory RealmFlags trust for delegation
I have a setup with a Samba4 AD server.
I want to mark my AD as trusted for delegation. So when logging in via putty to my linux server I want the kerberos ticket to be delegated. What I have now is ...
0
votes
0answers
17 views
Tips for troubleshooting 2008R2 GPO settings on 2008 servers
I have a 2008-level Windows domain running 5 x 2008 (non-R2) DCs (it's on the roadmap to migrate to R2 or possibly 2012 in the next 9-12 months, but this project needs to be working first), and I need ...
0
votes
1answer
26 views
Kerberos pre-authentication failed on nfs mount
I have the following nfs export:
/home/users 192.168.1.0/24(rw,sec=krb5p,no_subtree_check,nohide,async,anonuid=65534,anongid=65534)
When trying to mount that on a client I get:
client:/home # ...
0
votes
1answer
26 views
Troubleshooting NFS authentication problems
I am trying to mount a krb5p NFS export. For this I have followed these instructions.
Line in /etc/exports:
/home/users ...
0
votes
0answers
15 views
Cannot change Kerberos password with passwd
I setted it up a common kerberos authentication for my domain. After that , its working fine without any issues. But a user cannot change the passwordd using linux command. On analysis on this , I ...
0
votes
2answers
22 views
Kerberos with active directory from linux
I have windows stations and a linux server - and I would like to perform SSO using Windows-Kerberos (via Active Directory - the same one all users on the windows station use).
And so - I have ...
1
vote
2answers
51 views
2008 DC GPO - “Advanced Audit Policy Configuration” missing?
I'm trying to enable Kerberos Authentication auditing in a GPO for the purpose of sending auth events to an AD-integrated web filter appliance, and the instructions have me enable auditing of the ...
0
votes
1answer
44 views
Active Directory Kerberos issue KDC_ERR_S_PRINCIPAL_UNKNOWN
We are implementing a system where our clients are Windows XP and our server is Windows Server 2008 R2. Ours clients use DCOM to connect COM+ components in our Windows 2008 Server.
It works fine when ...
0
votes
0answers
13 views
Kerberos with AuthnProviderAlias
I was configuring some AuthnProviderAliases today and I want to add kerberos to it. The problem is that when I added kerberos apache wouldn't restart and I got the following error in my syslog:
...
1
vote
1answer
34 views
Bind DN entry missing in stash file - while initializing database for realm
I'm trying to run kerberos with ldap back-end on Centos 6.3
After creating Realm with:
kdb5_ldap_util -D "cn=admin,dc=example,dc=com" create -sscope sub -sf ...
0
votes
1answer
37 views
NFS + Kerberos: can regular users access mounted directory without Kerberos ticket (kinit)?
I had this issue, which turned out to be caused by lack of Kerberos ticket.
So the user can access NFS mount after doing kinit.
Is there any way to let users access NFS mounts without a need to ...
0
votes
1answer
25 views
NFS4 with Kerberos: DNS not enough, need entries in /etc/hosts (Why?)
I've had some hard time configuring NFS4 with Kerberos last time. Finally I made it but there are few things I do not fully understand yet.
One of them is: why DNS resolution of hostnames is not ...
0
votes
0answers
10 views
I need rpc.gssd to use the short hostname to kinit
I am trying to do a Kerberized NFS mount from CentOS 6.4. The problem is that the Kerberos backend is Active Directory and the UPN is the short hostname rather than the fqdn. I see that rpc.gssd ...
0
votes
1answer
55 views
Company Wide Windows Auth with Chrome and Firefox
I know that we can allow Firefox to allow passing through of Windows credentials by editing the following about:config settings
network.negotiate-auth.trusted-uris
...
1
vote
1answer
41 views
Dig Connection Error on SRV Records
Using Bind9 running on localhost.
I have two records in my DNS zone file:
_kerberos._udp.GROUP-42.SNOOPY.ISP IN SRV 0 0 88 kirby.group-42.snoopy.isp.
kirby.group-42.snoopy.isp. IN A ...
0
votes
1answer
26 views
How to list Samba 4 shares using server's IP and Kerberos authentication?
I am successfully able to list the Samba 4.0.3 shares by using
smbclient -L myhostname -k command.
However I am unable to do the same by using
smbclient -L 192.168.1.2 -k
and I get the session ...
0
votes
0answers
31 views
IIS: NTLM authentication works, Negotiate does not
We develop a web application that is installed on-site on customers' servers. In the past months, we've had a curious problem occurring every now and then. We also know how to workaround it, but I'm ...
1
vote
0answers
42 views
Kerberized SSH Failed
I want to authenticate ssh login with Kerberos, however fail. The following is a snippet of ssh debug information with the command ssh -vvv localhost.
debug3: Wrote 80 bytes for a total of 1125
...
0
votes
1answer
126 views
NFS4 + Kerberos: BAD_ENCRYPTION_TYPE, GSS: Encryption type not permitted, hang on “doing downcall”
I am trying to get NFS4 + Kerberos to work on Debian Squeeze.
I have 3 test machines: nfsserver, nfsclient, nfskerberos
What I've got is:
root@nfsclient:~# mount -v -t nfs4 -o sec=krb5 ...
2
votes
1answer
113 views
Active Directory: Thunderbird LDAP autocompletion not working with Kerberos auth
The Problem:
I'm trying to configure an LDAP mail autocompletion - a built-in functionality of Mozilla Thunderbird 17.0.5 @ Windows 7 x64 in 2008R2 domain environment. The OS is a fresh, ...
3
votes
0answers
206 views
Kerberos NFS4 permission denied
Update:
I realized that because of bad hosts file, both machines resolves their local names to 127.0.0.1 instead of their LAN IP Address. Once I changed it and tried to mount, the client shows:
...
0
votes
0answers
36 views
Centralized authentication for a mixed system (Linux, Windows) with existing OpendLdap,Active Directory and Keberos
I have a mixed system.
The linux users are authenticated using existing Active kerberos installed on a linux server and querying data in openldap.
On the other hand,Windows users are authenticated ...
0
votes
1answer
90 views
Multihop Kerberos delegation on IIS7 / Windows 2008
So here I am again dealing with probably the number one support question on IIS, SPNs. I am not a novice when it comes to this, having lived the pains of getting SSRS front ends to delegate for SQL ...
0
votes
0answers
24 views
Kerberos delegation on SQL cluster
Here's my setup.
A web server running ASP.NET web applications.
A SQL Clustered server, with 2 physical nodes.
Both of these are on the same domain.
The web server has been enabled for kerberos ...
1
vote
0answers
93 views
IIS7, Kerberos, sometimes no response from browser to 401
SharePoint 2010 hosted on IIS7, Kerberos enabled. Clients log on through Citrix on several terminal servers. Kerberos is working on several clients, so SPN's are defined correctly, but on some clients ...
0
votes
1answer
53 views
Lag between PAM password acceptance and session open on CentOS5
I have a very interesting situation. I have a server running CentOS5.5, and whenever I try to ssh in using any external interface, there is a 4+ second delay, consistently. There is no such delay ...
1
vote
1answer
89 views
What is the kerberos keytab file used for in UNIX/AD kerberos authentication?
I have proved that UNIX/AD Kerberos authentication works without the presence of a keytab file so I'd like to know whether I should worry about it (given I'll need an individual keytab for each server ...
0
votes
2answers
198 views
RDP in 2008 R2 domain no longer working - possible Kerberos issue
Everything was working fine and no changes were made. For no apparent reason, we can no longer RDP to any domain computers except for the domain controllers themselves. This includes Windows 7 clients ...
0
votes
0answers
36 views
CUPS Client hide print queues
Since it seems that getting Negotiate authentication is difficult/impossible to achieve with a local CUPS spooler on each client (see CUPS Negotiate authentication woes), I am now looking at an ...
1
vote
0answers
127 views
CUPS Negotiate authentication woes
I have been struggling to Kerberize certain services within our domain, one of which is CUPS. The setup is as follows: a central print server connects to each individual printer around the domain and ...
1
vote
1answer
20 views
How do I find out the current remaining lifetime of my AFS tokens?
I can use klog to renew my AFS token, but I am wondering whether there is an equivalent command to view the remaining lifetime of my AFS token.
2
votes
1answer
250 views
solved - SSH instant logout after ssh login kerberos / winbind
I set up a ubuntu server which is authenticating against the active directory of our W2k8 Domain. Everything went well and I see all the users in getent passwd, and wbinfo.
I want to be able to use ...
0
votes
1answer
85 views
Kerberos authentication for Git server?
I have a Git server, and I want to make it usable by all Kerberos-logged users.
eg: if a user has a valid Kerberos ticket, she can start pushing to Git without having to provide any ...
2
votes
2answers
270 views
Will kerberos work with CNAMEs if I have the SPN created for the A record as well?
We are currently setting up a SQL 2012 environment and it will be used for storing data that will be accessed by SSRS in sharepoint integrated mode. We will be using Kerberos for authentication.
...
1
vote
1answer
59 views
SSH + Kerberos but WITHOUT DNS
I was wondering if there's a way to set up SSH with Kerberos authentication without using a DNS server at all ?
1
vote
0answers
125 views
IIS, SQLServer, Google Chrome and Windows Authentication
I'm searching the internet for almost 4 days now and I'm stuck.
I've created a simple ASP MVC4 Intranet website and I have deployed it to server called: iis. That computer is inside the same domain ...
4
votes
3answers
192 views
SSH Kerberos authentication fails with “Wrong principal in request/Got no client credentials” on debian squeeze
I have a debian squeeze host where I can't log in with kerberos without a password prompt. An identically configured ubuntu 12.04 host works fine and can log in without getting a password prompt.
...
0
votes
1answer
182 views
Problems set-up Single Sign-On using Kerberos authentication
I need for Ruby on Rail application set authentication via Active Directory using Kerberos authentication.
Some technical information:
I are using Apache
installed mod_auth_kerb
In httpd.conf I ...
7
votes
3answers
181 views
Permissions are not taking effect with Kerberised NFSv4 on FreeBSD
I'm currently trying to set up an NFSv4 server on FreeBSD. I have extensive experience with doing this on other Unices (Solaris and Linux), but I'm fairly new to FreeBSD.
My goal is to achieve the ...
0
votes
0answers
64 views
GSS-SPNEGO with dovecot and Outlook without Samba
I am trying to configure a dovecot2 IMAP server to inter-operate with a active directory to authenticate users. The users should be able to login without a password on a domain-joined client(Outlook).
...
0
votes
0answers
78 views
OpenVPN + PAM + Keberos + AD + Domain shares
I would like to ask if someone the setup mentioned in the title already set up?
I have a domain with serval DC's, fileservers, etc. At the moment I set up the OpenVPN server as domain member and use ...
0
votes
0answers
51 views
EIM SSO Tickets via C#
We have setup EIM (Enterprise Identity Mapping) that maps Windows signons to IBM i signons. Is there a way of getting to the Target Mappings using a C# interface (or indeed I would like any working ...
0
votes
1answer
38 views
openafs over internet /afs/mycell connection timed out
I am trying to connect to my openafs-server from the internet.
kinit user; aklog
works, I get the ticket from the kerberos server and the token for afs.
As a measure of desperation I put the ...
0
votes
0answers
69 views
F5 authentication using kerberos keytab
Our network gear use tacplus for authentication and authorization. tac itself authenticates using kerberos. For one of the projects we need automated login to a F5 device using a script. Does anyone ...
0
votes
1answer
166 views
Get a user's kerberos ticket updated over VPN
We run a Windows 2008 network (2008 DC level). There are many users who work only from home and connect to the network via VPN.
Recently group membership was changed for many of these users and ...
0
votes
0answers
304 views
Samba 4 and NFS4 home directories
First of all, sorry for my poor english.
I have correctly installed Samba 4 on my Centos 6 server. Windows pcs join correctly the domain and users have their roaming profiles working good. In our ...
0
votes
1answer
118 views
Can't get postgres and kerberos (gss) working together
I am trying to get postgres and kerberos, via GSSAPI, working together. Having trouble at this point. It does not help that I am really a newbie for both technologies. I have both postgres and ...
