Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms

0
votes
0answers
17 views

Kerberos and SSH login

I've just configured a RHEL 7 for windows authentication (idmap_ad). Every check works but if i try to ssh with a domain user i get the error: Connection closed by ::1 Here follows the ssh log in ...
0
votes
2answers
19 views

IE HTTP Kerberos issues authenticating to site on FQDN not matching AD Domain

I have a site on a corporate domain that authenticates using Kerberos auto-login from IE and Chrome just fine, as long as the DNS being used to access it falls under the AD FQDN The AD domain is not ...
0
votes
1answer
27 views

kinit: Cannot contact any KDC for realm 'UBUNTU' while getting initial credentials

I am installing Kerberos5-1.12.1 on ubuntu machine by following the link: http://techpubs.spinlocksolutions.com/dklar/kerberos.html#krb-install Whenever i am trying to do : kinit user1 I am ...
0
votes
1answer
46 views

Unable to setup Kerberos on Ubuntu 14.04 - krb5kdc: No such file or directory - while initializing database for realm myrealm

I'm attempting to follow the guide on the Ubuntu wiki for installing and setting up Kerberos. I am running Ubuntu 14.04 (LTS) 64-bit. I have setup avahi-daemon in order to provide .local DNS names. I ...
1
vote
1answer
18 views

Is the Kerberos SPN FQDN significant to the server, or is the keytab enough?

I spend most of my time as a developer, so I'm not familiar with all the details... I have a service running on a linux host. I want to use Kerberos to transmit identity information to the service. ...
0
votes
1answer
23 views

Password reset is not working

I am using krb5 authentication to authenticate users in my machine. I am trying to change my password using passwd command but it failed. ~:$ passwd ~:$ Changing Password for bharathi ~:$ Kerberos 5 ...
0
votes
1answer
70 views

Issues with Kerberos trying to log on Samba 4 Active Directory Domain Controller from Windows

I'm trying to setup an Ubuntu Server with Samba 4 as Active Directory Domain Controller and I'm getting an error when I try to connect from a Windows machine. Here's Samba's log of the error (I've ...
0
votes
0answers
12 views

User under windows server AD access Linux server using kerberos

I installed AD on windows 2008 r2 sp1 server . And had configured all things follow the issue http://msdn.microsoft.com/en-us/library/ms995329.aspx ...
1
vote
1answer
151 views

FreeIPA: command-line tools do not work, 'No Kerberos credentials available'

We have a working FreeIPA installation, it's in production since February. Almost everything works as expected but when we try to run command-line FreeIPA-related tools none of them work: [admin@ipa ...
1
vote
0answers
17 views

kinit error: Realm not local to KDC, DC is in a subdomain

I have a user: oneuser@EXEMPLE.COM as principal and the next krb5.conf: [libdefaults] default_realm = EXEMPLE.COM default_tkt_enctypes = arcfour-hmac-md5 default_tgs_enctypes = ...
1
vote
1answer
87 views

Can't change password of FreeIPA admin - “Current password's minimum life has not expired”

We have a FreeIPA-based system, admin's password has expired and needs to be changed but the standard password changing procedure over SSH fails: sashka@cellar ~ ssh admin@ipa.xxxxxxxxxx.com ...
2
votes
0answers
28 views

Kerberos, .k5login and sudo

Background: I am using a Debian 7 system which I have integrated with an LDAP+Kerberos system using libnss-ldap, libpam-krb5 and nscd. I have modified sudoers to permit an LDAP group the right to sudo ...
2
votes
1answer
85 views

MSSQLSvc Service Principal Names, Kerberos, and NTLM

Was recently helping a DBA with an issue that appeared to be related to an invalid SPN. Discovered that a good number of SQL service accounts simply don't have an SPN set, resulting in NTLM ...
0
votes
0answers
41 views

Windows authentication and EWS Managed API [closed]

On our company intranet, I am trying to use the Windows Authentication Credentials of the user for EWS Managed API access to his mailbox. In IIS, the application is set to "Windows authentication" ...
1
vote
2answers
118 views

nfs4 and kerberos: Wrong principal in request

My client/servers are both running Ubuntu 14.04 and kerberos user authentication works as intended. regular nfs4 mounts also work fine. All machines are running heimdal libraries. I haven't been able ...
3
votes
1answer
38 views

SSH authentication mode selection

I am trying to figure out the SSH mechanism used while I try to ssh onto a production host. I see that the SSH client can choose among the available modes. But I'm not sure which mode is chosen and ...
1
vote
2answers
80 views

Kerberized nfs4 mounts ERROR: No credentials found for connection to server

My client/servers are both running ubuntu 14.04 and kerberos user authentication works as intended. regular nfs4 mounts also work fine. All machines are running heimdal libraries. I haven't been able ...
2
votes
2answers
42 views

NFS client keytab: multiple machines

How should one go about setting up client-side keytab files for each client machine to access network services? My working example is NFSv4, which requires each client to have a Kerberos keytab ...
0
votes
0answers
38 views

bugzilla authenticate with kerberos + ldap + SSO

I want to set up bugzilla with SSO, i cannot find any good documentation on how to do this. I have managed to set up ldap login which works fine. now I have set up kerberos on apache which works fine, ...
3
votes
2answers
136 views

Why should I not run setspn.exe on the domain controller?

I found several references (see below) on blogs that the setspn.exe utility should be run from either a client or server machine in the domain, but not from the domain controller itself. ...
2
votes
1answer
95 views

Retreive the current Kerberos KVNO from Active Directory

I have a Kerberos problem with a Linux host connecting to a Windows KDC. I suspect that Kerberos key with the wrong version is to blame. One way to be shure would be to delete the SPN and create it ...
0
votes
1answer
46 views

Clustered instance - kerberos double hop woes

We've recently migrated our virtualised SQL databases to a bare metal solution in an active/active cluster. Everything is working great except SQL Reports. Ok, so a rundown of our setup here as it ...
1
vote
0answers
16 views

Kerberos credentials cache dates reported differently in Debian Squeeze and Debian Wheezy

I have two Debian servers which use same LDAP/Kerberos server, but dates in output of klist on them shown in different format - mm/dd/yyyy on squeeze vs dd/mm/yy on wheezy. Looks like they just use ...
4
votes
1answer
387 views

How to integrate Active Directory with FreeBSD 10.0 using security/sssd?

What are the required steps to authenticate users from an Active Directory running on Windows Server 2012 R2 in FreeBSD 10.0 using sssd with the AD backend with Kerberos TGT working?
4
votes
1answer
91 views

How to remotely generate Windows AD Kerberos keytab from a Unix machine?

I would like to know if it’s possible to create a keytab file direct from a client machine without using the ktpass utility in the Windows Server side. The main reason I would want this, is to ...
1
vote
1answer
37 views

Have Kerberos use AD groups instead of netgroups

Currently we are able to have kerberos authenticate users who are in active directory (AD) and added to ldap created netgroups. We also set their unix attributes and add them to the netgroup. IT ...
0
votes
0answers
38 views

NFS4 and NFS3 mount proble with sec=krb5

I am having a problem when mounting the NFS server share using sec=krb5 The error is WARNING: Failed to create krb5 context for user with uid 0 for server YYY WARNING: Failed to create machine krb5 ...
3
votes
1answer
94 views

“net ads join” fails in puppet exec but runs OK directly from command line

I have the following exec that joins a Linux (CentOS 6) host to an Active Directory domain. When run as root from the bash terminal, it runs successfully and the host is joined to the AD domain ...
5
votes
2answers
258 views

NetApp erroring with: STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT

Since a sitewide upgrade to Windows 7 on desktop, I've started having a problem with virus checking. Specifically - when doing a rename operation on a (filer hosted) CIFS share. The virus checker ...
2
votes
1answer
179 views

Why is MS SQL Server Using NTLM Authentication?

Windows Server 2008 R2. SQL Server 2008 R2 installed. MSSQL Service runs as Local System. Server FQDN is SQL01.domain.com. SQL01 is joined to an Active Directory domain named domain.com. The ...
4
votes
3answers
98 views

Multiple Realms and Multiple TGTs under MIT Kerberos for Windows

My local computer uses Windows 7 Pro and belongs to realm LR, managed by AD servers. I login to my computer while attached to that realm's network. I can view the TGT with MIT Kerberos for Windows ...
1
vote
0answers
70 views

Testing NTLM\kerberos against a public url

I am creating a java open source package that makes it easy to connect with httpclient 3.1 to resources that are protected by ntlm v1/v2 and kerberos. I need to test this tool against real world ...
0
votes
1answer
50 views

LAMP server kerberos config to authenticate against a read only Windows KDC in a dmz

Background: We have a number of AD networks (domains) that are connected through VPNs and have established AD trust relationships. We have an externally hosted web server and have configured ...
0
votes
1answer
197 views

Completely uninstall Kerberos on Ubuntu Server

I am experimenting with Kerberos and messed up the installation. I've tried editing the config files but have had no joy in resolving my problems which currently consist of not being able to ...
0
votes
1answer
82 views

cannot login to domain - kerberos issue?

We cannot login as domain admin on one server but can on others. When I looked at Active Directory, I can see that the computer object doesn't exist for the server we can't login to. There is, however ...
1
vote
0answers
64 views

Samba Authentication

I know it's going to seem like I haven't done the research here, because I have done it, and I know how many related questions and tutorials there are. I have read every tutorial I can find online for ...
1
vote
0answers
37 views

Why does MIT Kerberos kinit warn “Your passwod will expire” when your principal is what is about to expire?

While doing some experimenting I noticed that the MIT Kerberos version 5 "kinit" program will warn you when either your password is about to expire (within 7 days) or when your principal is about to ...
7
votes
1answer
84 views

Kerberos: Separating AS and TGS

In Kerberos, the Authentication Server (AS) and the Ticket Granting Server (TGS) are generally implemented on the same server. This machine is called the Key Distribution Center (KDC). Surely, it ...
2
votes
0answers
17 views

Keberos clock skrew, although the clocks are synchronized

We have an issue during a backup (run every night). This backup is managed by Veeam Backup&Replication : copy 7 virtual machines from one VMware ESXi host. This host is linked to a vCenter server. ...
1
vote
1answer
162 views

Windows Authentication KRB5KRB_AP_ERR_MODIFIED

Let me preface by saying, I've been on this issue for about a week and a half now and I can't figure it out. I think I'm close, but every time I've thought that so far, I was wrong. I've looked at ...
0
votes
0answers
33 views

Any other option than HTTPS + Basic auth for reverse proxied IIS site that uses double hop authentication to SQL server

We've been struggling for a while to get, what I had assumed would be a relatively common scenario to work and would appreciate any pointers. We have 2 x Windows 2012 Servers running IIS Server SQL ...
1
vote
0answers
225 views

Why is my OSX client having so much trouble connecting to our SMB server?

I'm asking this here because I think I'm more likely to find SMB/kerberos experts here than in Ask Different, which seems to be mostly related to OSX client issues. When I first connect to our SMB ...
2
votes
2answers
73 views

Integrated Windows Authentication not working on PC bound to AD network

Background: Web server running LAMP stack Web server has VPN tunnel to AD network at HQ Multiple AD networks around the globe with VPN tunnels and trust relationships to HQ network Kerberos ...
0
votes
0answers
14 views

Change apache config based on connecting OS

I'm looking for a way to add an "if statement" to an Apache httpd.conf file. I would like to know if it is possible to do something like this: -if OS is Linux- EnableKerberosAuth true ...
0
votes
1answer
613 views

winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm

While looking for reasons why logging in to a samba machines joined to Active Directory is slow I have the strong impression that the following error in my log file could be a hint. Apr 3 14:44:14 ...
0
votes
1answer
246 views

IIS / kerberos not prompting for credentials from Mac clients

I have an IIS server (Server 2008R2/IIS 7.5) configured for kerberos authentication. The kerberos authentication works from clients on Windows (IE and Opera both tested), but when I access the site ...
0
votes
1answer
86 views

IIS Credential Delegation for AppPool in Integrated Pipeline mode

I know there have been mkore than a dozen articles on this topic, but for some reason I have not been able to find a solution. Server WEB1 has IIS7.5 with a site using Windows Authentication (kernel ...
8
votes
2answers
401 views

Demoted domain controller still authenticating users

Why is a demoted domain controller still authenticating users? Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
0
votes
2answers
43 views

Configure MSSQL 2008 to use kerberos authentication

I would like to set my current mssql db (2008 and 2012) to authenticate using a linux kerberos server that I have in my environment . The windows station is in a workgroup and I would like to avoid ...
0
votes
0answers
140 views

How to enable kerberos authentication to a Java web app

I'm currently using Centrify to aid with Kerberos/AD integration in our environment. Right now we have Kerberos enabled on a Centrified version of Apache. We are trying to run jnlp files through ...