Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

1
vote
0answers
10 views

Apache External access

I am wondering if anyone can help me. I am trying to setup SSO. I have it working inside a domain, where the kerberos ticket is passed and they sign on works and the user is able to login correctly. ...
1
vote
0answers
11 views

Clients can't update dNSHostName attribute after DNS suffix change

We have a bunch of Windows 7 and Windows Vista clients that belong to domain contoso.com. The clients are registered in DNS to client.contoso.com. We have changed the DNS suffix via GPO from ...
0
votes
0answers
18 views

Host verification with cross-realm kerberos auth and ssh

I have configured kerberos to cross-realm trust(MIT+AD) and here is what happens: When I do: kinit foo@MIT-REALM.COM ssh foo@krbservice Everything works fine. When I do: kinit bar@AD-REALM.COM ...
0
votes
0answers
13 views

What is GNOME doing at login that the console doesn't?

I have a series of lab machines running CentOS 7.2, authenticating via Kerberos and getting user data from NIS, then with home directories on NFS. When logging in, very often, the user puts in their ...
0
votes
0answers
10 views

Multi-factor auth with Kerberos and RADIUS

I am looking for a solution in order to allow a multi-factor authentication for a Kerberos-based logon service. By reading some articles, I found some good references about RADIUS, that provides a set ...
-1
votes
1answer
20 views

keytab file between Windows 2003 server Windows 2008 R2 [on hold]

My organization currently is migrating Windows 2003 server domain controllers to Windows 2008. The process may finish in next half year or so. Meanwhile we also want our Oracle database (on AIX 7.1) ...
1
vote
1answer
28 views

Determine usage of UPN for logon inside MS AD forest / domain

maybe somebody can give me a hint on this. I am evaluating the prerequisites for changing all (human) user's UPN in a large Microsoft AD environment to the recommended MS format (aligned with the ...
0
votes
0answers
26 views

kerberos authentication to linux from windows

We have mostly unix/linux server in our data center. We access them from our workstations running windows using putty. All the workstations are part of an AD domain but the servers are not. Kerberos ...
0
votes
1answer
41 views

sudo and Kerberos on AWS Linux issues

We have an issue on some of our AWS machines, running Amazon's hacked Fedora/RHEL linux where newer-in-AD users can login with password but cannot autheticate for sudo. Users that were created in AD ...
0
votes
0answers
6 views

How to keep a long-running process run with Kerbero and Andrew file system? [migrated]

I am running a bash script on a Scientific Linux server. The script has a loop for copying files and running some programs. The process for running the script probably takes a day or two. But I always ...
1
vote
0answers
98 views

Windows - Kerberos SSO from outside the domain

I've tried to figure it out myself, but to no avail. Google offers many tutorials but I couldn't find any for the below case. We have an external cooperating employee with VPN access to our LAN and ...
1
vote
1answer
67 views

Is LDAP used by Active Directory for anything if I only use Kerberos for authentication?

In my windows only domain, Kerberos is used for all authentication. The domain controllers I understand replicate & authenticate using RPC. Is LDAP used for anything else? Should I close the ...
6
votes
1answer
81 views

Is it possible to use Kerberos over TLS through sssd?

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with Kerberos and ...
4
votes
2answers
71 views

AWS Simple AD: “KDC has no support for encryption type” for users created with adtool, but not with MS Management Console

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with kerberos and ...
1
vote
0answers
32 views

How to add principals to a keytab when using realmd on CentOS

I joined a server to a MS Active Directory using realmd/sssd. I installed apache with mod_auth_kerb and created a keytab on a windows server. But, I need to add more SPNs to the keytab. I have tried ...
2
votes
1answer
30 views

SSH, Kerberos, AD: how / where to config /etc/pam.d/password-auth?

I have a CentOS 6 machine here and want to give SSH access for users from another forest, which is trusted. I got a temporary workaround, which is: 1) change content in /etc/pam.d/vncserver to auth ...
0
votes
0answers
20 views

Kerberos encryption unsupported type 23

I have to set up a automated file transfer from an application server to Hadoop fs using curl and Kerberos, I created the Kerberos keytab in the server hosting Hadoop successfully and the encryption ...
1
vote
0answers
21 views

Alot of Events “Kerberos authentication Ticket (TGT) was rejected”

Currently we are seeing a lot of Events "Kerberos authentication Ticket (TGT) was rejected" even for the accounts that are blocked. Also from the event logs, I see a username being used which does ...
0
votes
2answers
65 views

login with active directory users on debian jessy not working

I'm trying to get the login with active directory users working for nearly a week now. First of all, I'm pretty new to pam, samba, kerberos and winbind. We worked with local users and sudo before, but ...
0
votes
1answer
29 views

Grant Kerberos Ticket on successfull authentication against third party password store

I am currently building a system where I would like to deploy Kerberos. However my external constraints on the user management do not allow me to authenticate the users against Kerberos itself. I do ...
1
vote
1answer
54 views

Automatic Kerberos Ticket Renewal (Indefinitely)

I am currently switching our environment from NIS over to Kerberos + LDAP. During this migration I've now run into the following situation. We mount our homes via NFS which obviously should also be ...
0
votes
1answer
37 views

psql: duplicate GSS authentication request

What does it mean by saying 'duplicate' ? How to troubleshoot this? guest@www:~$ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: user/admin@SOHONET Valid starting Expires ...
0
votes
2answers
29 views

Issue authenticating to AD-joined Centos 7 server

Using this link, I have set up a server that is properly joined to an Active Directory server, but for some reason I can not authenticate to that server with a kerberos ticket on several test-users ...
0
votes
1answer
54 views

Single Sign On with multiple Identity Providers from PHP web app

I'm building a SAAS web app in PHP that needs to integrate SSO. We'll have multiple client organizations, each that have their own Identity Provider (Active Directory). While researching ...
1
vote
0answers
50 views

Websphere Application Server and Kerberos Keytab Renewal

I am currently running into an issue with Kerberos ticket expiration from a keytab on WAS 8.5.5.5. The same process works correctly on Tomcat 8, and I believe the primary difference is the JDK / JAAS ...
1
vote
2answers
131 views

kinit succeeded but ads_sasl_spnego_krb5_bind failed: SASL bind in progress

I'm trying to use fedora and samba as a file server. Using kerberos i'm trying to make sure no passwords are transmitted over my network. I'm able to use samba for its file server capabilities, ...
3
votes
3answers
47 views

Kerberos with OpenLDAP backend: Password Sync HowTo

The basic setup is an OpenLDAP server. The users are provisioned and the passwords are set. Now we decided to add an MIT KDC for being able to use Kerberos. We configured the MIT KDC to utilize the ...
3
votes
1answer
31 views

Kerberos authentication fails when local password is expired

I am using pam_krb5 with local accounts (Linux) for AD password authentication. Things are working great, users are able to authenticate with both AD and local passwords. I am having a problem ...
0
votes
1answer
28 views

Cache FreeIPA passwords to /etc/passwd

I have setup freeIPA/Kerberos authentication for my domain and it works well. I have a service that does not support server-based auth, only local auth via /etc/passwd. Is there a method to cache ...
1
vote
0answers
20 views

Kerberos - KDC and IIS on same machine

I have one domain controller which must act as Kerberos KDC and a IIS server running on that same domain controller. I need to set up an Integrated Windows Authentication where a domain user can ...
1
vote
2answers
140 views

Unable to join domain using samba tool net or realm/sssd

On a rhel7 server I am trying to join the server to a domain, but I am getting the following failure: net ads join -S domain.example.org -U name Enter name's password: Failed to join domain: failed ...
0
votes
0answers
15 views

Standalone VM on CentOS KDC Kerberos 5 Server autentication error

After installed and configured the kerberos 5 server on a CentOS 6.7 virtual machine. I tried to authenticate my principal admin and got this error below, I don't understand why the error as it looks ...
0
votes
1answer
53 views

Switch to Kerberos Authentication with Apache2 on Ubuntu (LDAP or AD)

I'm considering to switch my intranet apps to Kerberos authentication.(currently NTLM but modules required are not maintained anymore and will in not work anymore once the web server is updated to ...
0
votes
3answers
50 views

Squid kerberos authentication no popup

I configured squid to use kerberos authentication but when I'm trying to use proxy with browser i don't get popup in browser with ask for user and password - just access denied cos of no ...
0
votes
0answers
23 views

Apache Kerberos auth prompts user for password

I am trying to setup single-sign on against our Active Directory server for my Apache using the mod_auth_kerb module. I have the following configuration in Apache: AuthType Kerberos AuthName ...
0
votes
1answer
32 views

Windows AD single DC (degraded) - cannot modify Administrator limit exceeded

I had 2 DC's in my domain. one of them died, and the last one has all roles, dcdiag netdiag show all checked as "good" - but i actually can't modify my "Administrator" account. according to alot, ...
0
votes
1answer
36 views

Login in Active Directory Domain (Samba 4) and mount -t cifs on debian

I've configured Samba 4 with bind and kerberos to work as an Active Directory authentication server. I've also configured "home share" so I can login to any Windows machine in my Domain and work with ...
4
votes
0answers
30 views

Why is it common in the startup world for ssh keys to be used for authetication instead of kerberos? [closed]

My first few jobs as a linux admin had be working under some very senior admins. In all of these cases kerberos was setup for users to request a security token and gain access to company servers for ...
0
votes
1answer
25 views

Server 2008 R2 Replication Issue

I am trying to figure out why my Server 2 which is a domain controller is getting an error saying "Access Denied" when I am trying to access group policy management. I have checked and it is giving ...
1
vote
1answer
155 views

Error: KDC has no support for encryption type

I have intermittent authentication issues on my ubuntu 15.04 servers. Periodically, authentication will just stop working. Eventually it will start working again on its own. Or, if I restart both smbd ...
1
vote
0answers
74 views

Tomcat 8, Kerberos authentication

I'm configuring kerberos for a tomcat server. Before I call the web application support company I would like to know if I'm doing the correct steps since it's my first time. The domain has 2 zones, ...
2
votes
2answers
86 views

MaxTokenSize on Server 2012 R2 and Groups

I fixed an issue yesterday where a 2008 R2 machine did not want to communicate with the DC. I discovered warnings in the event log relating to the kerberos buffer, so I increased the size in the ...
0
votes
1answer
60 views

Cannot authenticate with Kerberos if both client and server on the same machine

I have a Tomcat webapp that supports Kerberos authentication. It works fine and I can log in to that app if I use a built-in account like LOCAL SYSTEM or NETWORK SERVICE, but I'm having problems with ...
-2
votes
1answer
75 views

How can I join a Windows Server 2008R2 server to a FreeIPA domain (LDAP/Kerberos)

In an infrastructure which consists of over 100 linux machines and only a single Windows Server (which will be replaced in two years with a linux server), it makes no sense to configure cross-forest ...
0
votes
0answers
199 views

HBase Kerberos SaslException: GSS initiate failed (Mechanism level: Failed to find any Kerberos tgt)

I am trying to set up Kerberos authentication for HBase using this http://hbase.apache.org/0.94/book/security.html documentation and have very little progress so far. HBase 1.1.1 from Apache without ...
3
votes
1answer
99 views

Proxy Kerberos Authentication - Kerberos Service Ticket Issues

I have a BlueCoat ProxySG that is able to authenticate users via Kerberos. It is set to "Proxy" so it requires user authentication for each new TCP connection. Users have a Single Sign On and their ...
1
vote
0answers
20 views

Dante with Kerberos configuration across sites

I have a requirement to host a socks proxy in a central location, using Dante. What I've been asked to do is connect remote clients to it across the internet, they'll pass through a gateway routing ...
0
votes
1answer
13 views

krb5 / ldap: realm name match with directory namingContext

In order to store krb5 principal entries on LDAP, is the LDAP naming context (root basename) required to match the realm name? principals of the realm HQ.EXAMPLE.ORG can be stored in the ...
-1
votes
1answer
84 views

Authenticate Samba share via Kerberos using Open Directory

I have an Open Directory master on a machine called "minime" (El Capitan, Server 5). I further have a Samba server "tricky", running Ubuntu and a Mac OS X client "wallace". I want users on wallace to ...
1
vote
1answer
103 views

MIT Kerberos with OpenLDAP backend - TLS ok when KDC started interactively but init script fails

In DNS domain domain.local. there are two machines host.domain.local. = 192.168.1.1 srv1.domain.local. = 192.168.1.2 host.domain.local. is KDC for Kerberos realm DOMAIN.LOCAL, srv1.domain.local. ...