Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

1
vote
0answers
9 views

Configure HTTP SPN for a domain user account on Windows Server 2012R2

I have a Windows 2012R2 Server and I would like to use Kerberos authentication with my IIS web applications. How do I set the SPN and map the users for HTTP and HTTPS services for a given use account ...
0
votes
1answer
8 views

nslcd and kerberos without Reverse DNS

I am trying to get nslcd to connect with an ldap instance using GSSAPI and kerberos authentication. Problem i'm having is that nslcd keeps using the wrong principal to try and connected with the ...
0
votes
1answer
11 views

Can Windows Authenticate Against ApacheDS?

ApacheDS claims to have support for ldap and Kerberos, so is it possible to authenticate Windows machines using it?
-1
votes
0answers
21 views

Ubuntu Samba 4 SSH [on hold]

I have a Samba 4 up and running as a (single) DC on my ubuntu 16.04 machine. (My setup is based on this and this tutorial) Now I'd like to allow the samba 4 users to authenticate on ssh with their ...
0
votes
0answers
8 views

FreeIPA fail to log in to Web UI on only one replication node

I run a FreeIPA cluster with 6 nodes I recently upgraded 4 of the nodes and encountered two issues. Couldn't run sudo commands as a user I was able to resolve this issue by clearing the SSSD ...
0
votes
1answer
13 views

How can extended file permissions (ACLs) be managed by Kerberos in Linux?

Is it possible to have extended file permissions (ACLs) in Linux be managed (enforced?) by adding permissions authenticated by Kerberos?
0
votes
1answer
11 views

How can I federate between two Kerberos realms?

I want to design my own micro services framework - API lifecycle mgmt, service discovery and security. Authentication surely must be encryption based but how do we go about federating across two ...
0
votes
0answers
24 views

How to connect to remote Kadmin KDC interface?

I have kerberos installed on my Windows Active Directory server however I cannot connect to KAdmin in UNIX. I'm able to create users and principals in Windows, export keytabs to remote linux servers ...
0
votes
0answers
4 views

Resources to Learn About Identity Federation and PKI / Kerberos [closed]

I am trying to comprehend/design my own micro services framework - API lifecycle mgmt, service discovery and security. Authentication surely must be encryption based but how do we go about federating ...
0
votes
0answers
19 views

WinRM Kerberos Authentication With Multiple Domain Controllers

I have configured a Rundeck instance on a Ubuntu host on AWS with the overthere-winrm plugin in order to execute scripts against Windows hosts. The instance is configured to access these hosts as an ...
0
votes
0answers
14 views

Setting NTAuthenticationProviders:negotiate at iis6 virtual directory level

My understanding is that in IIS6 I have to edit metabase.xml to be able to set the NTAuthenticationProviders value. I wish to set it to 'Negotiate' to use kerberos authentication. My non-production ...
0
votes
0answers
8 views

Error in krb5_recvauth: No such file or directory

Trying to propagate a slave dump file from a master KDC and it keeps on failing so I look at the log files to see what is up. In the krb5kdc.log file in the master this is the last two entries Jun 28 ...
1
vote
1answer
48 views

SELinux rules in CentOS 7 with Samba and SSSD on Kerberos Ticket generation

I've built a simple File Server with Samba and Netatalk running on CentOS 7.2. Everything is working as expected except for SELinux that's denying Samba to authenticate due to a policy of denying ...
0
votes
0answers
10 views

Need some clarification on Kerberos Constrained Delegation and SPN's

I can't seem to get a grip on what Kerberos Constrained Delegation and SPN's are... I've been reading up on IIS and these topics play a huge part when it comes to IIS. I've read about creating SPN's ...
0
votes
1answer
24 views

Apache authentication against FreeIPA's Kerberos

I'm currently trying to set up Apache as an authentication portal. It's supposed to act as a reverse proxy with krb authentication. My apache server is named portal.example.com (debian container) My ...
3
votes
2answers
48 views

Does Active Directory send a user's access token across the network?

Question: does AD send a user's access token across the network? Research: The following two passages contradict themselves--given that TGTs are transmitted across the network by design. From the ...
0
votes
0answers
16 views

Why is my sshd looking for a wrong kvno in keytab?

My FreeBSD box is using Heimdal Kerberos-implementation. It is registered with the corporate AD, its msDS-KeyVersionNumber-attribute is set to 2, and its keytab has the following entries: FILE:/etc/...
0
votes
0answers
27 views

kerberos - active directory domain trust - SSO only working for linux machines

I have an Active Directory Server (2008r2) and a MIT Kerberos Server. Between the realms "AD.EXAMPLE.COM" and "INTERN.EXAMPLE.COM" is a two-way transitive trust, set up on the windows-side with the ...
1
vote
1answer
21 views

FreeIPA AD Trust based Integration using SunLDAP to store Policies

If we want to use the FreeIPA Active Directory Trust Integration Option, can we use an existing implementation of SunLDAP to store the Policies (e.g. sudo, hbac etc.) Essentially we don't to create ...
0
votes
2answers
62 views

Can Foreman register a new host with Active Directory?

We use Foreman and Puppet to manage our Unix systems here, but the Kerberos infrastructure is implemented over Active Directory (because Exchange). Registering the newly bootsrapped hosts with AD is ...
2
votes
0answers
21 views

Kerberos Double Hop - SQL2014 HA - MSA's

OK, so i'm at my wits end. We have a system which works perfectly in our UAT environment (not HA) but will not work in live. so the config is: dns A record to iis box binding in iis on :80 to ...
0
votes
0answers
18 views

Kerberized NFS mount suddenly failing, permission denied errors

I'm trying to track down a bug with an NFS mount that seems to have appeared rather suddenly. Most of the time, if I try to ls /mnt, I get output that looks like this: ls: cannot access /mnt/dir1: ...
1
vote
2answers
36 views

Can a Unix host obtain Kerberos keytabs for another host from Active Directory?

We use Puppet to configure our servers, but creating Kerberos keytabs for them is currently a manual process. We would like the Kerberos keytabs of the Unix machines to be automatically generated, ...
0
votes
1answer
27 views

IIS 8.5, Kerberos and DFS Backend files

We have a new IIS app (8.5 on server 2012 R2).Some of the links on the site forward to files stored on a DFS (AD Integrated) share. The setup is : IIS 8.5 --> Two DFSN servers --> File server (all ...
0
votes
1answer
35 views

Calling an URL from a Windows Server 2012 + IE 11 fails with KRB_AP_ERR_MODIFIED error

My problem : Calling an URL from a Windows Server 2012 with IE 11 fails on a IIS Application (with Windows Authentication and Kerberos activated) : After 3 captures of the correct password, I get a ...
0
votes
0answers
23 views

kinit unable to connect

I'm trying to connect to a Kerberos running on ApacheDS. Here is the initial LDIF I've loaded on LDAP: dn: ou=Users,dc=example,dc=com ou: Users description: Example.Com Users objectClass: ...
5
votes
1answer
173 views

SSH works with expired Kerberos Password

I have setup SSH - single sign on using kerberos V5. When a user password has expired , it returns 'Warning: password has expired.' and allows the user to login! I even made changes in the /etc/pam.d/...
0
votes
1answer
114 views

kadmin can't find master key

I can't use the kadmin.local interface I just get the error Authenticating as principal root/admin@deadpool.cavill.org.uk with password. kadmin.local: Can not fetch master key (error: No such file or ...
0
votes
0answers
78 views

Windows 10 Client with Centos 7 Kerberos

All, I've created an OpenLDAP + Kerberos 5 authentication setup on my small test lab. All machines are communicating and working as expected with OpenLDAP + Kerberos. Now I need to test an ...
1
vote
0answers
74 views

gssproxy: apache httpd as nfs-client? centos7

When Apache httpd attempts to access a user directory automounted with sec=krb5p, and presumably other sec=krb options, gssproxy issues a failure message and the web server replies with 403 Forbidden. ...
3
votes
1answer
238 views

wbinfo -u does not show AD users (is empty)

We have a problem on a Ubuntu Server 14.04 (fileserver) connected to AD on a Windows Server 2008 R2 using Samba (version 4.3.8)/WinBind and Kerberos. The problem is that users do not have writing ...
0
votes
1answer
41 views

Forward service records from main DNS to IPA server

I have a production DNS server (dns1.local) in Data Center environment, I build recently IPA server (ipa.example.com) that runs DNS as well in the same environment and it forwards requests to dns1....
0
votes
1answer
42 views

Kerberos and LDAP login

I want to manually login to a ldap-server. For authentication Kerberos is used. I am registered there with username and pw. kinit username@servername It works fine and a valid TGT is created which ...
1
vote
2answers
55 views

Initialise Kerberos ticket on ssh login using PAM

Right, so I am struggling a bit with PAM in Centos7. I have no idea how to configure it manually and make the changes permanent so that I get a kerberos ticket after a successful ssh login. The ...
3
votes
2answers
171 views

creating an SPN from a linux build server

I'm setting up a process which would automatically create the SPNs for newly exposed service URLs. I am aware of how to create an SPN with Windows using the setspn -A command with the right priviliges....
4
votes
0answers
149 views

Questions about ktpass/kerberos with Active Directory

I got a few questions about Kerberos with Active Directory, specifically about the ktpass tool. The example AD I'm using (everything is on 2012R2 level): Active Directory Domain Name: ad.example....
0
votes
0answers
48 views

Kerberos-based SSH login requires local user account

I've recently set up a linux system (Debian-Jesse) which has joined an MS-Based Kerberos domain and been set up to allow Kerberos-based authentication for remote access. The only issue is, ...
-1
votes
1answer
115 views

Samba file server as domain member: error when joining domain

I would like to set up samba 4 to share a local directory, so that domain users are allowed to mount the directory. I don't want domain users to be able to log in the linux machine, they should only ...
0
votes
0answers
12 views

What changes with Kerberos Authentication in IPv6 when using NAT? [duplicate]

How should Kerberos Authentication be setup with IPv6? Of you're using NAT for IPv6 where there is a single public IPv6 address and it translates to the machines inside in the ULA range?
0
votes
1answer
29 views

What changes with Kerberos authentication in IPv6 when everyone has a public IPv6 Address?

How should Kerberos authentication be set up with IPv6? What implications are there when client devices each use a public, globally routeable IPv6 IP address? What changes when setup this way ...
0
votes
2answers
98 views

Build a production IPA server without integrate DNS and NTP with client

We are going to deploy a centralized authentication Linux server (RHEL6) for our RedHat/CentOS servers in Data Center environment. I made some search I believe Free IPA is the best choice since it's ...
3
votes
2answers
115 views

Are SPNs specific to Windows and Active Directory?

Are Service Principle Names specific to Active Directory on Windows? Or do they exist in Linux OpenLDAP / Kerberos KDC servers too?
0
votes
1answer
29 views

What kind of SPN is required to delegate client credentials to a SMB Share?

I'm trying to delegate KERBEROS authentication from an SQL Server to a file server over OLEDB. Is there a particular Service Principle Name that is used to delegate credentials from an SQL Server ...
6
votes
1answer
406 views

Joining AD domain with Windows 10 using smart card

My Windows "domain-centric" company has abruptly decided to make the switch from Windows 7 to Windows 10, and it has become my job to make their prepared image join our domain with our smart card/...
1
vote
0answers
39 views

Unspecified GSS failure. after setting up krb5/ldap authentication

new here, so I recently setup ldap/krb5 authentication on an centos7.2 vm. Krb5/ldap is working correclty as I can login using ldap user account. However, when I check the logs in the client machine /...
0
votes
0answers
30 views

Mounting NFS v4 on Linux with Username

I'm trying to mount a NFS v4 share on a Redhat Linux machine where the share is restricted to a particular user account. I have a kerberos ticket for the server and SSSD with LDAP used to populate ...
0
votes
0answers
32 views

Kerberos authentication failure with strange account name [closed]

Recently, I observed a lot of authentication failures(about 600 failures per day) coming from one of my company servers with account name "@@CyBAAAAUBQYAMHArBwUAMGAoBQZAQGA1B...."(about 150 characters ...
1
vote
0answers
52 views

Client to IIS to SQL Server Kerberos authentication

I would like to have a setup where my IIS web server sits on a different virtual server from where my SQL Server is installed, and Windows Authentication should be used for all connections. I am ...
0
votes
1answer
83 views

Apache not finding the kerberos principal in keytab file

Virtual host has been configured with these options; AuthType Kerberos AuthName "Kerberos Login" KrbMethodNegotiate On KrbMethodK5Passwd Off KrbAuthRealms EXAMPLE.COM KrbAuthoritative On ...
0
votes
0answers
66 views

SSO, Kerberos, multiple domains, multiple Linux servers

I have successfully implemented SSO for one production application running on Centos 6 + apache 2.2. connecting to Windows 2008 AD server. Users are coming from 2 different domains: a.com and b.net, ...