0
votes
0answers
5 views

User under windows server AD access Linux server using kerberos

I installed AD on windows 2008 r2 sp1 server . And had configured all things follow the issue http://msdn.microsoft.com/en-us/library/ms995329.aspx ...
2
votes
2answers
36 views

NFS client keytab: multiple machines

How should one go about setting up client-side keytab files for each client machine to access network services? My working example is NFSv4, which requires each client to have a Kerberos keytab ...
2
votes
1answer
68 views

Retreive the current Kerberos KVNO from Active Directory

I have a Kerberos problem with a Linux host connecting to a Windows KDC. I suspect that Kerberos key with the wrong version is to blame. One way to be shure would be to delete the SPN and create it ...
1
vote
1answer
30 views

Have Kerberos use AD groups instead of netgroups

Currently we are able to have kerberos authenticate users who are in active directory (AD) and added to ldap created netgroups. We also set their unix attributes and add them to the netgroup. IT ...
3
votes
1answer
78 views

“net ads join” fails in puppet exec but runs OK directly from command line

I have the following exec that joins a Linux (CentOS 6) host to an Active Directory domain. When run as root from the bash terminal, it runs successfully and the host is joined to the AD domain ...
0
votes
0answers
14 views

Change apache config based on connecting OS

I'm looking for a way to add an "if statement" to an Apache httpd.conf file. I would like to know if it is possible to do something like this: -if OS is Linux- EnableKerberosAuth true ...
0
votes
0answers
115 views

How to enable kerberos authentication to a Java web app

I'm currently using Centrify to aid with Kerberos/AD integration in our environment. Right now we have Kerberos enabled on a Centrified version of Apache. We are trying to run jnlp files through ...
1
vote
1answer
60 views

Create kerberos keytab from AD file with more than one SPN

I need to create a Kerberos keytab file from Active Directory with three different SPNs. It's no problem to add different SPNs with setspn -a but when I try to create a keytab file with ktpass ...
0
votes
0answers
311 views

Change local password as root after configuring for MS-AD Kerberos+LDAP

I have followed this excelent post to configure Kerberos + LDAP: http://koo.fi/blog/2013/01/06/ubuntu-12-04-active-directory-authentication/ However, there are some local users used for services. When ...
0
votes
0answers
148 views

GSSAPI Error: Server not found in Kerberos database

I'm unable to make working a simple configuration written in Samba Wiki. NSLCD worked fine, when authentized by name and password. But I have no idea, what can I do wrong when following that simple ...
0
votes
1answer
38 views

DNS Portability with regards to LDAP/Kerberos

How portable is a DNS server when it comes to LDAP, especially Kerberos which I am using for authentication? Meaning, how much do I have to change to use the same LDAP server with 2 different DNS ...
0
votes
1answer
71 views

Tool to allow Kerberos Authenticated users to modify Firewall settings

I run a firewall on a central router. Recently, several users want to use Skype. Since firewalling Skype virtually means to switch the firewall off, I consider to allow users to temporarily punch ...
2
votes
2answers
970 views

Apache SSO through Kerberos using Machine Account

I'm attempting to get Apache on Ubuntu 12.04 to authenticate users via Kerberos SSO to a Windows 2008 Active Directory server. Here are a few things that make my situation different: I don't have ...
1
vote
1answer
261 views

Why can't cron access a CIFS share using Kerberos authentication?

I'm on CentOS 6.4. Using kstart I have a TGT kept active using the machine account (ie computername$) from Active Directory. The ticket cache is assigned to root and is located at /tmp/krb5cc_0. I ...
7
votes
3answers
376 views

Ubuntu 12.04, Windows 2012 Active Directory Integration, Kerberos won't resolve service principals

after having checked the whole internet literally, I hope that I might get help here. I am trying to accomplish integration of ubuntu 12.04 servers into a Windows 2012 active directory with nfs and ...
1
vote
1answer
71 views

krenew command not working : Permission Denied

I am using a Linux server to perform my simulations. The login and the file-system of the server are protected using kerberos. The file-system is supported using NFS. Since my simulations take a lot ...
1
vote
1answer
125 views

Root access to kerberized NFSv4 host on Ubuntu

I have a kerberized NFSv4 setup working well under Ubuntu for regular users, but I cannot get it working for root. For most systems, I do not want to allow root access, but I have a couple servers ...
0
votes
0answers
116 views

Splitting labs into subdomains without breaking Kerberos and Active Directory

So I have a vSphere environment with ever increasing pools of servers. Each pool/group of servers includes something like a firewall/proxy server, and two application servers (mixed environment, Linux ...
7
votes
1answer
834 views

IPA vs just LDAP for Linux boxes - looking for a comparison

There are few (~30) Linux (RHEL) boxes and I'm looking for centralized and easy managed solution, mostly for control user accounts. I'm familiar with LDAP, and I deployed a pilot of IPA ver2 from Red ...
5
votes
4answers
182 views

Locking a user's account locally when kerberos is enabled

I'm trying to set up Chef-managed accounts for a group of machines with the following characteristics: If there is no local account, login is blocked. If there is a local account with SSH keys, use ...
0
votes
1answer
773 views

kerberos cifs multiuser mount from AD PDC

I'm trying to mount a cifs folder on a ubuntu server with multiuser support from a windows DC. I can get user kerberos tickets as root on the server and mount the directory with kerberos without any ...
0
votes
1answer
134 views

Cannot change Kerberos password with passwd

I setted it up a common kerberos authentication for my domain. After that , its working fine without any issues. But a user cannot change the passwordd using linux command. On analysis on this , I ...
0
votes
2answers
69 views

Kerberos with active directory from linux

I have windows stations and a linux server - and I would like to perform SSO using Windows-Kerberos (via Active Directory - the same one all users on the windows station use). And so - I have ...
1
vote
1answer
418 views

Bind DN entry missing in stash file - while initializing database for realm

I'm trying to run kerberos with ldap back-end on Centos 6.3 After creating Realm with: kdb5_ldap_util -D "cn=admin,dc=example,dc=com" create -sscope sub -sf ...
1
vote
0answers
69 views

Kerberized SSH Failed

I want to authenticate ssh login with Kerberos, however fail. The following is a snippet of ssh debug information with the command ssh -vvv localhost. debug3: Wrote 80 bytes for a total of 1125 ...
6
votes
0answers
1k views

Kerberos NFS4 permission denied [closed]

** Edit: ** I am not using Sabayon Linux anymore and this problem didn't occur on other distributions. I suggest to close this question. Update: I realized that because of bad hosts file, both ...
1
vote
1answer
34 views

How do I find out the current remaining lifetime of my AFS tokens?

I can use klog to renew my AFS token, but I am wondering whether there is an equivalent command to view the remaining lifetime of my AFS token.
5
votes
3answers
927 views

SSH Kerberos authentication fails with “Wrong principal in request/Got no client credentials” on debian squeeze

I have a debian squeeze host where I can't log in with kerberos without a password prompt. An identically configured ubuntu 12.04 host works fine and can log in without getting a password prompt. ...
1
vote
1answer
588 views

Linux Client Active Directory Authentication stops working when failover

I have an issue with Linux clients trying to AD authentication by targeting a DNS name (corp.example.com). I have 2 Domain Controller servers DC1(10.0.0.3/24), DC2(10.1.0.3/24) both domain controllers ...
1
vote
1answer
89 views

Kerberos credential cache type “DIR:”

How do I set the MIT Kerberos 5 credential cache type to "DIR:"? See Release Notes at http://web.mit.edu/kerberos/krb5-1.10/ "Major changes in 1.10: Add the DIR credential cache type, which can hold ...
0
votes
1answer
98 views

Kerberos: Running an app with a parameter using krenew

I need to run an application with krenew, but the application also needs to receive a parameter via command line and I need to send its output to a file. From the documentation, it looks like this ...
0
votes
1answer
37 views

Configuring “compat” mode for users in Linux OL5x

I wish to enable the "compat" mode for users using the /etc/passwd approach in my Linux OEL5x server. But I am not really sure how "compat" works in linux. I have made the following configurations- ...
3
votes
5answers
4k views

error reading keytab file krb5.keytab

I've noticed these kerberos keytab error messages on both SLES 11.2 and CentOS 6.3: sshd[31442]: pam_krb5[31442]: error reading keytab 'FILE: / etc/ krb5. keytab' /etc/krb5.keytab does not exist on ...
1
vote
0answers
467 views

Firefox proxy authentication with Kerberos: one service ticket per connection (Linux)

I am trying to enable proxy authentication via Kerberos for Firefox. The setup is: Active Directory domain (for LDAP and Kerberos; this works and I can log in the computer and get Kerberos tickets ...
1
vote
2answers
1k views

How to automate kinit process to obtain TGT for Kerberos?

I'm currently writing a puppet module to automate the process of joining RHEL servers to an AD domain, with support for Kerberos. Currently I have problems with automatically obtain and cache ...
0
votes
1answer
76 views

Accessing Kerberised NFS server from daemons on specific client servers

I have an NFS tree exported from a file server that is secured using Kerberos and uses LDAP for authentication and uid/gid management. Everything works swimmingly for each client machine and each ...
2
votes
1answer
348 views

Adding local users / passwords on Kerberized Linux box

Right now if I try to add a non-system user not in the university's Kerberos realm I am prompted for a Kerberos password anyway. Obviously there is no password to be entered, so I just press enter and ...
0
votes
1answer
237 views

How to change a Kerberos password on Fedora

How do you forcefully change a user's Kerberos password in Fedora? The only docs I could find mention kpasswd <username>, but this requires the user's current password, which the admin probably ...
3
votes
2answers
3k views

Integrated Windows Authentication with Apache HTTP Server on Linux

What is the best way to enable Integrated Windows Authentication for a PHP web application running on Apache2/Linux? There is a Windows Domain Controller in the network which should be used for ...
0
votes
4answers
2k views

How to determine the Kerberos realm from an LDAP directory?

I have two Kerberos realms I can authenticate against. One of them I can control, and the other one is external from my point of view. I also have an internal user database in LDAP. Let's say the ...
9
votes
3answers
1k views

How to deny access to disabled AD accounts via kerberos in pam_krb5?

I have a working AD/Linux/LDAP/KRB5 directory and authentication setup, with one small problem. When an account is disabled, SSH publickey authentication still allows user login. It's clear that ...
3
votes
1answer
445 views

Does an NFS export with sec=krb5 *require* that the parent directory also be exported with sec=krb5?

I copied somebody's NFS server/client setup verbatim and am having trouble making sense of what's going on with it. This is the /etc/exports: /export ...
3
votes
1answer
2k views

Troubles with sssd and Active Directory Integration

I have Debian Squeeze and sssd installed. When I try to login to server by user 'alexwinner' by ssh I see in the log: (Fri May 11 18:56:03 2012) [[sssd[krb5_child[26281]]]] [get_and_save_tgt] (1): ...
5
votes
2answers
5k views

ActiveDirectory Kerberos keytab unusable from Linux

I am configuring Kerberos authentication for Alfresco CIFS protocol fully implemented in Java (JLAN project). That is not the first time, I used to set it up right in a single shot. In the same ...
0
votes
3answers
238 views

SSO for linux/AD Windows 2008

I have multiple CENTOS servers that are all currently working off of a local /etc/passwd for user account control and have local home folders etc. This makes it a pain when users come on board leave ...
0
votes
1answer
327 views

Unable to install Kerberos libriaries using $ rpm -ivf krb5-libs-1.8.4-3.fc14.x86_64.rpm

My Linux version is as follows:Red Hat Enterprise Linux Server release 5.5 (Tikanga) My rpm version is 4.4.2.3 when I am trying ti run uname -a ,the output i sas follows: Linux ...
1
vote
2answers
237 views

Kerberos LDAP and Ubuntu Login

I setup Kerberos and LDAP for directory management at an institution for Ubuntu OS. I got LDAP configured correctly and Kerberos. The user's home directory is in an LDAP directory. When the user ...
1
vote
1answer
348 views

Squid Authentication & streaming

I've got squid setup using Kerberos authentication. I'm also using squidguard as an URL redirector to block out the usual nastiness of the web. There are some sites though that we allow certain users ...
1
vote
0answers
406 views

Kerberos high availability failover, Apache Mod_auth_kerb, Using the Kerberos slave is slow

We host our own Redmine rails web application internally with Apache using Mod_auth_kerb and our internal Kerberos for authentication. We have 2 internal Kerberos servers KDC1 and KDC2. KDC1 is ...
8
votes
2answers
2k views

How does Kerberos work with SSH?

Suppose I have four computers, Laptop, Server1, Server2, Kerberos server: I log in using PuTTY or SSH from L to S1, giving my username / password From S1 I then SSH to S2. No password is needed as ...