2
votes
2answers
40 views

NFS client keytab: multiple machines

How should one go about setting up client-side keytab files for each client machine to access network services? My working example is NFSv4, which requires each client to have a Kerberos keytab ...
3
votes
1answer
178 views

Does IIS NTLM/Kerberos authentication still work with an offline domain controller?

We have multiple IIS instances spread across remote regional branches. Each IIS instance (v.7.5) is running the same application and authenticates its users with Integrated Authentication (NTLM in the ...
0
votes
0answers
90 views

Is it possible to securely add an NFSv4 share to an ESXi Server?

I just wondered how to connect an NFSv4 share as storage extension to my ESXi. Since NFSv4 supports Kerberos, ESXi could use Username and Password to connect to the share, while no one else could ...
1
vote
1answer
125 views

Root access to kerberized NFSv4 host on Ubuntu

I have a kerberized NFSv4 setup working well under Ubuntu for regular users, but I cannot get it working for root. For most systems, I do not want to allow root access, but I have a couple servers ...
1
vote
1answer
89 views

Kerberos credential cache type “DIR:”

How do I set the MIT Kerberos 5 credential cache type to "DIR:"? See Release Notes at http://web.mit.edu/kerberos/krb5-1.10/ "Major changes in 1.10: Add the DIR credential cache type, which can hold ...
10
votes
2answers
2k views

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of ...
0
votes
1answer
1k views

How do I grant a user permission to use Hadoop via Kerberos?

I've setup Hadoop to use Kerberos (following the Cloudera security guide), but it is unclear how I connect to hadoop with regular users (e.g. username=myuser). Currently I have myself ...
0
votes
2answers
432 views

Mac OS X Server Secure Log full of failed SSH attempts

Whenever one of our server's admins tries to access our machine running Mac OS X Server 10.5 via SSH, I get the following error exactly every 10 seconds in the security log: sshd[32575]: ...
1
vote
2answers
761 views

Problem with testsaslauthd and kerberos5 (“saslauthd internal error”)

The error message “saslauthd internal error” seems like a catch-all for saslauthd, so I’m not sure if it’s a red herring, but here’s the brief description of my problem: This Kerberos command works ...
0
votes
1answer
113 views

kerberos security question

I don't know what the best practice for kerberos is with regards to security. I was wondering is it a good idea to allow a kerberos server to be public so public servers can use single-sign on or is ...
0
votes
2answers
172 views

kerberos instead of http over ssl

If I want to use kerberos instead of https (http over ssl) how do I make sure data is not tampered or read in the transit?
11
votes
2answers
2k views

The Story of secure user-authentication in squid

once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network: <the Internet> ...
1
vote
3answers
391 views

Why does Kerberos need Ticket Granting Server?

It's probably something fundamental but I can't find a certain statement. Why can't KDC authenticate then provide the service ticket directly. Is it about security or performance or some other thing? ...
4
votes
4answers
4k views

Authenticating Windows 7 against MIT Kerberos 5

I've been wracking my brains trying to get Windows 7 authenticating against a MIT Kerberos 5 Realm (which is running on an Arch Linux server). I've done the following on the server (aka dc1): ...
7
votes
3answers
4k views

Virus that tries to brute force attack Active Directory users (in alphabetical order)?

Users started complaining about slow network speed so I fired up Wireshark. Did some checking and found many PCs sending packets similar to the following: (screenshot) http://imgur.com/45VlI.png I ...
4
votes
1answer
3k views

Relative security of SAML vs Kerberos

Does anyone have any info/links on the relative security of SAML vs Kerberos. I believe I grasp the differences between the two, and what they mean for my particular application, but to decide ...
2
votes
1answer
570 views

Setting up sharepoint with kerberos authentication

I'm trying out sharepoint and I'm installed MOSS2007 trial version. I selected kerberos authentication method during install. It installed everything and when I try to go Central Administration site ...