The tag has no wiki summary.

learn more… | top users | synonyms

5
votes
2answers
7k views

ActiveDirectory Kerberos keytab unusable from Linux

I am configuring Kerberos authentication for Alfresco CIFS protocol fully implemented in Java (JLAN project). That is not the first time, I used to set it up right in a single shot. In the same ...
3
votes
2answers
169 views

Why do kerberos HOWTOs specify to copy keytabs securely to the host? Is networked kadmin not secure?

Kerberos HOWTOs often have words similar to these: Securely transfer (via flash drive, disk, or encrypted connection) the keytab to the client host. Is logging in on the client host as root, ...
3
votes
4answers
5k views

error reading keytab file krb5.keytab

I've noticed these kerberos keytab error messages on both SLES 11.2 and CentOS 6.3: sshd[31442]: pam_krb5[31442]: error reading keytab 'FILE: / etc/ krb5. keytab' /etc/krb5.keytab does not exist on ...
2
votes
2answers
5k views

help using setspn and ktpass

I'm trying to set up the SPNs and create a keytab file for tomcat kerberos spnego Single sign on. the server running tomcat7 is ubuntu-ad1.wad.eng.hytrst.com the KDC is kerberos.wad.eng.hytrust.com ...
1
vote
1answer
572 views

What is the kerberos keytab file used for in UNIX/AD kerberos authentication?

I have proved that UNIX/AD Kerberos authentication works without the presence of a keytab file so I'd like to know whether I should worry about it (given I'll need an individual keytab for each server ...
1
vote
1answer
3k views

keytab auth against samba 4 DC: Client not found in Kerberos database while getting initial credentials

I set up a samba 4 active directory on ubuntu 14.04 following Samba AD DC HOWTO. In principle everything works well but I'm stuck in getting kerberos authentication running using SPNs for web ...
1
vote
1answer
2k views

Exporting user keytabs in MIT Kerberos

How can I export a Kerberos keytab with a given password, so I can use it to authenticate passwordlessly with MIT KfW, while still being able to authenticate with a password elsewhere? If it matters ...
1
vote
0answers
29 views

Cross-Realm trust verify failed with 'netdom' command

Question 1: Am having my ActiveDirectory in Windowsserver 2012 machine - its domain name is AD-DEMO.LOCAL Kerberos admin-server is in another Ubuntu machine - its realm KERBEROS.COM Added trust in ...
1
vote
1answer
205 views

problems creating a keytab file on win server

I am trying to create a keytab file. i see a warning WARNING: pType and account type do not match. This might cause problems. The command i use is ktpass -princ ...
1
vote
1answer
92 views

Is the Kerberos SPN FQDN significant to the server, or is the keytab enough?

I spend most of my time as a developer, so I'm not familiar with all the details... I have a service running on a linux host. I want to use Kerberos to transmit identity information to the service. ...
1
vote
1answer
155 views

Create kerberos keytab from AD file with more than one SPN

I need to create a Kerberos keytab file from Active Directory with three different SPNs. It's no problem to add different SPNs with setspn -a but when I try to create a keytab file with ktpass ...
1
vote
0answers
283 views

Creating keytab for computer account to decrypt packet capture

We are having an issue with our blackberry server (EWSTest fails at autodiscover lookup) and I am running a packet capture with Wireshark in an attempt to diagnose the issue. There is a conversation ...
0
votes
1answer
2k views

kerberos cifs multiuser mount from AD PDC

I'm trying to mount a cifs folder on a ubuntu server with multiuser support from a windows DC. I can get user kerberos tickets as root on the server and mount the directory with kerberos without any ...
0
votes
1answer
551 views

kerberos error when active-directory user connects to Solaris machine

I have configured two CentOS machines to authenticate via kerberos and LDAP to Windows Server 2008 R2 Active Directory. I am now trying to do the same to a Solaris 10u9 (without upgrades to Kerberos ...
0
votes
0answers
16 views

password ipa idm redhat change itself

I am new in Kerberos and I don't know why the password change itself I create another account but the problem persists after generating keytabe in IPA client the password of admin IPA idm redhat ...
0
votes
1answer
290 views

setting kerberos ktpass ktab all that JAAS

I have a couple of questions on Kerberos on Windows. I want to find out what the purpose of mapping a user to a service using ktpass is. For example I am on windows and I run ktpass like this: ...
0
votes
2answers
92 views

can't login after generating keytab file

I generated a keytab file with the following command: ktpass /out http-web.keytab /mapuser Administrator@my.domain.bar /princ HTTP/localhost:8080@my.domain.bar /pass * However, now I can't seem to ...
0
votes
1answer
433 views

Why does ktutil list show some clients, but kinit says client unknown?

When I run ktutil list, I get a list of several clients. However, when I run kinit for any of the listed clients, I always get client unknown. Any ideas?
0
votes
1answer
118 views

Sudden catastrophic failure of kerberos

I've been playing with my openAFS setup, and adding keys for the afs principle for kerberos. Now, suddenly, Kerberos has gone down (or something). Kadmin gives the following error: kadmin -p admin ...
0
votes
1answer
183 views

F5 authentication using kerberos keytab

Our network gear use tacplus for authentication and authorization. tac itself authenticates using kerberos. For one of the projects we need automated login to a F5 device using a script. Does anyone ...
-1
votes
2answers
50 views

How to find out domain name for Win 2k8 server

I'm following this blog post: http://blog.springsource.com/2009/09/28/spring-security-kerberos/ It says: For this to work, every web applications needs to be registered at the Kerberos server ...