Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...
0
votes
0answers
255 views
pfsense squid kerberos authentication
Here it is:
pfsense squid 2.7 proxy server: 192.168.1.1
DC win2012srvstd: 192.168.1.2
client win7.
How do I configure Kerberos authentication in squid, so that when a user logs in the domain, he ...
0
votes
1answer
40 views
Meaning of Kerberos e-data field value
I'm using Kerberos on Windows (non-Windows software generates the token) and have been trying to debug a problem. In a network trace, I can see KRB5KRB_ERR_GENERIC is being returned by the IIS ...
2
votes
1answer
230 views
Kerberos authentication failing with 401
We have a .NET MVC 3 application deployed in IIS 7 on our Windows 2008 server (let's call it PROD). The application has Anonymous and Windows Authentication enabled - all others are disabled. The ...
0
votes
0answers
82 views
ksu: Unsupported key table format version number while verifying ticket for server
I'm trying to use ksu on a machine (client.domain.local), where I'm ve been authentized by Kerberos running on another machine, but I got an error:
Server not found in Kerberos database while getting ...
0
votes
1answer
45 views
How to make SSO work on remote machine
I'm fighting with SSO and SSH on Debian Wheezy. Locally it works fine. I'm getting ticket successfully at login. But when I've logged in to the remote machine by SSH without password, klist on the ...
1
vote
1answer
294 views
SSO with Apache and Kerberos issues
I am trying to set up SSO on my Apache web server using Kerberos so that users logged into the local domain are recognised and logged in immediately.
I have followed this guide to the letter but I ...
0
votes
1answer
63 views
Fedora 389 ds sasl mapping issue?
I have a fedora client that is authenticating to a centos server running 389 ds and kerberos
I can run kinit <my-user-principal> on the fedora client successfully and get a ticket, but no ...
0
votes
0answers
158 views
Configuring Kerberos authentication with fedora 389 server
I am trying to build out a DNS + kerberos + LDAP setup using centos and fedora for learning purposes.
I setup bind, 389 ds, and kdc services following red hat and 389 tutorials on my centos VM and I ...
0
votes
0answers
60 views
UPN suffixes and MIT Kerberos
I have a functionnal samba linked with AD, through an MIT kerberos. The KDC is the domain controller, and is a windows AD server.
There is one point not working. There are 2 UPN suffixes. One ...
0
votes
0answers
95 views
Powershell remote invoke on machine in separate domain?
I have a user on a Windows Server 2008 machine in domain exampleA.com that I would like to be able to invoke commands remotely using the current user's credentials on a Windows Server 2008 machine in ...
0
votes
0answers
93 views
Are there any GUIs for managing Kerberos principals on Enterprise Linux? [closed]
I've setup a KDC on CentOS 6.3 and I typically don't mind adding principals through kadmin as needed, but this is a task I'd like to delegate to another user who probably won't want to use any sort of ...
2
votes
3answers
262 views
Unified Authentication between Windows AD and Linux LDAP Server
Does anyone know of a solution that would allow me to do user account synchronization between Windows Active Directory and an LDAP Server hosted on a Linux Server? I'm currently looking at FreeIPA ...
1
vote
0answers
96 views
Mixing Redmine and custom authentication method in a single apache virtualhost for Redmine
I developed on Redmine a plugin to automatically log users using the REMOTE_USER given by Apache when its Kerberos ticket is accepted.
This plugin works as long as the user has a corporate login, but ...
1
vote
0answers
76 views
Winbind info shows local users that do not exist
I am setting up Samba on a Linux machine running CentOS 6 (called localhost, and the AD computer I am connecting to is dc.companyname.com), and I have done everything successfully, except when I type
...
2
votes
2answers
132 views
Is there a Kerberos testing tool?
I often use openssl s_client to test and debug SSL connections (to LDAPS or HTTPS services). It allows me to isolate the problem down to SSL, without anything getting in the way.
I want to do ...
0
votes
1answer
137 views
Default username format in Active Directory
Since Windows 2000 NTLM has been replaced with Kerberos. Thus Kerberos uses UPNs to identify the users. UPN is also the preferred usernaming format.
Now, why does Windows 7 still display a logged in ...
0
votes
1answer
78 views
Kerberos Authentication for workstations not on domain
I have a base understanding of how Kerberos works in an Active Directory environment and the methods it uses to authenticate users and workstations onto the network, but my question is.. since ...
0
votes
1answer
147 views
Mounting samba share authenticated by kerberos automatically through /etc/fstab
I have a samba server working and I can access the different shares with the command
smbclient -k //$server.$my_domain.$net/$my_share
I would like the mount to be automatically provided at boot ...
0
votes
0answers
72 views
Multi- authentication scenario for a public internet service using Kerberos [closed]
I have a public web server which has users coming from internet (via HTTPS) and from a corporate intranet.
I wish to use Kerberos authentication for the intranet users so that they would be ...
9
votes
1answer
207 views
Kerberos authentication, service host and access to KDC
I have a web application (hostname: service.domain.com) and I wish to use Kerberos authentication to identify users that are logged into a Windows domain. Microsoft AD (Windows Server 2008 R2) is ...
1
vote
1answer
189 views
Linux Client Active Directory Authentication stops working when failover
I have an issue with Linux clients trying to AD authentication by targeting a DNS name (corp.example.com). I have 2 Domain Controller servers DC1(10.0.0.3/24), DC2(10.1.0.3/24) both domain controllers ...
1
vote
0answers
1k views
Kerberos broken when upgrading Snow Leopard Server to Mountain Lion
I work for a small company where there's no dedicated system admin. I was tasked with upgrading our file and calendar server to 10.8, which I did by upgrading the OS then installing the server tools ...
1
vote
1answer
49 views
Kerberos credential cache type “DIR:”
How do I set the MIT Kerberos 5 credential cache type to "DIR:"?
See Release Notes at http://web.mit.edu/kerberos/krb5-1.10/
"Major changes in 1.10: Add the DIR credential cache type, which can hold ...
0
votes
1answer
52 views
Kerberos: Running an app with a parameter using krenew
I need to run an application with krenew, but the application also needs to receive a parameter via command line and I need to send its output to a file. From the documentation, it looks like this ...
1
vote
0answers
91 views
Kerberos: connection from win app running from IIS to SQL failed
I have an IIS web-application with Windows authentication and impersonation.
This application connects to SQL server.
In this case Kerberos works fine.
But there is a problem.
Web-application runs ...
1
vote
1answer
285 views
Cannot access shares via \\servername but \\ip works
To set up the scenario: One of our techs set one of the domain controllers to use Microsoft time. The time IS correct (including Time Zone) and DOES match the other domain controller's time; it was ...
0
votes
1answer
32 views
Configuring “compat” mode for users in Linux OL5x
I wish to enable the "compat" mode for users using the /etc/passwd approach in my Linux OEL5x server.
But I am not really sure how "compat" works in linux.
I have made the following configurations- ...
1
vote
0answers
216 views
heimdal kerberos in openldap issue
I think I posted this on the wrong 'sister site', so here it is.
I'm having a bit of trouble getting Kerberos (Heimdal version) to work nicely with OpenLDAP. The kerberos database is being stored in ...
2
votes
0answers
144 views
issue with heimdal kerberos in ldap backend
I'm having a bit of trouble getting Kerberos (Heimdal version) to work nicely with OpenLDAP. The kerberos database is being stored in LDAP itself. The KDC uses SASL EXTERNAL authentication as root to ...
5
votes
1answer
145 views
Risks of Kerberos Delegation
I've been spending hours upon hours trying to learn and understand Windows Authentication, Kerberos, SPNs, and Constrained Delegation in IIS 7.5. One thing I just don't get is why it is "risky" to ...
2
votes
2answers
1k views
error reading keytab file krb5.keytab
I've noticed these kerberos keytab error messages on both SLES 11.2 and CentOS 6.3:
sshd[31442]: pam_krb5[31442]: error reading keytab 'FILE: / etc/ krb5. keytab'
/etc/krb5.keytab does not exist on ...
0
votes
1answer
97 views
Updating delegated Kerberos credentials through SSH using GSSAPIRenewalForcesRekey
I've been investigating options for minimizing the amount of credentials that need to be retyped as credentials expire. One of the big problems I'm having now is dealing with delegated credentials, ...
4
votes
1answer
152 views
Kerberos issues after new server of same name joined to domain
Environment: Windows Server 2012, 2 Domain Controllers, 1 domain.
A server called Sharepoint1 was joined to the domain (running
Sharepoint 2013 using NTLM).
The fresh install for Sharepoint1 (OS and ...
1
vote
1answer
192 views
Can a Windows machine authenticate against Samba with Kerberos when users are stored in AD?
I understand the title is probably less clear that it should be, but I couldn't think of anything better.
We have two domains, let's call them example.com and subnet.example.com. The former is ...
2
votes
1answer
645 views
“KDC has no support for encryption type” when setting up cross-realm trust between MIT Kerberos and Active Directory
I am currently setting up an environment where I have a set of Solaris and Linux machines, using a dedicated Krberos 5 realm (MIT, on Solaris 11, krb5-config --version returns: Solaris Kerberos (based ...
1
vote
2answers
423 views
Using Apache / Kerberos / Keytab to Authenticate Redmine Users Against Active Directory
Please bare with me, as I am still fresh to these technologies.
We have a Debian (squeeze) server to which I have root access. It is running Apache, and Redmine is deployed to the server (currently ...
4
votes
0answers
197 views
What breaks in a Windows domain if a member has a high time skew? [closed]
It's taken for granted by most IT people that in a Windows domain, if a member server's clock is off by more than 5 minutes (or however many minutes you've configured it for) from that of its domain ...
0
votes
1answer
122 views
proxypass and mod_auth_kerb
We have a web application that is protected with mod_auth_kerb. This application works fine inside the LAN.
Now we would like to give access to users outside of the LAN to this application.
Is there ...
3
votes
1answer
1k views
Impact of increasing the MaxTokenSize for Kerberos Tickets
Recently by migrating form Netware to Windows file servers we have ended up creating a boat load of AD groups. We have now run in to some problems with authenticating and gaining access to resources. ...
0
votes
1answer
124 views
Authentication through mod_auth_kerb should provide website with no user if no TGT provided
Users are authenticated by mod_auth_kerb which works great. Therefore I need to set
Require valid-user
If there is no valid user Apache fails with an 401 Authorization Required. I would like ...
1
vote
1answer
268 views
Immediate logout after login with PAM, Kerberos, and LDAP
I've set up remote login on a computer using Kerberos and LDAP. I've also configured NFS to mount onto /home so that the user's home directory is the same wherever they login.
Kerberos authentication ...
2
votes
1answer
594 views
0x19 KDC_ERR_PREAUTH_REQUIRED in my event log
So I have a server, and every time a user or service account logs on to the machine, an error event is generated in the System log:
A Kerberos Error Message was received:
on logon session ...
2
votes
2answers
2k views
Setting up a Mac Mountain Lion NFS client to securely access Debian NFS server
Okay, I’m going just about insane here.
Trying to set up an OS X (10.8.2) NFS client to connect to Debian (6.0.6) nfs server. I’ve mostly been following instructions here: ...
0
votes
1answer
214 views
Kerberos with LDAP backend still using db2
I've installed and configured LDAP, installed and configured kerberos to use LDAP as the backend, as follows:
[dbdefaults]
ldap_kerberos_container_dn = dc=voltage,dc=com
[dbmodules]
...
0
votes
1answer
132 views
Does Windows 7 store domain account and password in SAM
If my machine has Windows 7 and connect to domain, what happens when domain controller is unavailable ?
How do I exactly log in when domain controller is unavailable ?
I mean normally it should use ...
0
votes
0answers
66 views
Lighttpd with Kerberos 5
I currently have Kerberos and the key distribution center set up on my Linux web server. Assigning tickets from the terminal works.
However, I have no idea how to setup Kerberos with Lighttpd/PHP to ...
1
vote
0answers
307 views
Firefox proxy authentication with Kerberos: one service ticket per connection (Linux)
I am trying to enable proxy authentication via Kerberos for Firefox. The setup is:
Active Directory domain (for LDAP and Kerberos; this works and I can log in the computer and get Kerberos tickets ...
1
vote
1answer
431 views
How to cache authentication in Linux using PAM/Kerberos authentication (for CVS)?
We have several Linux servers that authenticate Linux user passwords on our Windows Active Directory Server using PAM and Kerberos 5. The Linux distro we use is CentOS 6.
On one system, we have ...
0
votes
1answer
347 views
Kerberos setup on Red Hat
I'm using Red Hat 5 client to authenticate to a Windows 2003 KDC (or trying to anyway), but when I run
kinit vwwebseal@VWXAUTHN.LOCAL
I get
kinit(v5): Cannot find KDC for requested realm while ...
1
vote
0answers
167 views
LSA Cache Entries - NTLM versus Negotiate Windows Authentication Providers
We have a situation, due to a recent employee name change, where the HttpContext.Current.User.Identity.Name property of an ASP.NET web application resolves to the old username. This has been ...
