Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

0
votes
0answers
34 views

Kerberos Authenticator Encryption Type NULL

So, I've been working on a SSO enabled XMPP application on our network for a couple weeks. I have 95% of the bugs worked out, and everything is running smoothly. The problem is that I have a couple ...
2
votes
0answers
78 views

CUPS remote print queues

In my network, there are multiple printers over many locations, all connected to a single CUPS server via whatever protocols they require. Client machines on the network need to print to the printers ...
4
votes
2answers
160 views

If an IIS hosted site is secured using Kerberos, can Linux machines connect to it?

I'm running into a problem configuring my IIS 7.0 website in a test environment with Kerberos. I have a trial version of Windows Server 2008 R2 with AD DS, AD RMS, DHCP, DNS & IIS roles installed. ...
3
votes
4answers
6k views

error reading keytab file krb5.keytab

I've noticed these kerberos keytab error messages on both SLES 11.2 and CentOS 6.3: sshd[31442]: pam_krb5[31442]: error reading keytab 'FILE: / etc/ krb5. keytab' /etc/krb5.keytab does not exist on ...
5
votes
3answers
509 views

In a Windows PKI, what is a Workstation Authentication CA Template used for? What happens if it expires?

Many workstations have an expiring computer certificate that was issued using the Workstation Authentication CA template. The CA of this template expires in 2 days. I've deployed a new CA, with an ...
2
votes
2answers
2k views

nfs4 and kerberos: Wrong principal in request

My client/servers are both running Ubuntu 14.04 and kerberos user authentication works as intended. regular nfs4 mounts also work fine. All machines are running heimdal libraries. I haven't been able ...
2
votes
1answer
758 views

IIS 7.5 web application failing with NT Authority\Anonymous Logon

I am finding various google results, but none seem to fix my problem. I am setting up a new WINDOWS 2008 R2 box at work that is to communicate with an existing SQL 2012 box via web tools running in ...
1
vote
0answers
603 views

Encounter an error when configuer secure hadoop : org.apache.hadoop.security.AccessControlException

I try to configure secure hadoop with kerberos. I have started KDC server , generated and copy related keytab to corresponding node. kerberos can work normally (use kinit) but when i try to start ...
1
vote
1answer
1k views

Kerberos says there is no KDC at my server's location while getting initial credentials

This is probably some stupid error I've overlooked, but I've been working on this on and off for about a week. Running version 1.10.3 release 17.fc18 This is my krb5.conf [logging] default = ...
0
votes
0answers
34 views

Active Directory - Windows Kerberos integration

I integrated ActiveDirectory in Windows Server with Kerberos in Ubuntu machine I am able to generate tickets for the ActiveDirectory users in Ubuntu's Kerberos using 'kinit' command. Now would like to ...
1
vote
1answer
148 views

Kerberos SSH Man-in-the-Middle for Data Sniffing

Kerberos clearly keeps an attacker from getting a user's credentials in an SSH man-in-the-middle scenario (one where the attacker has gotten the user to trust their server's public key and redirects ...
0
votes
0answers
153 views

bugzilla authenticate with kerberos + ldap + SSO

I want to set up bugzilla with SSO, i cannot find any good documentation on how to do this. I have managed to set up ldap login which works fine. now I have set up kerberos on apache which works fine, ...
3
votes
2answers
895 views

Putty Kerberos/GSSAPI authentication

I configured a few Linux servers to authenticate with Active Directory Kerberos using sssd on RHEL6. I also enabled GSSAPI authentication in hopes of passwordless logins. But I can't seem to get ...
0
votes
2answers
280 views

Active directory auth to comprimised machine?

Let's say that I have a machine on my domain that has been compromised by an unknown attacker. If I use my domain credentials to log into that machine remotely, via RDP, does that expose my ...
5
votes
4answers
2k views

Login using Active Directory in Linux using Kerberos 5

I have a problem with setting up auth for users on Linux (Fedora Core 15 to be exact) using Active Directory on Windows 2008 Server with installed support for UNIX systems. I've successfully setup ...
0
votes
0answers
55 views

password ipa idm redhat change itself

I am new in Kerberos and I don't know why the password change itself I create another account but the problem persists after generating keytabe in IPA client the password of admin IPA idm redhat ...
0
votes
0answers
42 views

iis 7.5 application in webfarm using kerberos authentication not working for external users

I have setup my application to run using kerberos authentication,,it works fine at our end but when the application user tries to access he gets a 500 internal error..failed request tracing shows the ...
0
votes
1answer
98 views

Does Active Directory alone is not enough to secure hadoop?

I am trying to secure Hadoop environment installed in windows. So basically I started to analyse how to secure a Unix-based hadoop cluster. Have gone through various links related to Kerberos and ...
1
vote
2answers
2k views

Kerberos authentication using Java and ActiveDirectory: KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN

Iv'e got a Java app that is SSO-enabled using Kerberos under the URL http://alf-test.example.com/. Unfortunately somethings not working, the AD says it doesn't know the service principal. This is the ...
1
vote
0answers
123 views

Setting up SPN for SSRS in a CRM load balance environment

I'm getting this exception randomly in a CRM load balance LIVE environment when running Reports from CRM. System.ServiceModel.Security.SecurityNegotiationException: A call to SSPI failed, see inner ...
2
votes
0answers
97 views

Samba Shares Without Using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
0
votes
0answers
86 views

How to support Kerberos authentication on internal websites through Citrix Access Gateway

When I remote in through a citrix access gateway (using netscaler) I am unable to use kerberos tickets for authentication with apache. The browser only sends an NTLMSSP negotiate header and gives up. ...
1
vote
1answer
67 views

Can I use user-based kerberos authenication with NFSv4?

Is it possible to set NFSv4 + Kerberos to do user-based authentication? As far as I understand you are required to create a principal for a client machine(i.e. it is still Host-based?) on Kerberos ...
4
votes
2answers
564 views

Is there a way to have tortisesvn use Windows 7 kerberos tickets to auth against an apache svn server?

I have putty able to use gssapi on my Windows 7 x64 clients against kerberos logins for SSH. I.e. it forwards the ticket you get when you log in to windows. I can't figure out how to get tortiseSVN to ...
1
vote
0answers
49 views

pwauth kerberos authentication specifying default and secondary servers

I am currently using Kerberos authentication for Basic Authentication on Apache using pwauth and mod_auth_external. I would like to add multiple servers to authenticate from, however they would have ...
0
votes
1answer
497 views

MacOS X 10.9 Mavericks Kerberos login w/ FreeIPA

Has anyone successfully set up authentication and authorization between MacOS X and FreeIPA? An old revision of the FreeIPA documentation explains how to get it working in 10.4 and nothing in their ...
1
vote
1answer
2k views

Apache kerberos authentication to Active Directory not happening. (Is KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN related?)

My goal is to have Apache authenticate authenticate against AD, without prompting for a username and password, using Kerberos. It currently always shows "401 Unauthorized", and appears to be not ...
1
vote
2answers
4k views

Unable to setup Kerberos on Ubuntu 14.04 - krb5kdc: No such file or directory - while initializing database for realm myrealm

I'm attempting to follow the guide on the Ubuntu wiki for installing and setting up Kerberos. I am running Ubuntu 14.04 (LTS) 64-bit. I have setup avahi-daemon in order to provide .local DNS names. I ...
1
vote
2answers
1k views

How do I use ldapsearch with a cross-realm ticket?

kinit user@DOMAIN.TLD klist -afe Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: user@DOMAIN.TLD Valid starting Expires Service principal 08/04/11 13:14:53 08/05/11 ...
1
vote
0answers
164 views

GSSAPITrustDns option missing from OpenSSH-6.7

I need to use the GSSAPITrustDns option to connect to a round robin service using Kerberos authentication. This works correctly using OpenSSH 5.3 and 6.6.1p1 on a selection of machines. I have an Arch ...
0
votes
1answer
518 views

libnss-ldap getent passwd - AD replies correctly but output shows local /etc/passwd

I am trying to configure libnss-ldap to provide AD authentication to my Linux Debian servers. This is working fine if user exists locally, I want to make it work for Domain users. Here is my ...
24
votes
5answers
18k views

Why use Kerberos instead of NTLM in IIS?

This is something that I've never really been able to answer as well as I like: What is the real advantage of using Kerberos authentication in IIS instead of NTLM? I've seen a lot of people really ...
0
votes
0answers
50 views

How can I utilise resource based delegation

Windows 2012 comes with an extension to the existing Kerberos Constrained Delegation, called resource based delegation (RBCD). There are a number of great articles that explain how it works for ...
1
vote
1answer
9k views

keytab auth against samba 4 DC: Client not found in Kerberos database while getting initial credentials

I set up a samba 4 active directory on ubuntu 14.04 following Samba AD DC HOWTO. In principle everything works well but I'm stuck in getting kerberos authentication running using SPNs for web ...
1
vote
0answers
43 views

Apache auth_kerb_module on Windows

I need to install the Kerberos module in Apache on Windows. I have copied the file auth_kerb_mod.so to apache/modules/ and I have modified the conf/httpd.conf with LoadModule auth_kerb_module ...
1
vote
0answers
229 views

Postfix + Saslauthd + Kerberos 5 + CentOS 7 not working

I've almost got saslauthd checking against Kerberos but seeing some last issues on CentOS 7. When postfix talks to saslauthd, it sends a lowercased domain and it's not corrected. I tried to fix things ...
4
votes
2answers
255 views

Joining a NetApp to a domain on a Read Only Domain Controller

I have an isolated network, into which I've built a vfiler. The point of this network is that it's a non routed 'test' network. However, there's a need for LDAP/Kerberos and CIFS access to the ...
0
votes
0answers
55 views

Do kerberos constrained delegation with protocol transition on IIS to another IIS need my own application for very simple redirect

Please excuse me if its a very basic question but i'm totally lost on this as Im new to IIS and kerberos delegation but have understanding of auth protocols. Need you peoples help please as i have ...
0
votes
0answers
123 views

Samba4 Workgroup showing in My computer Properties

I suppose my question is stupid but want to clear it. Installed Samba4, joined machine but in My Computer properties the WORKGROUP is shown in lowercase letters. Whats is the reason to don't show in ...
12
votes
2answers
4k views

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of ...
5
votes
3answers
5k views

How to integrate Active Directory with FreeBSD 10.0 using security/sssd?

What are the required steps to authenticate users from an Active Directory running on Windows Server 2012 R2 in FreeBSD 10.0 using sssd with the AD backend with Kerberos TGT working?
0
votes
1answer
1k views

AD + Postfix + Dovecot problems with query_filter

I set up a mail server AD + Postfix + Dovecot + Kerberos This works fine for only one domain In the attribute mail=test@test.com, in otherMailbox=vasya@otherdoamin.com,petya@another.net Config ...
3
votes
2answers
2k views

Why should I not run setspn.exe on the domain controller?

I found several references (see below) on blogs that the setspn.exe utility should be run from either a client or server machine in the domain, but not from the domain controller itself. ...
1
vote
4answers
1k views

How to ensure machine is “Kerberos Domain” joined?

i've been having issues where calls to the LogonUser Windows API function is falling back to NTLM authentication, rather than using the preferred, default, Kerberos authentication. Researching the ...
0
votes
2answers
1k views

IIS / kerberos not prompting for credentials from Mac clients

I have an IIS server (Server 2008R2/IIS 7.5) configured for kerberos authentication. The kerberos authentication works from clients on Windows (IE and Opera both tested), but when I access the site ...
0
votes
0answers
32 views

Windows Interoperable Kerberos V5 Realm tcp KDC

I have a Windows 7 client that cannot reach a mit-krb5 KDC due to a firewall beyond my control. More specifically the client can reach the KDC, but the KDC's udp response does not make it back to the ...
2
votes
1answer
315 views

Kerberos-PAM authentication failure: pam or pre-authentication

kinit -p 'username' works -- no problem with the setup of the Kerberos realm. I can't get the login from the GUI to work, however. Client auth.log: pam_krb5(gdm3:auth): user <username> ...
0
votes
0answers
94 views

Apache+subversion Kerberos Authorization Active Directory

I have configured Apache+Subversion with Kerberos. Here's my config: SSLRequireSSL DAV svn SVNPATH /var/www/svn/testrepo AuthType Kerberos Krb5KeyTab /etc/krb5.keytab KrbAuthRelams ...
-1
votes
1answer
162 views

Lightweight webserver with SSPI authentification [closed]

I'm looking for a fast, lightweight web server (for example nginx or lighttpd) which supports authentication to a Microsoft Kerberos authentication server (SSPI). This webserver must run under Windows ...
0
votes
0answers
139 views

How can I use LDAP and Kerberos for web auth only, not server auth

I have read this question on proper kerberos integration and this question on enterprise authentication, neither are helpful to me at this point in time though they did provide some good background. ...