Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

0
votes
1answer
40 views

Cache FreeIPA passwords to /etc/passwd

I have setup freeIPA/Kerberos authentication for my domain and it works well. I have a service that does not support server-based auth, only local auth via /etc/passwd. Is there a method to cache ...
5
votes
2answers
4k views

March 10th Patch Tuesday appears to cause SQL Server client connection problems

Since applying the full set of patches on a Win 7.1 Pro desktop and a Windows 2012 R2 Datacenter Azure server running SQL 2014, SQL Management Studio (2008 and 2014 versions) won't connect to the SQL ...
1
vote
0answers
23 views

Kerberos - KDC and IIS on same machine

I have one domain controller which must act as Kerberos KDC and a IIS server running on that same domain controller. I need to set up an Integrated Windows Authentication where a domain user can ...
0
votes
0answers
20 views

Standalone VM on CentOS KDC Kerberos 5 Server autentication error

After installed and configured the kerberos 5 server on a CentOS 6.7 virtual machine. I tried to authenticate my principal admin and got this error below, I don't understand why the error as it looks ...
0
votes
1answer
111 views

Switch to Kerberos Authentication with Apache2 on Ubuntu (LDAP or AD)

I'm considering to switch my intranet apps to Kerberos authentication.(currently NTLM but modules required are not maintained anymore and will in not work anymore once the web server is updated to ...
0
votes
3answers
67 views

Squid kerberos authentication no popup

I configured squid to use kerberos authentication but when I'm trying to use proxy with browser i don't get popup in browser with ask for user and password - just access denied cos of no ...
0
votes
1answer
41 views

Windows AD single DC (degraded) - cannot modify Administrator limit exceeded

I had 2 DC's in my domain. one of them died, and the last one has all roles, dcdiag netdiag show all checked as "good" - but i actually can't modify my "Administrator" account. according to alot, ...
0
votes
1answer
388 views

Clustered instance - kerberos double hop woes

We've recently migrated our virtualised SQL databases to a bare metal solution in an active/active cluster. Everything is working great except SQL Reports. Ok, so a rundown of our setup here as it ...
0
votes
1answer
93 views

Does “Kerberised” NFSv4 securely protect against a malicious client spoofing the user

I have read conflicting statements about whether shares exported via NFSv4 with sec=krb5 are cryptographically protected against a malicious client mounting the share and then spoofing the user to ...
3
votes
1answer
2k views

Firefox not using Kerberos despite being configured to [closed]

I am deploying Linux/Firefox on a corporate Kerberos network. I followed this Kerberos-on-Firefox procedure but still Firefox does not connect via the company's Kerberos. I am using Firefox 3.0.18 ...
0
votes
1answer
53 views

Login in Active Directory Domain (Samba 4) and mount -t cifs on debian

I've configured Samba 4 with bind and kerberos to work as an Active Directory authentication server. I've also configured "home share" so I can login to any Windows machine in my Domain and work with ...
4
votes
0answers
36 views

Why is it common in the startup world for ssh keys to be used for authetication instead of kerberos? [closed]

My first few jobs as a linux admin had be working under some very senior admins. In all of these cases kerberos was setup for users to request a security token and gain access to company servers for ...
1
vote
0answers
74 views

kerberos apache 401 error for domain admins using office addin

I use SSO for access to a Linux based system from our windows 7 PC's. This works for IE using the logon credentials to access the system. However, when the developed office plugin is used by any ...
0
votes
0answers
95 views

password ipa idm redhat change itself

I am new in Kerberos and I don't know why the password change itself I create another account but the problem persists after generating keytabe in IPA client the password of admin IPA idm redhat ...
1
vote
1answer
107 views

Kerberos Errors

Need help with the below error. I haven't been able to find much that has helped. Event Source: Security-Kerberos Event ID: 4 Qualifiers: 16384 Version: 0 Level: 2 Task: 0 Opcode: 0 Keywords: ...
0
votes
1answer
26 views

Server 2008 R2 Replication Issue

I am trying to figure out why my Server 2 which is a domain controller is getting an error saying "Access Denied" when I am trying to access group policy management. I have checked and it is giving ...
3
votes
1answer
130 views

Proxy Kerberos Authentication - Kerberos Service Ticket Issues

I have a BlueCoat ProxySG that is able to authenticate users via Kerberos. It is set to "Proxy" so it requires user authentication for each new TCP connection. Users have a Single Sign On and their ...
4
votes
1answer
786 views

Kerberos KDC has no support for encryption type while getting credentials

I am configuring an apache/SSO authentication with an AD with Kerberos. My http server is a Debian Wheezy and the AD is a Windows Server 2012. I generated keytabs files on WS2012 with kpass command ...
1
vote
1answer
240 views

Error: KDC has no support for encryption type

I have intermittent authentication issues on my ubuntu 15.04 servers. Periodically, authentication will just stop working. Eventually it will start working again on its own. Or, if I restart both smbd ...
9
votes
1answer
698 views

Kerberos authentication, service host and access to KDC

I have a web application (hostname: service.domain.com) and I wish to use Kerberos authentication to identify users that are logged into a Windows domain. Microsoft AD (Windows Server 2008 R2) is ...
1
vote
0answers
137 views

Tomcat 8, Kerberos authentication

I'm configuring kerberos for a tomcat server. Before I call the web application support company I would like to know if I'm doing the correct steps since it's my first time. The domain has 2 zones, ...
2
votes
2answers
202 views

MaxTokenSize on Server 2012 R2 and Groups

I fixed an issue yesterday where a 2008 R2 machine did not want to communicate with the DC. I discovered warnings in the event log relating to the kerberos buffer, so I increased the size in the ...
2
votes
2answers
2k views

Linux AD integration, unable to login when using Windows Server 2012 DC

I am trying to integrate my CentOS 6.6 servers into Active Directory. I've followed this guide from Red Hat using configuration 3 (SSSD/Kerberos/LDAP). When using a Windows Server 2008 R2 server as ...
0
votes
1answer
82 views

Cannot authenticate with Kerberos if both client and server on the same machine

I have a Tomcat webapp that supports Kerberos authentication. It works fine and I can log in to that app if I use a built-in account like LOCAL SYSTEM or NETWORK SERVICE, but I'm having problems with ...
-2
votes
1answer
103 views

How can I join a Windows Server 2008R2 server to a FreeIPA domain (LDAP/Kerberos)

In an infrastructure which consists of over 100 linux machines and only a single Windows Server (which will be replaced in two years with a linux server), it makes no sense to configure cross-forest ...
2
votes
2answers
553 views

Using SSH Keys with Kerberos

So there's an issue that we've been having at our company causing me to pull my hair out for the past week: We have hundreds of server boxes (a mix of CentOS6/7, if it matters) that need to quickly ...
1
vote
1answer
746 views

Cross-Realm trust verify failed with 'netdom' command

Question 1: Am having my ActiveDirectory in Windowsserver 2012 machine - its domain name is AD-DEMO.LOCAL Kerberos admin-server is in another Ubuntu machine - its realm KERBEROS.COM Added trust in ...
0
votes
1answer
19 views

krb5 / ldap: realm name match with directory namingContext

In order to store krb5 principal entries on LDAP, is the LDAP naming context (root basename) required to match the realm name? principals of the realm HQ.EXAMPLE.ORG can be stored in the ...
1
vote
2answers
842 views

kadmin interface not working - immediately closes connection

So far I've been doing most of the administration for kerberos with kadmin.local, however, I'm trying to migrate over to using the remote kadmin as it would be better practice and all. What I'm ...
1
vote
3answers
18k views

Windows Server Manager Kerberos error 0x80090322

I have been frustrated with this issue for two days now so I finally decided to ask this on serverfault. I'm setting up a Windows lab environment. It has a Win2012R2 domain controller (srv001) and ...
1
vote
0answers
32 views

Dante with Kerberos configuration across sites

I have a requirement to host a socks proxy in a central location, using Dante. What I've been asked to do is connect remote clients to it across the internet, they'll pass through a gateway routing ...
-1
votes
1answer
163 views

Authenticate Samba share via Kerberos using Open Directory

I have an Open Directory master on a machine called "minime" (El Capitan, Server 5). I further have a Samba server "tricky", running Ubuntu and a Mac OS X client "wallace". I want users on wallace to ...
5
votes
1answer
11k views

How to Change the Kerberos Default Ticket Lifetime

Our KDC servers are running either Ubuntu Dapper (2.6.15-28) or Hardy (2.6.24-19). The Kerberos software is the MIT implementation of Kerberos 5. By default, a Kerberos ticket lasts for 10 hours. ...
1
vote
2answers
2k views

Windows Authentication KRB5KRB_AP_ERR_MODIFIED

Let me preface by saying, I've been on this issue for about a week and a half now and I can't figure it out. I think I'm close, but every time I've thought that so far, I was wrong. I've looked at ...
7
votes
2answers
199 views

Kerberos service login only possible for 30 minutes after running ktpass.exe

I'm trying to Kerberize an Apache-server, and allow the created server principal to sign on to the Active Directory. I've followed one of the numerous tutorials available online, and it seems to work ...
1
vote
1answer
49 views

GSSAPI on Linux when reverse DNS lookup doesn't match AD DNS suffix

I have CentOS 6 server that has been joined to Active Directory using Samba and net ads join -k. It thus has a keytab like this: Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- ...
0
votes
3answers
322 views

SSO for linux/AD Windows 2008

I have multiple CENTOS servers that are all currently working off of a local /etc/passwd for user account control and have local home folders etc. This makes it a pain when users come on board leave ...
0
votes
1answer
102 views

kdm and ssh detecting different fully qualified domain name when using kerberos authentication

I'm attempting to setup Kerberos login support (Windows AD domain providing the kerberos) for Kubuntu 12.04 Linux workstations at the company I'm at. It's almost completely working but I can't get ...
1
vote
1answer
168 views

MIT Kerberos with OpenLDAP backend - TLS ok when KDC started interactively but init script fails

In DNS domain domain.local. there are two machines host.domain.local. = 192.168.1.1 srv1.domain.local. = 192.168.1.2 host.domain.local. is KDC for Kerberos realm DOMAIN.LOCAL, srv1.domain.local. ...
2
votes
1answer
41 views

Kerberos Error APP_MODIFIED when using a CNAME DNS record

I have a production server, which I'll call CONTOSO\MachineA, running SQL Server. I have a development server, which I'll call CONTOSO\MachineB, running IIS. Both servers are running Windows Server ...
0
votes
1answer
311 views

Slaptest, bad configuration file

I have been struggling to start LDAP server and I am failing miserably at it, from journalctl -xn I it clearly say bad configuration files!, but there are three configuration files, but what is ...
0
votes
0answers
188 views

Is it ok to disable the KCM (Kerberos Credential Cache) daemon on OS X?

I've got some issues that seems would be cleared up if I disable the KCM Daemon (it's the Kerberos Credential Cache). Is there any good reason I shouldn't? Does it break anything other than single ...
1
vote
0answers
57 views

How to get Kerberos tickets in sync with OS X password changes?

I've traced an issue that's been plaguing us down to a "simple" problem: Kerberos tickets are not syncing with OS X Open Directory password changes. Another way to put this: Expired/expiring ticket ...
4
votes
1answer
758 views

Kerberos, .k5login and sudo

Background: I am using a Debian 7 system which I have integrated with an LDAP+Kerberos system using libnss-ldap, libpam-krb5 and nscd. I have modified sudoers to permit an LDAP group the right to sudo ...
1
vote
1answer
29 views

How does data flow in a password change with Open Directory?

I'm trying to troubleshoot an OS X OD issue and I'm having a hard time finding anything concrete about just how data flows between clients and server. Specifically, I'd love to know what exactly ...
1
vote
0answers
74 views

How can I make Kerberos flush the credential cache when a user changes their password?

We've got a fun new issue after upgrading to OS X 10.10 client and server with Open Directory (from 10.8). When a user changes their password (using System Preferences or at the Login screen) it ...
1
vote
0answers
252 views

Open Directory Password Change Issues on OS X Server 10.10

I'm having a problem with 50+ workstations (10.9 and 10.10) when a user changes their OD password (either at the OS X login screen or the System Preferences). The password change updates on the ...
2
votes
2answers
7k views

winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm

While looking for reasons why logging in to a samba machines joined to Active Directory is slow I have the strong impression that the following error in my log file could be a hint. Apr 3 14:44:14 ...
0
votes
1answer
294 views

Can I use kadmin (Linux) to add/remote SPNs from an Active Directory server?

Is it possible to use kadmin (Linux) to add/remote SPNs from an Active Directory server? I'm trying to add some service principles on my Active Directory server and store the keys in the local keytab ...
0
votes
1answer
154 views

FreeIPA ssh auth not working remotle with .k5login file

I cant login to my root and any other account which im not owner with kerberos and ~/.k5login (ksu is working). Here is presentation of problem: root@gwhost:~# ssh user@freeipa01 user@freeipa01's ...