Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

0
votes
0answers
35 views

kerberos authentication to linux from windows

We have mostly unix/linux server in our data center. We access them from our workstations running windows using putty. All the workstations are part of an AD domain but the servers are not. Kerberos ...
0
votes
2answers
232 views

Integrate Squid Kerberos auth and Squidguard ldapusersearch into AD

I'm having trouble with Squid Kerberos auth and the Squidguard ldapusersearch that I use to apply ACLs by Active Directory groups membership. The problem is : Squid and Squidguard see my user as : ...
2
votes
0answers
206 views

Windows - Kerberos SSO from outside the domain

I've tried to figure it out myself, but to no avail. Google offers many tutorials but I couldn't find any for the below case. We have an external cooperating employee with VPN access to our LAN and ...
1
vote
3answers
9k views

Ubuntu + AD; Failed to join domain: failed to set machine spn: Constraint violation

I'm attempting to join a Ubuntu 12.04 server to Active Directory. I installed samba, and kb5-user, created a machine account in AD, and did: > net ads testjoin Join is OK So far so good. Then I ...
1
vote
2answers
764 views

kinit succeeded but ads_sasl_spnego_krb5_bind failed: SASL bind in progress

I'm trying to use fedora and samba as a file server. Using kerberos i'm trying to make sure no passwords are transmitted over my network. I'm able to use samba for its file server capabilities, ...
0
votes
1answer
712 views

Troubleshooting kerberos problems with Samba

I've run into an odd problem with Samba 3.6.23. Right now I have a Windows 2008 R2 machine that has trouble accessing shares on a domained Samba box. \\example_serv\my_share : Fails with LOGIN ...
3
votes
3answers
147 views

Kerberos with OpenLDAP backend: Password Sync HowTo

The basic setup is an OpenLDAP server. The users are provisioned and the passwords are set. Now we decided to add an MIT KDC for being able to use Kerberos. We configured the MIT KDC to utilize the ...
1
vote
1answer
111 views

Is LDAP used by Active Directory for anything if I only use Kerberos for authentication?

In my windows only domain, Kerberos is used for all authentication. The domain controllers I understand replicate & authenticate using RPC. Is LDAP used for anything else? Should I close the ...
6
votes
1answer
156 views

Is it possible to use Kerberos over TLS through sssd?

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with Kerberos and ...
4
votes
2answers
195 views

AWS Simple AD: “KDC has no support for encryption type” for users created with adtool, but not with MS Management Console

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with kerberos and ...
1
vote
1answer
2k views

DCOM Authentication Fails to use Kerberos, Falls back to NTLM

I have a webservice that is written in Classic ASP. In this web service it attempts to create a VirtualServer.Application object on another server via DCOM. This fails with Permission Denied. However ...
2
votes
1answer
81 views

SSH, Kerberos, AD: how / where to config /etc/pam.d/password-auth?

I have a CentOS 6 machine here and want to give SSH access for users from another forest, which is trusted. I got a temporary workaround, which is: 1) change content in /etc/pam.d/vncserver to auth ...
0
votes
0answers
41 views

Kerberos encryption unsupported type 23

I have to set up a automated file transfer from an application server to Hadoop fs using curl and Kerberos, I created the Kerberos keytab in the server hosting Hadoop successfully and the encryption ...
2
votes
2answers
2k views

Windows Server 2003 -Ktpass - crypto: enum value 'rc4-hmac' is not known

I'm trying to create a keytab with Ktpass on a Windows Server 2003 with: Ktpass -princ host/prueba-mail.ejemplo.org@EJEMPLO.ORG -mapuser host -pass password -crypto rc4-hmac -out UNIXhost.keytab I ...
0
votes
2answers
318 views

login with active directory users on debian jessy not working

I'm trying to get the login with active directory users working for nearly a week now. First of all, I'm pretty new to pam, samba, kerberos and winbind. We worked with local users and sudo before, but ...
0
votes
1answer
102 views

LDAP+KERBEROS server configuration

I am following this guide to setup up kerberos server. the system configuration for kerberos server is below, can someone help me to resolve the issue, any help will be appreciated. Here is the ...
0
votes
1answer
35 views

Grant Kerberos Ticket on successfull authentication against third party password store

I am currently building a system where I would like to deploy Kerberos. However my external constraints on the user management do not allow me to authenticate the users against Kerberos itself. I do ...
1
vote
0answers
44 views

Alot of Events “Kerberos authentication Ticket (TGT) was rejected”

Currently we are seeing a lot of Events "Kerberos authentication Ticket (TGT) was rejected" even for the accounts that are blocked. Also from the event logs, I see a username being used which does ...
1
vote
2answers
68 views

Issue authenticating to AD-joined Centos 7 server

Using this link, I have set up a server that is properly joined to an Active Directory server, but for some reason I can not authenticate to that server with a kerberos ticket on several test-users ...
0
votes
2answers
437 views

Get Kerberos ticket with SSH

I'd like to get a Kerberos 5 ticket when ssh-ing to get to a fully-automated login solution. Typically, you use kinit first and then ssh: > kinit user@DOMAIN user@DOMAIN's Password: (enter ...
1
vote
1answer
194 views

Automatic Kerberos Ticket Renewal (Indefinitely)

I am currently switching our environment from NIS over to Kerberos + LDAP. During this migration I've now run into the following situation. We mount our homes via NFS which obviously should also be ...
4
votes
5answers
11k views

error reading keytab file krb5.keytab

I've noticed these kerberos keytab error messages on both SLES 11.2 and CentOS 6.3: sshd[31442]: pam_krb5[31442]: error reading keytab 'FILE: / etc/ krb5. keytab' /etc/krb5.keytab does not exist on ...
0
votes
1answer
137 views

Single Sign On with multiple Identity Providers from PHP web app

I'm building a SAAS web app in PHP that needs to integrate SSO. We'll have multiple client organizations, each that have their own Identity Provider (Active Directory). While researching possibilities,...
1
vote
0answers
95 views

Websphere Application Server and Kerberos Keytab Renewal

I am currently running into an issue with Kerberos ticket expiration from a keytab on WAS 8.5.5.5. The same process works correctly on Tomcat 8, and I believe the primary difference is the JDK / JAAS ...
3
votes
1answer
68 views

Kerberos authentication fails when local password is expired

I am using pam_krb5 with local accounts (Linux) for AD password authentication. Things are working great, users are able to authenticate with both AD and local passwords. I am having a problem though,...
0
votes
1answer
43 views

Cache FreeIPA passwords to /etc/passwd

I have setup freeIPA/Kerberos authentication for my domain and it works well. I have a service that does not support server-based auth, only local auth via /etc/passwd. Is there a method to cache ...
5
votes
2answers
4k views

March 10th Patch Tuesday appears to cause SQL Server client connection problems

Since applying the full set of patches on a Win 7.1 Pro desktop and a Windows 2012 R2 Datacenter Azure server running SQL 2014, SQL Management Studio (2008 and 2014 versions) won't connect to the SQL ...
1
vote
0answers
27 views

Kerberos - KDC and IIS on same machine

I have one domain controller which must act as Kerberos KDC and a IIS server running on that same domain controller. I need to set up an Integrated Windows Authentication where a domain user can ...
0
votes
0answers
28 views

Standalone VM on CentOS KDC Kerberos 5 Server autentication error

After installed and configured the kerberos 5 server on a CentOS 6.7 virtual machine. I tried to authenticate my principal admin and got this error below, I don't understand why the error as it looks ...
0
votes
1answer
170 views

Switch to Kerberos Authentication with Apache2 on Ubuntu (LDAP or AD)

I'm considering to switch my intranet apps to Kerberos authentication.(currently NTLM but modules required are not maintained anymore and will in not work anymore once the web server is updated to ...
0
votes
3answers
73 views

Squid kerberos authentication no popup

I configured squid to use kerberos authentication but when I'm trying to use proxy with browser i don't get popup in browser with ask for user and password - just access denied cos of no ...
0
votes
1answer
42 views

Windows AD single DC (degraded) - cannot modify Administrator limit exceeded

I had 2 DC's in my domain. one of them died, and the last one has all roles, dcdiag netdiag show all checked as "good" - but i actually can't modify my "Administrator" account. according to alot, ...
0
votes
1answer
405 views

Clustered instance - kerberos double hop woes

We've recently migrated our virtualised SQL databases to a bare metal solution in an active/active cluster. Everything is working great except SQL Reports. Ok, so a rundown of our setup here as it ...
0
votes
1answer
99 views

Does “Kerberised” NFSv4 securely protect against a malicious client spoofing the user

I have read conflicting statements about whether shares exported via NFSv4 with sec=krb5 are cryptographically protected against a malicious client mounting the share and then spoofing the user to ...
3
votes
1answer
2k views

Firefox not using Kerberos despite being configured to [closed]

I am deploying Linux/Firefox on a corporate Kerberos network. I followed this Kerberos-on-Firefox procedure but still Firefox does not connect via the company's Kerberos. I am using Firefox 3.0.18 ...
0
votes
1answer
67 views

Login in Active Directory Domain (Samba 4) and mount -t cifs on debian

I've configured Samba 4 with bind and kerberos to work as an Active Directory authentication server. I've also configured "home share" so I can login to any Windows machine in my Domain and work with ...
4
votes
0answers
38 views

Why is it common in the startup world for ssh keys to be used for authetication instead of kerberos? [closed]

My first few jobs as a linux admin had be working under some very senior admins. In all of these cases kerberos was setup for users to request a security token and gain access to company servers for ...
1
vote
0answers
76 views

kerberos apache 401 error for domain admins using office addin

I use SSO for access to a Linux based system from our windows 7 PC's. This works for IE using the logon credentials to access the system. However, when the developed office plugin is used by any ...
0
votes
0answers
96 views

password ipa idm redhat change itself

I am new in Kerberos and I don't know why the password change itself I create another account but the problem persists after generating keytabe in IPA client the password of admin IPA idm redhat ...
1
vote
1answer
123 views

Kerberos Errors

Need help with the below error. I haven't been able to find much that has helped. Event Source: Security-Kerberos Event ID: 4 Qualifiers: 16384 Version: 0 Level: 2 Task: 0 Opcode: 0 Keywords: ...
0
votes
1answer
29 views

Server 2008 R2 Replication Issue

I am trying to figure out why my Server 2 which is a domain controller is getting an error saying "Access Denied" when I am trying to access group policy management. I have checked and it is giving ...
3
votes
1answer
156 views

Proxy Kerberos Authentication - Kerberos Service Ticket Issues

I have a BlueCoat ProxySG that is able to authenticate users via Kerberos. It is set to "Proxy" so it requires user authentication for each new TCP connection. Users have a Single Sign On and their ...
4
votes
1answer
1k views

Kerberos KDC has no support for encryption type while getting credentials

I am configuring an apache/SSO authentication with an AD with Kerberos. My http server is a Debian Wheezy and the AD is a Windows Server 2012. I generated keytabs files on WS2012 with kpass command ...
1
vote
1answer
325 views

Error: KDC has no support for encryption type

I have intermittent authentication issues on my ubuntu 15.04 servers. Periodically, authentication will just stop working. Eventually it will start working again on its own. Or, if I restart both smbd ...
9
votes
1answer
712 views

Kerberos authentication, service host and access to KDC

I have a web application (hostname: service.domain.com) and I wish to use Kerberos authentication to identify users that are logged into a Windows domain. Microsoft AD (Windows Server 2008 R2) is ...
1
vote
0answers
165 views

Tomcat 8, Kerberos authentication

I'm configuring kerberos for a tomcat server. Before I call the web application support company I would like to know if I'm doing the correct steps since it's my first time. The domain has 2 zones, ...
2
votes
2answers
372 views

MaxTokenSize on Server 2012 R2 and Groups

I fixed an issue yesterday where a 2008 R2 machine did not want to communicate with the DC. I discovered warnings in the event log relating to the kerberos buffer, so I increased the size in the ...
2
votes
2answers
2k views

Linux AD integration, unable to login when using Windows Server 2012 DC

I am trying to integrate my CentOS 6.6 servers into Active Directory. I've followed this guide from Red Hat using configuration 3 (SSSD/Kerberos/LDAP). When using a Windows Server 2008 R2 server as ...
0
votes
1answer
96 views

Cannot authenticate with Kerberos if both client and server on the same machine

I have a Tomcat webapp that supports Kerberos authentication. It works fine and I can log in to that app if I use a built-in account like LOCAL SYSTEM or NETWORK SERVICE, but I'm having problems with ...
-2
votes
1answer
156 views

How can I join a Windows Server 2008R2 server to a FreeIPA domain (LDAP/Kerberos)

In an infrastructure which consists of over 100 linux machines and only a single Windows Server (which will be replaced in two years with a linux server), it makes no sense to configure cross-forest ...