Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms

0
votes
1answer
155 views

AD Login to Solaris Zone Periodically Not Working

I have a Solaris 11.1 zone named "AZone". I have the zone joined to an Active Directory domain (Windows Server 2008) with the goal of users being able to use their AD account to log in to the Solaris ...
3
votes
1answer
195 views

Is there a way to have tortisesvn use Windows 7 kerberos tickets to auth against an apache svn server?

I have putty able to use gssapi on my Windows 7 x64 clients against kerberos logins for SSH. I.e. it forwards the ticket you get when you log in to windows. I can't figure out how to get tortiseSVN to ...
-1
votes
1answer
48 views

Why there are three rounds of message exchanges for integrated windows authentication for IE

According to the result monitored by fiddler, there are totally 3 handshakes for integrated windows authentication for IE. GET /home - 401 Unauthorized WWW-Authenticate: Negotiate, NTLM GET ...
0
votes
1answer
74 views

Tool to allow Kerberos Authenticated users to modify Firewall settings

I run a firewall on a central router. Recently, several users want to use Skype. Since firewalling Skype virtually means to switch the firewall off, I consider to allow users to temporarily punch ...
1
vote
0answers
148 views

heimdal error Decrypt integrity check failed for checksum type

when I try to authentication with heimdal-kdc ,I get this error in kdc log : (enctype aes256-cts-hmac-sha1-96) error Decrypt integrity check failed for checksum type hmac-sha1-96-aes256, key type ...
2
votes
2answers
63 views

Adding new SPNs to existing service ids

We have a tomcat server using spring-security kerberos to authenticate users to the webpage against active directory. There are around 25 domain controllers. The site has two CNAME based DNS ...
1
vote
2answers
467 views

mounting windows shares on linux while keeping windows permissions

I have a windows share on a windows2003 server (WINJOE) which I want to back up to a Linux machine (LINUXJOE) that is properly joined to the domain. My goal is to backup shared folders of WINJOE to ...
2
votes
2answers
1k views

Apache SSO through Kerberos using Machine Account

I'm attempting to get Apache on Ubuntu 12.04 to authenticate users via Kerberos SSO to a Windows 2008 Active Directory server. Here are a few things that make my situation different: I don't have ...
0
votes
1answer
242 views

Kerberos & signle-sign-on for website

I have a website running on a Linux computer using Apache. I've employed mod_auth_kerb for single-sign-on Kerberos authentication against a Windows Active Directory server. In order for Kerberos to ...
1
vote
1answer
2k views

mod_auth_kerberos “Unspecified GSS failure”

I did an apache 2.4 fresh install. I'd like to use kerberos authentication. I compiled and install mod_auth_kerb modules. here is my config <location "/restriced/"> SSLRequireSSL AuthName ...
0
votes
0answers
42 views

Import accounts from Kerberos/OpenLDAP to linux

I have a configuration of our own Kerberos server and OpenLDAP server that manages user accounts. I want to get rid of Kerberos and LDAP altogether and import a list of users as well as their shadow ...
1
vote
1answer
96 views

Using Kerberos only for SSO

I've installed Kerberos on the Debian machine that hosts an internal application, to be able to use it to authenticate users against our AD. This works. However, Kerberos seems to feel responsible ...
0
votes
0answers
214 views

Apache / Nginx - Reverse Proxy with Kerberos Constrained Delegation

I am after a solution to replace Microsoft TMG, and i am hoping there is an open source route of acomplishing. Currently using TMG we are reverse proxying Web resources say for example sharepoint, ...
1
vote
0answers
2k views

Synology DSM4.3 with Kerberos and NFSv4

According to the press releases of Synology DSM4.3 can do NFSv4 and Kerberos. Actually, in the Tab with NFS settings, there is a button for Kerberos settings. But I cannot find any guidance anywhere. ...
0
votes
0answers
277 views

HTTP proxy authentication Kerberos fallback on Windows

We run a Samba4 domain with Linux and Windows clients joined to it. Both the Windows and Linux machines use a Squid proxy that uses both Kerberos and Basic authentication, and for the most part it ...
1
vote
1answer
107 views

Kerberos using app pool credentials

I have the following setup: ServerA, a web server with an asp.net mvc site ServerB, a web server with an asp.net Web Api service The MVC site on ServerA consumes the Web Api service on ServerB. ...
3
votes
3answers
446 views

Kerberos - Adding a SPN to a Domain User

When adding a new SPN into the Kerberos domain, you have the option of mapping the SPN to a user. In general, I join the domain through Integrated Windows Authentication, and this creates a new ...
0
votes
1answer
377 views

How does the Cisco Global Site Selector pass traffic?

I have reason to believe that the Cisco GSS 4400 Series behaves differently from Cisco ACE NLB's, in regards to the way they pass name references. I would like to know the details of how they differ, ...
0
votes
1answer
106 views

Is it possible to securely add an NFSv4 share to an ESXi Server?

I just wondered how to connect an NFSv4 share as storage extension to my ESXi. Since NFSv4 supports Kerberos, ESXi could use Username and Password to connect to the share, while no one else could ...
0
votes
1answer
100 views

Unable to disable Kerberos Single Sign On (SSO)

I've been exploring Kerberos Single Sign On (SSO) to replace NTLM for a Web Application hosted internally within a Windows Domain. After creating Service Principal Names (SPN) for a test service ...
0
votes
0answers
495 views

NFS4 Kerberos Heimdal :: [mysterious] No credentials found to connection to server

I'm configuring NFS4 over Heimdal. After two days configuring this stuff, I've got to a point that all principals are found, everything is present in the keytab, but it still fails and I don't have a ...
3
votes
2answers
2k views

Web app running as NETWORK SERVICE can connect to SQL Server but windows service running as LOCAL SYSTEM cannot

I have installed a .net web application on a Windows Server 2003 IIS server, running in an Application Pool as NETWORK SERVICE and connecting to SQL Server on a different machine using Integrated ...
1
vote
1answer
224 views

Alfresco with only MIT Kerberos: What authentication.chain?

I want Alfresco to authenticate users using SSO with MIT Kerberos. What authentication.chain should I use? I tried authentication.chain=kerberos1:kerberos without success. Based on this answer I ...
1
vote
1answer
327 views

Why can't cron access a CIFS share using Kerberos authentication?

I'm on CentOS 6.4. Using kstart I have a TGT kept active using the machine account (ie computername$) from Active Directory. The ticket cache is assigned to root and is located at /tmp/krb5cc_0. I ...
3
votes
1answer
86 views

If an IIS hosted site is secured using Kerberos, can Linux machines connect to it?

I'm running into a problem configuring my IIS 7.0 website in a test environment with Kerberos. I have a trial version of Windows Server 2008 R2 with AD DS, AD RMS, DHCP, DNS & IIS roles installed. ...
1
vote
0answers
135 views

Alfresco with Kerberos: Error creating bean with name globalAuthenticationFilter

I configured Alfresco 4.2.c to work with MIT Kerberos, following the documentation. Because the documentation is only for Active Directory, I adapted some part to Kerberos by reading the forum. Upon ...
1
vote
2answers
138 views

Managing user and their credentials in kerberos and openldap system

I am learning to use openldap as backend database for kerberos credentials. It is good that all the programs are working with single sign on. The problem is - I can manage user from kadmin command ...
7
votes
3answers
423 views

Ubuntu 12.04, Windows 2012 Active Directory Integration, Kerberos won't resolve service principals

after having checked the whole internet literally, I hope that I might get help here. I am trying to accomplish integration of ubuntu 12.04 servers into a Windows 2012 active directory with nfs and ...
1
vote
1answer
76 views

krenew command not working : Permission Denied

I am using a Linux server to perform my simulations. The login and the file-system of the server are protected using kerberos. The file-system is supported using NFS. Since my simulations take a lot ...
0
votes
1answer
520 views

Autofs + NFS + LDAP sudo problems

I have a setup very similar to Dan Bishop's Ubuntu 12.04 Ultimate Server Guide. I actually created a series of ansible scripts to automate this process on my github. So I have ldap+kerberos set up ...
3
votes
1answer
3k views

Track Down Which Process/Program is Causing Kerberos pre-authentication error (Code 0x18)

We have a domain account that is being locked out via 1 of 2 servers. The built-in auditing only tells us that much (locked out from SERVER1, SERVER2). The account gets locked out within 5 minutes, ...
0
votes
0answers
932 views

krb5kdc: cannot initialize realm MYDOMAIN

On an out-of-the-box Turnkey Linux Domain Controller, I ran apt-get install krb5-admin-server, and while it ran fine, except for this error (warning?) in the middle of the execution: Setting up ...
1
vote
1answer
137 views

How exactly does the HOST/machine SPN work?

Normally when you set up Kerberos for IIS, you would do something like setspn -A HTTP/machine some_account. When IIS 7 is installed, it registers the SPN "HOST/machine" for its kernel-mode ...
1
vote
1answer
141 views

Root access to kerberized NFSv4 host on Ubuntu

I have a kerberized NFSv4 setup working well under Ubuntu for regular users, but I cannot get it working for root. For most systems, I do not want to allow root access, but I have a couple servers ...
1
vote
0answers
186 views

Problems with kvno + Consultation with kerberos authentication settings

I have clearly identified a problem that I can not solve. I suspect I'm missing something when setting the service running on Centos 6 on Windows Server 2003. First I tell the environment that I'm ...
0
votes
0answers
134 views

Splitting labs into subdomains without breaking Kerberos and Active Directory

So I have a vSphere environment with ever increasing pools of servers. Each pool/group of servers includes something like a firewall/proxy server, and two application servers (mixed environment, Linux ...
2
votes
1answer
74 views

How does one remove an encryption type from a kerberos principal?

I would like to remove all of the des keys from the principal below, but have no idea how to do so without someone inputting the password. kadmin: getprinc user Principal: user@EXAMPLE.COM ...
0
votes
2answers
629 views

Windows Server 2003 -Ktpass - crypto: enum value 'rc4-hmac' is not known

I'm trying to create a keytab with Ktpass on a Windows Server 2003 with: Ktpass -princ host/prueba-mail.ejemplo.org@EJEMPLO.ORG -mapuser host -pass password -crypto rc4-hmac -out UNIXhost.keytab I ...
2
votes
1answer
129 views

Duplicate SPNs causing NTLM fallback

I have duplicate SPNs which are threatening to downgrade the authentication from Kerberos to NTLM showing in the event viewer. How can I safely remove the duplicate SPN's for a SQL account? I have ...
1
vote
0answers
531 views

Server not found in Kerberos database while getting credentials for imap

When running kvno imap/prueba-mail.ejemplo.org@EJEMPLO.ORG get the following error: kvno: Server not found in Kerberos database while getting credentials for imap/prueba-mail.ejemplo.org@EJEMPLO.ORG ...
1
vote
1answer
53 views

Samba need an ip of same network of Windows Active Directory to make the join?

Im working to setup samba in windows network. The goal is windows users from Active Direcotry uses their passwords to log in samba shares. I am not sure if, in this setup, AD server and Samba Server ...
2
votes
1answer
101 views

replace Lock screen with Switch Account screen

User successfully logs in as user@EXAMPLE.COM . User is then mapped to user@ad.example.com via altSecurityIdentities: Kerberos:user@EXAMPLE.COM When the user locks the screen, the lock screen is ...
0
votes
1answer
68 views

kerberos: kadmin interface not working

We are using kerberos for authentication with pam module. We need to reinstall kerberos on another machine. So , I took kerberos dump and planned to restore using it. kdb5_util -sf stash load ...
0
votes
1answer
484 views

Kerberos says there is no KDC at my server's location while getting initial credentials

This is probably some stupid error I've overlooked, but I've been working on this on and off for about a week. Running version 1.10.3 release 17.fc18 This is my krb5.conf [logging] default = ...
0
votes
1answer
38 views

Kerberos authentication between 2 applications

We work on a server 2003 and server 2008 R2 enviroment. I'm familiar with the basic usage of the Kerberos protocol where the protocol authenticates a client when he tries to use a shared resource ...
8
votes
1answer
1k views

IPA vs just LDAP for Linux boxes - looking for a comparison

There are few (~30) Linux (RHEL) boxes and I'm looking for centralized and easy managed solution, mostly for control user accounts. I'm familiar with LDAP, and I deployed a pilot of IPA ver2 from Red ...
0
votes
1answer
405 views

House roaming profiles on realm trusted samba server?

Raison D'être I am attempting, so far unsuccessfully, to house roaming profiles for an Active Directory domain on a realm trusted Ubuntu 12.04LTS ZFS-on-Linux file server. The end goal is to have an ...
3
votes
1answer
108 views

Does Windows (Active Directory) kerberos use DNS for Realm mapping?

Will Windows clients use DNS to map hosts to specific kerberos realms? Specifically, do they use _kerberos.host.example.com IN TXT OTHERREALM.COM records?
0
votes
1answer
1k views

AD accounts on centos 6.4 not showing up despite successfull wbinfo -u

I have a centos 6.4 box with samba 3.6.9 which I have connected to MS server 2008 R2. That part seems to work fine, since I can see my AD users and groups with wbinfo -u and wbinfo -g. What does not ...
2
votes
1answer
900 views

Why is Kerberos security failing for our ADFS proxy server?

We have a WCF service that uses active federation to authenticate callers via AD FS 2.0 and it's working fine internally. Now we want to expose it to the outside world, so our server team set up a ...