Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

1
vote
1answer
74 views

Can I use user-based kerberos authenication with NFSv4?

Is it possible to set NFSv4 + Kerberos to do user-based authentication? As far as I understand you are required to create a principal for a client machine(i.e. it is still Host-based?) on Kerberos ...
1
vote
0answers
55 views

pwauth kerberos authentication specifying default and secondary servers

I am currently using Kerberos authentication for Basic Authentication on Apache using pwauth and mod_auth_external. I would like to add multiple servers to authenticate from, however they would have ...
1
vote
1answer
3k views

Apache kerberos authentication to Active Directory not happening. (Is KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN related?)

My goal is to have Apache authenticate authenticate against AD, without prompting for a username and password, using Kerberos. It currently always shows "401 Unauthorized", and appears to be not ...
1
vote
0answers
186 views

GSSAPITrustDns option missing from OpenSSH-6.7

I need to use the GSSAPITrustDns option to connect to a round robin service using Kerberos authentication. This works correctly using OpenSSH 5.3 and 6.6.1p1 on a selection of machines. I have an Arch ...
0
votes
0answers
59 views

How can I utilise resource based delegation

Windows 2012 comes with an extension to the existing Kerberos Constrained Delegation, called resource based delegation (RBCD). There are a number of great articles that explain how it works for ...
0
votes
1answer
549 views

libnss-ldap getent passwd - AD replies correctly but output shows local /etc/passwd

I am trying to configure libnss-ldap to provide AD authentication to my Linux Debian servers. This is working fine if user exists locally, I want to make it work for Domain users. Here is my ...
1
vote
0answers
49 views

Apache auth_kerb_module on Windows

I need to install the Kerberos module in Apache on Windows. I have copied the file auth_kerb_mod.so to apache/modules/ and I have modified the conf/httpd.conf with LoadModule auth_kerb_module ...
2
votes
2answers
3k views

How do I re-enable Kerberos authentication after upgrading to Mac OS X 10.10 Yosemite?

In previous versions of Mac OS X, one could enable Kerberos authentication when a user logs in by following a support document. Specifically, this document explains that the file ...
4
votes
2answers
315 views

Joining a NetApp to a domain on a Read Only Domain Controller

I have an isolated network, into which I've built a vfiler. The point of this network is that it's a non routed 'test' network. However, there's a need for LDAP/Kerberos and CIFS access to the ...
0
votes
0answers
55 views

Do kerberos constrained delegation with protocol transition on IIS to another IIS need my own application for very simple redirect

Please excuse me if its a very basic question but i'm totally lost on this as Im new to IIS and kerberos delegation but have understanding of auth protocols. Need you peoples help please as i have ...
1
vote
0answers
269 views

Postfix + Saslauthd + Kerberos 5 + CentOS 7 not working

I've almost got saslauthd checking against Kerberos but seeing some last issues on CentOS 7. When postfix talks to saslauthd, it sends a lowercased domain and it's not corrected. I tried to fix things ...
2
votes
1answer
356 views

Kerberos-PAM authentication failure: pam or pre-authentication

kinit -p 'username' works -- no problem with the setup of the Kerberos realm. I can't get the login from the GUI to work, however. Client auth.log: pam_krb5(gdm3:auth): user <username> ...
0
votes
0answers
102 views

Apache+subversion Kerberos Authorization Active Directory

I have configured Apache+Subversion with Kerberos. Here's my config: SSLRequireSSL DAV svn SVNPATH /var/www/svn/testrepo AuthType Kerberos Krb5KeyTab /etc/krb5.keytab KrbAuthRelams ...
-1
votes
1answer
194 views

Lightweight webserver with SSPI authentification [closed]

I'm looking for a fast, lightweight web server (for example nginx or lighttpd) which supports authentication to a Microsoft Kerberos authentication server (SSPI). This webserver must run under Windows ...
0
votes
0answers
156 views

How can I use LDAP and Kerberos for web auth only, not server auth

I have read this question on proper kerberos integration and this question on enterprise authentication, neither are helpful to me at this point in time though they did provide some good background. ...
0
votes
0answers
19 views

Enabling constrained delegation on DC computer account

Is it necessary to have constrained delegation enabled on Microsoft AD domain controller computer account? If yes then why and what are consequences of disabling it? I'm mainly interested in current ...
0
votes
0answers
133 views

Samba4 Workgroup showing in My computer Properties

I suppose my question is stupid but want to clear it. Installed Samba4, joined machine but in My Computer properties the WORKGROUP is shown in lowercase letters. Whats is the reason to don't show in ...
1
vote
0answers
707 views

Kerberos Configuration Manager for SQL Server error “unable to access user principal information from the system”

When I launch the Kerberos Configuration Manager for SQL Server and try to connect to the local machine it's on, I am getting the error "Kerberos Configuration Manager for SQL Server error "unable to ...
0
votes
1answer
91 views

389 Directory Server - Multiple Domains

I have multiple business that i would like to authenticate to a single server for SSO. I am using 389 directory server and have already split each domain into it's own respective OU. I would like to ...
0
votes
0answers
41 views

IIS 6.0 reverting to NTLM authorization

This is related to my other question here. We have a .net 2.0 app hosted in IIS 6 on two different servers (the second server was setup to troubleshoot this issue) these servers are on two different ...
2
votes
1answer
325 views

Kerberos token size error

I am having issues with a .net 2.0 web app hosted on a windows 2003 server authenticating with a java app (on linux I think). The java server is expecting Kerberos authentication and currently fails ...
1
vote
0answers
55 views

kerberos apache 401 error for domain admins using office addin

I use SSO for access to a Linux based system from our windows 7 PC's. This works for IE using the logon credentials to access the system. However, when the developed office plugin is used by any ...
3
votes
0answers
256 views

Cannot enable GSS-TSIG updates from Active Directory in BIND 9.10

I’m with a problem trying to enable GSS-TSIG with BIND 9.10. Before I start describing what I’ve done, I would like to say that I’ve already done this in in another domain without any problems. So I ...
0
votes
1answer
606 views

MacOS X 10.9 Mavericks Kerberos login w/ FreeIPA

Has anyone successfully set up authentication and authorization between MacOS X and FreeIPA? An old revision of the FreeIPA documentation explains how to get it working in 10.4 and nothing in their ...
0
votes
0answers
78 views

Avoid client keytab with Kerberized NFSv4

I would like to setup a Kerberized NFSv4 server such that clients do not need a keytab to mount a volume (but such that users get their privileges according to their Kerberos ticket as usual). Is it ...
1
vote
1answer
373 views

Apache - Replace Apache::AuthenNTLM with Kerberos (mod_auth_kerb)

Within an intranet system on Solaris we currently use perls Apache2::AuthenNTLM module to authenticate with a Win 2k3 doman server, so we can access the user ID of the person browsing the site. ...
0
votes
1answer
50 views

Kerberos in production on virtual machines

At the moment I am investigating the possibility to use Kerberos as the primary authentication protocol for our cloud structure. We'll probably follow through with this idea and for the sake of HA the ...
0
votes
1answer
111 views

FreeIPA krb5.conf has example.com entries

I have installed and reinstalled FreeIPA ipa-server-3.0.0-37.el6.x86_64 on a fully updated OEL 6.5 server a couple (3) times now and even if I destroy the existing /etc/krb5.conf file and reinstall ...
0
votes
2answers
2k views

Can't add my Red Hat 7 machine to our company's Active Directory

I'm trying to join my RHEL 7 VM machine to our company's AD. I can validate my login credentials just fine with kinit (No return if I enter the correct password, error if I enter the wrong one), ...
2
votes
1answer
1k views

problems creating a keytab file on win server

I am trying to create a keytab file. i see a warning WARNING: pType and account type do not match. This might cause problems. The command i use is ktpass -princ ...
1
vote
2answers
820 views

Kerberos ktutil, what kinds of encryption are available?

I am attempting to make a keytab using ktutil. I get to choose the encryption type, but the ktutil man page does not offer a list of possible choices. I also don't know which encryption method is the ...
5
votes
1answer
157 views

Does Active Directory's Kerberos implementation support per-user ticket lifetime settings?

With MIT Kerberos, the kadmin utility supports the creation of principals that have an explicit maximum ticket lifetime and renewal lifetime (-maxlife and -maxrenewlife arguments for add_principal) ...
0
votes
2answers
794 views

How to clear kerberos config

I am setting my machine as a kerberos client. I have a question on how the kerberos config file actually take effect and how to clear its effect. My experiment is as follow. Step 1, without editing ...
0
votes
0answers
180 views

Browser (SPNEGO) kerberos authentication on Windows Phone 8 IE

Is there a way to make Internet Explorer on Windows Phone 8 authenticate to a site using Windows Integrated Security Authentication with Kerberos through the Negotiate (SPNEGO) protocol? It seems to ...
0
votes
0answers
813 views

squid authentication error kerberos - windows active directory

I use squid on RHEL6 and I want that authentication is via AD windows 2008, I already joined the server to the windows domain and all users is already seen by wbinfo -u wbinfo -g but wbmin -t show ...
1
vote
1answer
243 views

BCP/xp_cmdshell access denied - but only when running procedure from outside the server

I've been attempting to run some of my team's database deployment code to a SQL 2014 server on a Windows 7 test box. Part of this code is a procedure that pulls in data from a file using BCP from a ...
2
votes
1answer
1k views

Why don't Active Directory user accounts automatically support Kerberos AES authentication?

I'm playing around with a test domain on Windows Server 2012 R2. I'm operating at the highest possible functional level and have no backwards-compatibility issues in my small test environment. ...
0
votes
0answers
163 views

Kerberos and SSH login

I've just configured a RHEL 7 for windows authentication (idmap_ad). Every check works but if i try to ssh with a domain user i get the error: Connection closed by ::1 Here follows the ssh log in ...
1
vote
2answers
590 views

IE HTTP Kerberos issues authenticating to site on FQDN not matching AD Domain

I have a site on a corporate domain that authenticates using Kerberos auto-login from IE and Chrome just fine, as long as the DNS being used to access it falls under the AD FQDN The AD domain is not ...
2
votes
2answers
12k views

kinit: Cannot contact any KDC for realm 'UBUNTU' while getting initial credentials

I am installing Kerberos5-1.12.1 on ubuntu machine by following the link: http://techpubs.spinlocksolutions.com/dklar/kerberos.html#krb-install Whenever i am trying to do : kinit user1 I am ...
1
vote
2answers
6k views

Unable to setup Kerberos on Ubuntu 14.04 - krb5kdc: No such file or directory - while initializing database for realm myrealm

I'm attempting to follow the guide on the Ubuntu wiki for installing and setting up Kerberos. I am running Ubuntu 14.04 (LTS) 64-bit. I have setup avahi-daemon in order to provide .local DNS names. I ...
2
votes
1answer
201 views

Is the Kerberos SPN FQDN significant to the server, or is the keytab enough?

I spend most of my time as a developer, so I'm not familiar with all the details... I have a service running on a linux host. I want to use Kerberos to transmit identity information to the service. ...
0
votes
1answer
79 views

Password reset is not working

I am using krb5 authentication to authenticate users in my machine. I am trying to change my password using passwd command but it failed. ~:$ passwd ~:$ Changing Password for bharathi ~:$ Kerberos 5 ...
0
votes
1answer
854 views

Issues with Kerberos trying to log on Samba 4 Active Directory Domain Controller from Windows

I'm trying to setup an Ubuntu Server with Samba 4 as Active Directory Domain Controller and I'm getting an error when I try to connect from a Windows machine. Here's Samba's log of the error (I've ...
0
votes
0answers
70 views

User under windows server AD access Linux server using kerberos

I installed AD on windows 2008 r2 sp1 server . And had configured all things follow the issue http://msdn.microsoft.com/en-us/library/ms995329.aspx ...
1
vote
2answers
2k views

FreeIPA: command-line tools do not work, 'No Kerberos credentials available'

We have a working FreeIPA installation, it's in production since February. Almost everything works as expected but when we try to run command-line FreeIPA-related tools none of them work: [admin@ipa ...
1
vote
0answers
166 views

kinit error: Realm not local to KDC, DC is in a subdomain

I have a user: oneuser@EXEMPLE.COM as principal and the next krb5.conf: [libdefaults] default_realm = EXEMPLE.COM default_tkt_enctypes = arcfour-hmac-md5 default_tgs_enctypes = ...
1
vote
1answer
964 views

Can't change password of FreeIPA admin - “Current password's minimum life has not expired”

We have a FreeIPA-based system, admin's password has expired and needs to be changed but the standard password changing procedure over SSH fails: sashka@cellar ~ ssh admin@ipa.xxxxxxxxxx.com ...
3
votes
0answers
385 views

Kerberos, .k5login and sudo

Background: I am using a Debian 7 system which I have integrated with an LDAP+Kerberos system using libnss-ldap, libpam-krb5 and nscd. I have modified sudoers to permit an LDAP group the right to sudo ...
2
votes
1answer
753 views

MSSQLSvc Service Principal Names, Kerberos, and NTLM

Was recently helping a DBA with an issue that appeared to be related to an invalid SPN. Discovered that a good number of SQL service accounts simply don't have an SPN set, resulting in NTLM ...