Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

-1
votes
1answer
226 views

Authenticate Samba share via Kerberos using Open Directory

I have an Open Directory master on a machine called "minime" (El Capitan, Server 5). I further have a Samba server "tricky", running Ubuntu and a Mac OS X client "wallace". I want users on wallace to ...
1
vote
1answer
219 views

MIT Kerberos with OpenLDAP backend - TLS ok when KDC started interactively but init script fails

In DNS domain domain.local. there are two machines host.domain.local. = 192.168.1.1 srv1.domain.local. = 192.168.1.2 host.domain.local. is KDC for Kerberos realm DOMAIN.LOCAL, srv1.domain.local. ...
0
votes
1answer
5k views

Samba4 & Active Directory Kerberos [Cannot contact any KDC for realm 'INTERNAL.CORP.COM' while getting initial credentials

Yesterday I configured an Active Directory Server using Arch Linux and Samba 4 following this guide. I even added a client to the domain and was able to log in successfuly on my client. After a ...
1
vote
1answer
52 views

GSSAPI on Linux when reverse DNS lookup doesn't match AD DNS suffix

I have CentOS 6 server that has been joined to Active Directory using Samba and net ads join -k. It thus has a keytab like this: Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- ---------------...
0
votes
0answers
245 views

Is it ok to disable the KCM (Kerberos Credential Cache) daemon on OS X?

I've got some issues that seems would be cleared up if I disable the KCM Daemon (it's the Kerberos Credential Cache). Is there any good reason I shouldn't? Does it break anything other than single ...
1
vote
0answers
60 views

How to get Kerberos tickets in sync with OS X password changes?

I've traced an issue that's been plaguing us down to a "simple" problem: Kerberos tickets are not syncing with OS X Open Directory password changes. Another way to put this: Expired/expiring ticket ...
1
vote
1answer
31 views

How does data flow in a password change with Open Directory?

I'm trying to troubleshoot an OS X OD issue and I'm having a hard time finding anything concrete about just how data flows between clients and server. Specifically, I'd love to know what exactly ...
2
votes
1answer
50 views

Kerberos Error APP_MODIFIED when using a CNAME DNS record

I have a production server, which I'll call CONTOSO\MachineA, running SQL Server. I have a development server, which I'll call CONTOSO\MachineB, running IIS. Both servers are running Windows Server ...
1
vote
0answers
88 views

How can I make Kerberos flush the credential cache when a user changes their password?

We've got a fun new issue after upgrading to OS X 10.10 client and server with Open Directory (from 10.8). When a user changes their password (using System Preferences or at the Login screen) it ...
0
votes
1answer
391 views

Slaptest, bad configuration file

I have been struggling to start LDAP server and I am failing miserably at it, from journalctl -xn I it clearly say bad configuration files!, but there are three configuration files, but what is ...
0
votes
1answer
389 views

Can I use kadmin (Linux) to add/remote SPNs from an Active Directory server?

Is it possible to use kadmin (Linux) to add/remote SPNs from an Active Directory server? I'm trying to add some service principles on my Active Directory server and store the keys in the local keytab ...
1
vote
1answer
471 views

Enabling AES-encrypted single sign-on to Apache in a Win2008 domain

All of the tutorials I could find on setting up single-sign on into an Apache-hosted website using Active Directory authentication do so by configuring Kerberos with insecure settings. It's been best ...
0
votes
1answer
102 views

LDAP+KERBEROS server configuration

I am following this guide to setup up kerberos server. the system configuration for kerberos server is below, can someone help me to resolve the issue, any help will be appreciated. Here is the ...
0
votes
1answer
192 views

FreeIPA ssh auth not working remotle with .k5login file

I cant login to my root and any other account which im not owner with kerberos and ~/.k5login (ksu is working). Here is presentation of problem: root@gwhost:~# ssh user@freeipa01 user@freeipa01's ...
1
vote
0answers
344 views

Powerbroker Open : Cannot automount CIFS share, where is the kerberos ticket?

I am using Powerbroker Open (formerly Likewise Open) to join CentOS 7 machines to a Windows 2012 R2 domain. Login etc. works fine. Now I am trying to use the automatic mount of home directories via ...
1
vote
0answers
282 views

Open Directory Password Change Issues on OS X Server 10.10

I'm having a problem with 50+ workstations (10.9 and 10.10) when a user changes their OD password (either at the OS X login screen or the System Preferences). The password change updates on the ...
1
vote
0answers
126 views

Kerberized NFSv4 without creating new service principals

I need to deploy NFSv4 with Kerberos authentication in an existing AD environment, however, it must be done without making any changes on the KDC... So I figured, I would need to reuse host ...
0
votes
1answer
227 views

Active Directory authentication without Kerberos?

A friend of my has a Linux machine hosting Jenkins and a Windows 2008 Domain Controller. He uses Active Directory authentication in Jenkins and only specified the domain name and domain controller in ...
0
votes
1answer
162 views

Track down source of event 4771: Kerberos pre-authentication failed

Some process on a remote server is generating failed log-on attempts for a specific user account. I want to know what process it is. The account in question started generating these bad password ...
3
votes
0answers
265 views

Use Kerberos ticket to access WebDAV

Using Apache's mod_dav as the server, Samba 4.1.17 as the server and any version of Windows from 7 upwards as the client how can I mount a WebDAV share using Kerberos for the authentication? ...
7
votes
2answers
207 views

Kerberos service login only possible for 30 minutes after running ktpass.exe

I'm trying to Kerberize an Apache-server, and allow the created server principal to sign on to the Active Directory. I've followed one of the numerous tutorials available online, and it seems to work ...
1
vote
0answers
229 views

Obtain Kerberos ticket automatically (on boot) in CentOS 7?

I'm using Ansible to administer a group of Windows servers, with my control machine running CentOS 7.1. I've set up my /etc/krb5.conf file to authenticate to a domain controller so I can use one ...
1
vote
1answer
452 views

Wrong user mapping in kerberized NFSv4 automounted homedirs

Short problem description This question is about id mapping in NFSv4 going wrong. NFS server: a Synology DS, with DSM 5.2. Client: A regular FC22 machine, which automounts as /home one of the ...
1
vote
1answer
24 views

Is it possible for two legs of a service to have the same SPN? Or at least clients refer to a single identity?

For a WCF service "SuperService", installed on two separate servers "Server1" and "Server2" - is it possible to have a single SPN identity string to which the WCF client "SuperClient" can refer? Such ...
0
votes
1answer
169 views

Scalability of multiple keytabs, Linux NFS client/server and Windows AD KDC

I have kerberized NFSv3 working with a generic Linux NFS server and multiple Linux clients with a Windows AD 2012 domain for the Kerberos Realm. Windows KDC requires that when you create a keytab for ...
0
votes
0answers
167 views

Kerberos key version number mismatch in Apache, even though kvno and klist -k return the same numbers

I don't know if anyone had this issue. I am trying to implement single-sign-on through Kerberos and I get the following Apache error: [Thu Aug 13 12:08:54.219420 2015] [auth_kerb:error] [pid 1829] [...
0
votes
1answer
723 views

LDAP + KERBEROS + NFS. Why do I need idmapd?

What I am trying to do I have a freeIPA domain, with a few clients and a Synology NAS (also enrolled in freeIPA). I created a shared folder on the NAS, with NFSv4 + krb5 support. From the client, I ...
0
votes
1answer
160 views

krb5.conf is not readable by httpd process

I have an issue regarding kerberos / httpd / RHEL System 1 This is the problematic system. OS: RHEL 6.6 Kernel: 2.6.32-431.29.2.el6.x86_64 CPU: Intel Xeon X5570 There is a kerberized website ...
1
vote
1answer
114 views

automate kinit while login using sssd

I'm searching and trying this for a few weeks. What I've done so far: I'm authenticating for login using sssd with ldap. This works actually great! We need to authenticate via sssd with ldap, ...
0
votes
0answers
77 views

LDAP Kerberos authentication on linux

I have configured my RHEL linux machine to be authenticated against active directory without being joining it to domain, using nss-pam-ldapd pam_ldap samba-winbind openldap-devel krb5-devel. I am able ...
0
votes
0answers
51 views

Is it possible to configure different AuthType for directory and proxy in Apache?

I want to configure different AuthType for directory and proxy in Apache HTTPD server: https://httpd.apache.org/docs/2.2/mod/core.html#authtype I want to configure in directory Kerberos AuthType &...
1
vote
1answer
194 views

List all kerberized SPN's in Linux

Is there a way to list/show all SPN's in an kerberized AD using a Linux Client? In Windows one can use setspn -T <domain> -Q */* to get them. Is there something similar? Haven't found anything ...
0
votes
0answers
34 views

kerberos cross realm authentication

I want to do setup for kerberos cross realm service authentication using active directory. My question is that should I create a different domain (I read somewhere that realm is a domain) or should I ...
1
vote
1answer
86 views

Kerberos master server to slave server automation?

I've set up Kerberos in my workplace running on Centos 6 boxes, and successfully propagated the master server database to the slave and also set up a cron job to update it automatically every 5 ...
2
votes
1answer
90 views

how can I restrict kerberos service tickets by group?

I have multiple Linux servers all configured to allow kerberos authentication with active directory. All other user and group attributes reside in a separate directory server (389). I am able to log ...
1
vote
1answer
32 views

kadmind error - krb5_recvauth: start_seq_get is not supported in the HDBGET keytab type

I'm trying to migrate a heimdal KDC with an OpenLDAP backend from a Debian 5.x server (heimdal 1.2.dfsg.1-2.1) to a Ubuntu 14.04 server (heimdal 1.6~git20131207+dfsg-1ubuntu1.1), and am running into ...
2
votes
3answers
804 views

Using SSH Keys with Kerberos

So there's an issue that we've been having at our company causing me to pull my hair out for the past week: We have hundreds of server boxes (a mix of CentOS6/7, if it matters) that need to quickly ...
2
votes
1answer
1k views

Joining Linux host to Active Directory fails to update Microsoft DNS

I am joining Linux hosts (CentOS 6) to Active Directory using a special bind account. I've granted delegate permissions to this user and when I join on the default Computers OU, a computer object is ...
0
votes
0answers
44 views

'Kerberos Method' on Samba 3.0

When running sudo net ads join -U admin to add my domain to the realm, I get the error: Unknown parameter encountered: "kerberos method" I found out that kerberos method is not supported by Samba 3....
0
votes
2answers
27 views

How can I audit Ip adresses of users logging into system?

I have a group of servers which use Kerberos for authentication. We distribute keytabs to users but want to ensure that a user never pass their keytab to someone else. Essentially we need to audit the ...
2
votes
1answer
70 views

Privileges when doing sudo to another domain user

Suppose I have a corporate domain mydomain using MS Active Directory. In the domain I have the users myuser and youruser. Now, on one specific Ubuntu machine mymachine, myuser has sudo rights, and ...
0
votes
0answers
10 views

Privileges when doing sudo to another domain user [duplicate]

Suppose I have a corporate domain mydomain using MS Active Directory. In the domain I have the users myuser and youruser. Now, on one specific Ubuntu machine mymachine, myuser has sudo rights, and ...
2
votes
1answer
620 views

Windows 7 versus 8 Access CNAME'd Share

Here's a situation that came up yesterday: we have a share on a machine we have to access using an alias (CNAME). The machine is running Windows Server 2012 R2, and services Windows 7 and 8 clients. ...
0
votes
1answer
109 views

kdm and ssh detecting different fully qualified domain name when using kerberos authentication

I'm attempting to setup Kerberos login support (Windows AD domain providing the kerberos) for Kubuntu 12.04 Linux workstations at the company I'm at. It's almost completely working but I can't get ...
1
vote
2answers
2k views

How to avoid frequent KVNO increases, when using Apache HTTPD with mod_auth_kerb talking to AD?

I've setup Apache HTTPD 2.4 with mod_auth_kerb, created a service account on Active Directory, added a SPN for my http hostname, created a keytab file on the linux machine, and had SSO start working ...
4
votes
0answers
276 views

Samba authentication and LDAP

I have an OpenLDAP server that I use for authentication and authorization for various services. All users are of object type inetOrgPerson and my groups are groupOfNames. Now I want to configure ...
1
vote
1answer
731 views

Ubuntu 14.04 Failing to join domain for Integration with Active Directory (winbind & samba)

I've followed the tutorial at this link https://help.ubuntu.com/community/ActiveDirectoryWinbindHowto Everything seems to be configured somewhat correctly, net rpc join worked and the realm is listed ...
1
vote
1answer
113 views

Active Directory: Permissions to get Kerberos Service Ticket

I have an Active Directory with a KDC running on Windows Server 2012. At the moment, every user can request service tickets for every service from the TGS. I'm looking for a solution where the KDC ...
0
votes
1answer
99 views

Does “Kerberised” NFSv4 securely protect against a malicious client spoofing the user

I have read conflicting statements about whether shares exported via NFSv4 with sec=krb5 are cryptographically protected against a malicious client mounting the share and then spoofing the user to ...
0
votes
2answers
846 views

Apache 2.2 mod_auth_kerb SSO stopped working

I'm all out of ideas why has it just stopped working, here's what I checked: httpd-error.log: [Thu Jun 11 18:04:21 2015] [debug] src/mod_auth_kerb.c(1758): [client 10.105.5.131] ...