Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms

3
votes
1answer
83 views

Does Windows (Active Directory) kerberos use DNS for Realm mapping?

Will Windows clients use DNS to map hosts to specific kerberos realms? Specifically, do they use _kerberos.host.example.com IN TXT OTHERREALM.COM records?
0
votes
1answer
807 views

AD accounts on centos 6.4 not showing up despite successfull wbinfo -u

I have a centos 6.4 box with samba 3.6.9 which I have connected to MS server 2008 R2. That part seems to work fine, since I can see my AD users and groups with wbinfo -u and wbinfo -g. What does not ...
2
votes
1answer
610 views

Why is Kerberos security failing for our ADFS proxy server?

We have a WCF service that uses active federation to authenticate callers via AD FS 2.0 and it's working fine internally. Now we want to expose it to the outside world, so our server team set up a ...
1
vote
1answer
73 views

Conditional authentication based on group membership in AD

I need to authenticate AD users logging into their workstations only if they belong to the security group AT THE MOMENT OF AUTHENTICATION. They're being added to this privileged group right before ...
1
vote
0answers
71 views

Kerberos Single Sign On

I am trying to implement Single Sign On using kerberos with ssh. I changed the below files and restarted the ssh daemon. /etc/ssh_config GSSAPIAuthentication yes GSSAPIDelegateCredentials yes ...
3
votes
1answer
92 views

SPNs and Kerberos Delegation

I would like to check my understanding. This is a fully hypothetical scenario below as I am currently studying for a certification. I have an IIS App Pool with a basic website, which accesses data ...
5
votes
4answers
139 views

Locking a user's account locally when kerberos is enabled

I'm trying to set up Chef-managed accounts for a group of machines with the following characteristics: If there is no local account, login is blocked. If there is a local account with SSH keys, use ...
0
votes
1answer
117 views

Kerberos + Ldap Setup not working with ssh

I have a Kerberos 5 + LDAP configuration in the same server. They both work well (I assume). Kerberos works fine when asking for a TGT. The problem comes when I try to login from client1 to ...
2
votes
1answer
292 views

How to enable Kerberos Authentication Service auditing on 2008 server

I have a 2008-level Windows domain running 5 x 2008 (non-R2) DCs (it's on the roadmap to migrate to R2 or possibly 2012 in the next 9-12 months, but this project needs to be working first), and I need ...
0
votes
1answer
423 views

kerberos cifs multiuser mount from AD PDC

I'm trying to mount a cifs folder on a ubuntu server with multiuser support from a windows DC. I can get user kerberos tickets as root on the server and mount the directory with kerberos without any ...
0
votes
0answers
31 views

Active Directory RealmFlags trust for delegation

I have a setup with a Samba4 AD server. I want to mark my AD as trusted for delegation. So when logging in via putty to my linux server I want the kerberos ticket to be delegated. What I have now is ...
0
votes
0answers
55 views

Tips for troubleshooting 2008R2 GPO settings on 2008 servers

I have a 2008-level Windows domain running 5 x 2008 (non-R2) DCs (it's on the roadmap to migrate to R2 or possibly 2012 in the next 9-12 months, but this project needs to be working first), and I need ...
0
votes
1answer
312 views

Kerberos pre-authentication failed on nfs mount

I have the following nfs export: /home/users 192.168.1.0/24(rw,sec=krb5p,no_subtree_check,nohide,async,anonuid=65534,anongid=65534) When trying to mount that on a client I get: client:/home # ...
0
votes
1answer
81 views

Troubleshooting NFS authentication problems

I am trying to mount a krb5p NFS export. For this I have followed these instructions. Line in /etc/exports: /home/users ...
0
votes
0answers
99 views

Cannot change Kerberos password with passwd

I setted it up a common kerberos authentication for my domain. After that , its working fine without any issues. But a user cannot change the passwordd using linux command. On analysis on this , I ...
0
votes
2answers
58 views

Kerberos with active directory from linux

I have windows stations and a linux server - and I would like to perform SSO using Windows-Kerberos (via Active Directory - the same one all users on the windows station use). And so - I have ...
1
vote
2answers
2k views

2008 DC GPO - “Advanced Audit Policy Configuration” missing?

I'm trying to enable Kerberos Authentication auditing in a GPO for the purpose of sending auth events to an AD-integrated web filter appliance, and the instructions have me enable auditing of the ...
0
votes
1answer
442 views

Active Directory Kerberos issue KDC_ERR_S_PRINCIPAL_UNKNOWN

We are implementing a system where our clients are Windows XP and our server is Windows Server 2008 R2. Ours clients use DCOM to connect COM+ components in our Windows 2008 Server. It works fine when ...
1
vote
0answers
65 views

Kerberos with AuthnProviderAlias

I was configuring some AuthnProviderAliases today and I want to add kerberos to it. The problem is that when I added kerberos apache wouldn't restart and I got the following error in my syslog: ...
1
vote
1answer
332 views

Bind DN entry missing in stash file - while initializing database for realm

I'm trying to run kerberos with ldap back-end on Centos 6.3 After creating Realm with: kdb5_ldap_util -D "cn=admin,dc=example,dc=com" create -sscope sub -sf ...
0
votes
1answer
193 views

NFS + Kerberos: can regular users access mounted directory without Kerberos ticket (kinit)?

I had this issue, which turned out to be caused by lack of Kerberos ticket. So the user can access NFS mount after doing kinit. Is there any way to let users access NFS mounts without a need to ...
0
votes
1answer
50 views

NFS4 with Kerberos: DNS not enough, need entries in /etc/hosts (Why?)

I've had some hard time configuring NFS4 with Kerberos last time. Finally I made it but there are few things I do not fully understand yet. One of them is: why DNS resolution of hostnames is not ...
0
votes
0answers
40 views

I need rpc.gssd to use the short hostname to kinit

I am trying to do a Kerberized NFS mount from CentOS 6.4. The problem is that the Kerberos backend is Active Directory and the UPN is the short hostname rather than the fqdn. I see that rpc.gssd ...
2
votes
1answer
341 views

Company Wide Windows Auth with Chrome and Firefox

I know that we can allow Firefox to allow passing through of Windows credentials by editing the following about:config settings --If using Kerberos-- network.negotiate-auth.trusted-uris ...
1
vote
1answer
92 views

Dig Connection Error on SRV Records

Using Bind9 running on localhost. I have two records in my DNS zone file: _kerberos._udp.GROUP-42.SNOOPY.ISP IN SRV 0 0 88 kirby.group-42.snoopy.isp. kirby.group-42.snoopy.isp. IN A ...
0
votes
1answer
85 views

How to list Samba 4 shares using server's IP and Kerberos authentication?

I am successfully able to list the Samba 4.0.3 shares by using smbclient -L myhostname -k command. However I am unable to do the same by using smbclient -L 192.168.1.2 -k and I get the session ...
0
votes
0answers
147 views

IIS: NTLM authentication works, Negotiate does not

We develop a web application that is installed on-site on customers' servers. In the past months, we've had a curious problem occurring every now and then. We also know how to workaround it, but I'm ...
1
vote
0answers
54 views

Kerberized SSH Failed

I want to authenticate ssh login with Kerberos, however fail. The following is a snippet of ssh debug information with the command ssh -vvv localhost. debug3: Wrote 80 bytes for a total of 1125 ...
0
votes
1answer
708 views

NFS4 + Kerberos: BAD_ENCRYPTION_TYPE, GSS: Encryption type not permitted, hang on “doing downcall”

I am trying to get NFS4 + Kerberos to work on Debian Squeeze. I have 3 test machines: nfsserver, nfsclient, nfskerberos What I've got is: root@nfsclient:~# mount -v -t nfs4 -o sec=krb5 ...
2
votes
1answer
560 views

Active Directory: Thunderbird LDAP autocompletion not working with Kerberos auth

The Problem: I'm trying to configure an LDAP mail autocompletion - a built-in functionality of Mozilla Thunderbird 17.0.5 @ Windows 7 x64 in 2008R2 domain environment. The OS is a fresh, ...
6
votes
0answers
1k views

Kerberos NFS4 permission denied [closed]

** Edit: ** I am not using Sabayon Linux anymore and this problem didn't occur on other distributions. I suggest to close this question. Update: I realized that because of bad hosts file, both ...
0
votes
1answer
203 views

Multihop Kerberos delegation on IIS7 / Windows 2008

So here I am again dealing with probably the number one support question on IIS, SPNs. I am not a novice when it comes to this, having lived the pains of getting SSRS front ends to delegate for SQL ...
1
vote
0answers
190 views

IIS7, Kerberos, sometimes no response from browser to 401

SharePoint 2010 hosted on IIS7, Kerberos enabled. Clients log on through Citrix on several terminal servers. Kerberos is working on several clients, so SPN's are defined correctly, but on some clients ...
0
votes
1answer
101 views

Lag between PAM password acceptance and session open on CentOS5

I have a very interesting situation. I have a server running CentOS5.5, and whenever I try to ssh in using any external interface, there is a 4+ second delay, consistently. There is no such delay ...
1
vote
1answer
328 views

What is the kerberos keytab file used for in UNIX/AD kerberos authentication?

I have proved that UNIX/AD Kerberos authentication works without the presence of a keytab file so I'd like to know whether I should worry about it (given I'll need an individual keytab for each server ...
0
votes
2answers
387 views

RDP in 2008 R2 domain no longer working - possible Kerberos issue

Everything was working fine and no changes were made. For no apparent reason, we can no longer RDP to any domain computers except for the domain controllers themselves. This includes Windows 7 clients ...
1
vote
0answers
329 views

CUPS Negotiate authentication woes

I have been struggling to Kerberize certain services within our domain, one of which is CUPS. The setup is as follows: a central print server connects to each individual printer around the domain and ...
1
vote
1answer
30 views

How do I find out the current remaining lifetime of my AFS tokens?

I can use klog to renew my AFS token, but I am wondering whether there is an equivalent command to view the remaining lifetime of my AFS token.
2
votes
1answer
1k views

solved - SSH instant logout after ssh login kerberos / winbind

I set up a ubuntu server which is authenticating against the active directory of our W2k8 Domain. Everything went well and I see all the users in getent passwd, and wbinfo. I want to be able to use ...
0
votes
2answers
287 views

Kerberos authentication for Git server?

I have a Git server, and I want to make it usable by all Kerberos-logged users. eg: if a user has a valid Kerberos ticket, she can start pushing to Git without having to provide any ...
2
votes
2answers
2k views

Will kerberos work with CNAMEs if I have the SPN created for the A record as well?

We are currently setting up a SQL 2012 environment and it will be used for storing data that will be accessed by SSRS in sharepoint integrated mode. We will be using Kerberos for authentication. ...
1
vote
3answers
146 views

SSH + Kerberos but WITHOUT DNS

I was wondering if there's a way to set up SSH with Kerberos authentication without using a DNS server at all ?
1
vote
1answer
211 views

IIS, SQLServer, Google Chrome and Windows Authentication

I'm searching the internet for almost 4 days now and I'm stuck. I've created a simple ASP MVC4 Intranet website and I have deployed it to server called: iis. That computer is inside the same domain ...
5
votes
3answers
640 views

SSH Kerberos authentication fails with “Wrong principal in request/Got no client credentials” on debian squeeze

I have a debian squeeze host where I can't log in with kerberos without a password prompt. An identically configured ubuntu 12.04 host works fine and can log in without getting a password prompt. ...
1
vote
1answer
588 views

Problems set-up Single Sign-On using Kerberos authentication

I need for Ruby on Rail application set authentication via Active Directory using Kerberos authentication. Some technical information: I are using Apache installed mod_auth_kerb In httpd.conf I ...
7
votes
3answers
341 views

Permissions are not taking effect with Kerberised NFSv4 on FreeBSD

I'm currently trying to set up an NFSv4 server on FreeBSD. I have extensive experience with doing this on other Unices (Solaris and Linux), but I'm fairly new to FreeBSD. My goal is to achieve the ...
0
votes
1answer
74 views

openafs over internet /afs/mycell connection timed out

I am trying to connect to my openafs-server from the internet. kinit user; aklog works, I get the ticket from the kerberos server and the token for afs. As a measure of desperation I put the ...
0
votes
1answer
132 views

F5 authentication using kerberos keytab

Our network gear use tacplus for authentication and authorization. tac itself authenticates using kerberos. For one of the projects we need automated login to a F5 device using a script. Does anyone ...
0
votes
1answer
360 views

Get a user's kerberos ticket updated over VPN

We run a Windows 2008 network (2008 DC level). There are many users who work only from home and connect to the network via VPN. Recently group membership was changed for many of these users and ...
0
votes
1answer
468 views

Can't get postgres and kerberos (gss) working together

I am trying to get postgres and kerberos, via GSSAPI, working together. Having trouble at this point. It does not help that I am really a newbie for both technologies. I have both postgres and ...