Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms

3
votes
0answers
267 views

Kerberos, .k5login and sudo

Background: I am using a Debian 7 system which I have integrated with an LDAP+Kerberos system using libnss-ldap, libpam-krb5 and nscd. I have modified sudoers to permit an LDAP group the right to sudo ...
2
votes
1answer
472 views

MSSQLSvc Service Principal Names, Kerberos, and NTLM

Was recently helping a DBA with an issue that appeared to be related to an invalid SPN. Discovered that a good number of SQL service accounts simply don't have an SPN set, resulting in NTLM ...
2
votes
2answers
2k views

nfs4 and kerberos: Wrong principal in request

My client/servers are both running Ubuntu 14.04 and kerberos user authentication works as intended. regular nfs4 mounts also work fine. All machines are running heimdal libraries. I haven't been able ...
3
votes
1answer
242 views

SSH authentication mode selection

I am trying to figure out the SSH mechanism used while I try to ssh onto a production host. I see that the SSH client can choose among the available modes. But I'm not sure which mode is chosen and ...
1
vote
1answer
6k views

keytab auth against samba 4 DC: Client not found in Kerberos database while getting initial credentials

I set up a samba 4 active directory on ubuntu 14.04 following Samba AD DC HOWTO. In principle everything works well but I'm stuck in getting kerberos authentication running using SPNs for web ...
1
vote
2answers
912 views

Kerberized nfs4 mounts ERROR: No credentials found for connection to server

My client/servers are both running ubuntu 14.04 and kerberos user authentication works as intended. regular nfs4 mounts also work fine. All machines are running heimdal libraries. I haven't been able ...
3
votes
2answers
186 views

NFS client keytab: multiple machines

How should one go about setting up client-side keytab files for each client machine to access network services? My working example is NFSv4, which requires each client to have a Kerberos keytab ...
0
votes
0answers
127 views

bugzilla authenticate with kerberos + ldap + SSO

I want to set up bugzilla with SSO, i cannot find any good documentation on how to do this. I have managed to set up ldap login which works fine. now I have set up kerberos on apache which works fine, ...
3
votes
2answers
2k views

Why should I not run setspn.exe on the domain controller?

I found several references (see below) on blogs that the setspn.exe utility should be run from either a client or server machine in the domain, but not from the domain controller itself. ...
2
votes
1answer
1k views

Retreive the current Kerberos KVNO from Active Directory

I have a Kerberos problem with a Linux host connecting to a Windows KDC. I suspect that Kerberos key with the wrong version is to blame. One way to be shure would be to delete the SPN and create it ...
0
votes
1answer
175 views

Clustered instance - kerberos double hop woes

We've recently migrated our virtualised SQL databases to a bare metal solution in an active/active cluster. Everything is working great except SQL Reports. Ok, so a rundown of our setup here as it ...
1
vote
0answers
42 views

Kerberos credentials cache dates reported differently in Debian Squeeze and Debian Wheezy

I have two Debian servers which use same LDAP/Kerberos server, but dates in output of klist on them shown in different format - mm/dd/yyyy on squeeze vs dd/mm/yy on wheezy. Looks like they just use ...
4
votes
3answers
4k views

How to integrate Active Directory with FreeBSD 10.0 using security/sssd?

What are the required steps to authenticate users from an Active Directory running on Windows Server 2012 R2 in FreeBSD 10.0 using sssd with the AD backend with Kerberos TGT working?
4
votes
1answer
2k views

How to remotely generate Windows AD Kerberos keytab from a Unix machine?

I would like to know if it’s possible to create a keytab file direct from a client machine without using the ktpass utility in the Windows Server side. The main reason I would want this, is to ...
1
vote
1answer
114 views

Have Kerberos use AD groups instead of netgroups

Currently we are able to have kerberos authenticate users who are in active directory (AD) and added to ldap created netgroups. We also set their unix attributes and add them to the netgroup. IT ...
0
votes
0answers
144 views

NFS4 and NFS3 mount proble with sec=krb5

I am having a problem when mounting the NFS server share using sec=krb5 The error is WARNING: Failed to create krb5 context for user with uid 0 for server YYY WARNING: Failed to create machine krb5 ...
3
votes
1answer
694 views

“net ads join” fails in puppet exec but runs OK directly from command line

I have the following exec that joins a Linux (CentOS 6) host to an Active Directory domain. When run as root from the bash terminal, it runs successfully and the host is joined to the AD domain ...
6
votes
2answers
2k views

NetApp erroring with: STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT

Since a sitewide upgrade to Windows 7 on desktop, I've started having a problem with virus checking. Specifically - when doing a rename operation on a (filer hosted) CIFS share. The virus checker ...
2
votes
1answer
2k views

Why is MS SQL Server Using NTLM Authentication?

Windows Server 2008 R2. SQL Server 2008 R2 installed. MSSQL Service runs as Local System. Server FQDN is SQL01.domain.com. SQL01 is joined to an Active Directory domain named domain.com. The ...
6
votes
3answers
513 views

Multiple Realms and Multiple TGTs under MIT Kerberos for Windows

My local computer uses Windows 7 Pro and belongs to realm LR, managed by AD servers. I login to my computer while attached to that realm's network. I can view the TGT with MIT Kerberos for Windows ...
2
votes
0answers
410 views

Testing NTLM\kerberos against a public url

I am creating a java open source package that makes it easy to connect with httpclient 3.1 to resources that are protected by ntlm v1/v2 and kerberos. I need to test this tool against real world ...
0
votes
1answer
143 views

LAMP server kerberos config to authenticate against a read only Windows KDC in a dmz

Background: We have a number of AD networks (domains) that are connected through VPNs and have established AD trust relationships. We have an externally hosted web server and have configured ...
0
votes
2answers
2k views

Completely uninstall Kerberos on Ubuntu Server

I am experimenting with Kerberos and messed up the installation. I've tried editing the config files but have had no joy in resolving my problems which currently consist of not being able to ...
0
votes
1answer
604 views

cannot login to domain - kerberos issue?

We cannot login as domain admin on one server but can on others. When I looked at Active Directory, I can see that the computer object doesn't exist for the server we can't login to. There is, however ...
1
vote
0answers
156 views

Samba Authentication

I know it's going to seem like I haven't done the research here, because I have done it, and I know how many related questions and tutorials there are. I have read every tutorial I can find online for ...
1
vote
0answers
91 views

Why does MIT Kerberos kinit warn “Your passwod will expire” when your principal is what is about to expire?

While doing some experimenting I noticed that the MIT Kerberos version 5 "kinit" program will warn you when either your password is about to expire (within 7 days) or when your principal is about to ...
7
votes
1answer
136 views

Kerberos: Separating AS and TGS

In Kerberos, the Authentication Server (AS) and the Ticket Granting Server (TGS) are generally implemented on the same server. This machine is called the Key Distribution Center (KDC). Surely, it ...
2
votes
0answers
41 views

Keberos clock skrew, although the clocks are synchronized

We have an issue during a backup (run every night). This backup is managed by Veeam Backup&Replication : copy 7 virtual machines from one VMware ESXi host. This host is linked to a vCenter server. ...
1
vote
1answer
543 views

Windows Authentication KRB5KRB_AP_ERR_MODIFIED

Let me preface by saying, I've been on this issue for about a week and a half now and I can't figure it out. I think I'm close, but every time I've thought that so far, I was wrong. I've looked at ...
0
votes
0answers
108 views

Any other option than HTTPS + Basic auth for reverse proxied IIS site that uses double hop authentication to SQL server

We've been struggling for a while to get, what I had assumed would be a relatively common scenario to work and would appreciate any pointers. We have 2 x Windows 2012 Servers running IIS Server SQL ...
1
vote
0answers
1k views

Why is my OSX client having so much trouble connecting to our SMB server?

I'm asking this here because I think I'm more likely to find SMB/kerberos experts here than in Ask Different, which seems to be mostly related to OSX client issues. When I first connect to our SMB ...
1
vote
0answers
68 views

Connect an LDAP realm with an AD domain, with the same name?

The situation is a separate group has created an LDAP domain. We'll call it foo.bar. (fyi, none of these are connected in any way to the Internet) They also have a Windows domain and renamed it to ...
2
votes
2answers
106 views

Integrated Windows Authentication not working on PC bound to AD network

Background: Web server running LAMP stack Web server has VPN tunnel to AD network at HQ Multiple AD networks around the globe with VPN tunnels and trust relationships to HQ network Kerberos ...
0
votes
0answers
19 views

Change apache config based on connecting OS

I'm looking for a way to add an "if statement" to an Apache httpd.conf file. I would like to know if it is possible to do something like this: -if OS is Linux- EnableKerberosAuth true ...
0
votes
2answers
3k views

winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm

While looking for reasons why logging in to a samba machines joined to Active Directory is slow I have the strong impression that the following error in my log file could be a hint. Apr 3 14:44:14 ...
0
votes
2answers
1k views

IIS / kerberos not prompting for credentials from Mac clients

I have an IIS server (Server 2008R2/IIS 7.5) configured for kerberos authentication. The kerberos authentication works from clients on Windows (IE and Opera both tested), but when I access the site ...
0
votes
1answer
262 views

IIS Credential Delegation for AppPool in Integrated Pipeline mode

I know there have been mkore than a dozen articles on this topic, but for some reason I have not been able to find a solution. Server WEB1 has IIS7.5 with a site using Windows Authentication (kernel ...
9
votes
2answers
784 views

Demoted domain controller still authenticating users

Why is a demoted domain controller still authenticating users? Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
0
votes
2answers
61 views

Configure MSSQL 2008 to use kerberos authentication

I would like to set my current mssql db (2008 and 2012) to authenticate using a linux kerberos server that I have in my environment . The windows station is in a workgroup and I would like to avoid ...
0
votes
0answers
364 views

How to enable kerberos authentication to a Java web app

I'm currently using Centrify to aid with Kerberos/AD integration in our environment. Right now we have Kerberos enabled on a Centrified version of Apache. We are trying to run jnlp files through ...
1
vote
1answer
116 views

Does Kerberos provide Encryption of Application Session data?

I understand kerberos provides authentication using encryption. I see it exchanges session keys. Are those session keys used for applications send their data over that network encryption after ...
1
vote
1answer
170 views

Create kerberos keytab from AD file with more than one SPN

I need to create a Kerberos keytab file from Active Directory with three different SPNs. It's no problem to add different SPNs with setspn -a but when I try to create a keytab file with ktpass ...
0
votes
0answers
212 views

Cannot authenticate as diradmin - OS X Server 10.6 Workgroup Manager

As far as I can tell, not an uncommon problem: when I try to authenticate as 'diradmin' in Workgroup Manager for /LDAPv3/127.0.0.1 it fails with a login problem: "The login information is not valid ...
1
vote
1answer
266 views

What does squid proxy do when negating acl proxy_auth_regex in rule?

The NTLM auth helper only tags users as authorized if they are member of a AD group. The Kerberos auth helper tags a user as authorized, if he was able to log in, the group check can't be done by the ...
2
votes
2answers
241 views

Apache 2.2.14 / mod_auth_kerb 5.4 : Custom krb5.conf for Apache Instance

Objective: Use Apache/mod_auth_kerb using a custom krb5.conf file, not system standard /etc/krb5.conf. Issue: I've got a strongly regimented environment where we application owners are able to ...
0
votes
1answer
1k views

How to reset Keytab for FreeIPA Server and Client

I followed the standard documentation to install FreeIPA server and client on hosts 'SRV' and 'CLT' respectively. I then added a user 'X' to FreeIPA using Web UI. Now when i try to SSH as X to CLT, i ...
1
vote
0answers
526 views

Encounter an error when configuer secure hadoop : org.apache.hadoop.security.AccessControlException

I try to configure secure hadoop with kerberos. I have started KDC server , generated and copy related keytab to corresponding node. kerberos can work normally (use kinit) but when i try to start ...
0
votes
2answers
7k views

Windows Server Manager Kerberos error 0x80090322

I have been frustrated with this issue for two days now so I finally decided to ask this on serverfault. I'm setting up a Windows lab environment. It has a Win2012R2 domain controller (srv001) and ...
2
votes
1answer
68 views

How does a Kerberos Client determine the Service Name portion of an SPN?

If I deploy a server call FOO/host.example.com@myrealm how does a client become aware that the service name is FOO? ENV: Unix / MIT kerberos 1.4 or 1.10 I see windows has some sort of mapping: How ...
0
votes
1answer
327 views

Add custom headers to HTTP 401 responses from Kerberos mod_auth_kerb

I'm using Apache with mod_auth_kerb to perform HTTP authentication. How do I add custom headers to the 401 Authorization Required response generated by the auth module? The relevant sections of my ...