Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms

0
votes
2answers
243 views

kadmin interface not working - immediately closes connection

So far I've been doing most of the administration for kerberos with kadmin.local, however, I'm trying to migrate over to using the remote kadmin as it would be better practice and all. What I'm ...
0
votes
1answer
54 views

Mail client with support for gssapi

I have configured Postfix and Cyrus Imap to enable SSO using Kerberos and GSSAPI. I use Thunderbird as a mail client which supports GSSAPI but I wanted to try some other client also. I tried ...
0
votes
0answers
402 views

GSSAPI Error: Server not found in Kerberos database

I'm unable to make working a simple configuration written in Samba Wiki. NSLCD worked fine, when authentized by name and password. But I have no idea, what can I do wrong when following that simple ...
2
votes
0answers
249 views

Authentization agains Samba4 domain controler and not working kinit

I've a problem with Samba 4 and Kerberos. If I call kinit, it writes Client not found in Kerberos database while getting initial credentials. I find out, that the Kerberos works with user name only, ...
1
vote
1answer
447 views

Kerberos on IIS 7.5, unknown error - how to troubleshoot

I have a asp.net site installed on a server owned by a client. The client now, due to using MobileIron for single-sign-on capabilites on mobile devices, requires my site to work with Kerberos ...
-1
votes
1answer
41 views

Setup kerberos on windows 7

I am developping a java web application application for a client which use kerberos spnego to authenticate its user. Kerberos itself is "plugged" to a LDAP They send me a documentation with what to ...
0
votes
0answers
82 views

browse samba shares and login with ssh at the same time[Active Directory]

hello, i have a problem with krb5 and samba. when samba is running(i can browse shares with domain account) i can not login with ssh. And when samba is NOT running i can login with ssh with domain ...
0
votes
1answer
44 views

AFS client error message “tokens have expired”

I see the following syslog entries about once or twice a day on one of my servers. This server backs up files to AFS space using a Kerberos service principal: Dec 6 04:01:06 myserver kernel: ...
1
vote
1answer
89 views

Connecting to Mac OS X VNC with Kerberos authentication [closed]

I'm running Mac OS X Server with remote administration. Apple uses VNC with (I believe) Kerberos authentication. I do NOT use a VNC password, just the user-based authentication. I need to find a VNC ...
1
vote
1answer
572 views

Problems mounting Kerberos authenticated NFS share on CentOS 6.4

I'm trying to mount a Kerberos authenticated NFS share on a CentOS 6.4 machine. I have tried exporting the protected share from both another CentOS 6.4 machine and from our NetApp with the same ...
0
votes
1answer
53 views

To identify which application uses kerberos authentication

i need to identify which application / process requesting kerberos authentication. Eg I have an PC for login i am using windows AD account. In that pc there are several applicationslike outlook, ...
0
votes
1answer
42 views

DNS Portability with regards to LDAP/Kerberos

How portable is a DNS server when it comes to LDAP, especially Kerberos which I am using for authentication? Meaning, how much do I have to change to use the same LDAP server with 2 different DNS ...
3
votes
1answer
240 views

Does IIS NTLM/Kerberos authentication still work with an offline domain controller?

We have multiple IIS instances spread across remote regional branches. Each IIS instance (v.7.5) is running the same application and authenticates its users with Integrated Authentication (NTLM in the ...
1
vote
2answers
7k views

kinit & pam_sss: Cannot find KDC for requested realm while getting initial credentials

I have a very similar problem as described in this thread on CentOS 6.3 authenticating against a 2008R2 AD DC. Here is my krb5.conf, I know for a fact that XXXXXXX.LOCAL is the true domain name: ...
0
votes
0answers
24 views

Get Service_key in the course of kerberos authentication

Built environment 1) Exchange server: The operator system of Exchange server is Windows Server2008R2, We configured it as Active Directory (primary domain controller) used for client ...
1
vote
2answers
227 views

How does Cron interact with Kerberos for authentication?

I have a CentOS 6.4 machine which is set up with pam_ldap and pam_krb5. It is configured to use our Active Directory servers for authentication. I can SSH into the machine using AD accounts. I have ...
0
votes
1answer
165 views

Kerberos authentication of Windows clients and Redhat 5.5 with Samba PDC?

I already realize that configure Redhat 5.5 as PDC (Primary Domain Controller), and the clients (Windows XP and Windows 2003) can join the realm. The realm name of Linux server is EXAMPLE.COM. ...
0
votes
1answer
174 views

AD Login to Solaris Zone Periodically Not Working

I have a Solaris 11.1 zone named "AZone". I have the zone joined to an Active Directory domain (Windows Server 2008) with the goal of users being able to use their AD account to log in to the Solaris ...
3
votes
1answer
250 views

Is there a way to have tortisesvn use Windows 7 kerberos tickets to auth against an apache svn server?

I have putty able to use gssapi on my Windows 7 x64 clients against kerberos logins for SSH. I.e. it forwards the ticket you get when you log in to windows. I can't figure out how to get tortiseSVN to ...
-1
votes
1answer
50 views

Why there are three rounds of message exchanges for integrated windows authentication for IE

According to the result monitored by fiddler, there are totally 3 handshakes for integrated windows authentication for IE. GET /home - 401 Unauthorized WWW-Authenticate: Negotiate, NTLM GET ...
0
votes
1answer
75 views

Tool to allow Kerberos Authenticated users to modify Firewall settings

I run a firewall on a central router. Recently, several users want to use Skype. Since firewalling Skype virtually means to switch the firewall off, I consider to allow users to temporarily punch ...
1
vote
0answers
181 views

heimdal error Decrypt integrity check failed for checksum type

when I try to authentication with heimdal-kdc ,I get this error in kdc log : (enctype aes256-cts-hmac-sha1-96) error Decrypt integrity check failed for checksum type hmac-sha1-96-aes256, key type ...
2
votes
2answers
76 views

Adding new SPNs to existing service ids

We have a tomcat server using spring-security kerberos to authenticate users to the webpage against active directory. There are around 25 domain controllers. The site has two CNAME based DNS ...
1
vote
2answers
649 views

mounting windows shares on linux while keeping windows permissions

I have a windows share on a windows2003 server (WINJOE) which I want to back up to a Linux machine (LINUXJOE) that is properly joined to the domain. My goal is to backup shared folders of WINJOE to ...
2
votes
2answers
2k views

Apache SSO through Kerberos using Machine Account

I'm attempting to get Apache on Ubuntu 12.04 to authenticate users via Kerberos SSO to a Windows 2008 Active Directory server. Here are a few things that make my situation different: I don't have ...
0
votes
1answer
470 views

Kerberos & signle-sign-on for website

I have a website running on a Linux computer using Apache. I've employed mod_auth_kerb for single-sign-on Kerberos authentication against a Windows Active Directory server. In order for Kerberos to ...
1
vote
1answer
2k views

mod_auth_kerberos “Unspecified GSS failure”

I did an apache 2.4 fresh install. I'd like to use kerberos authentication. I compiled and install mod_auth_kerb modules. here is my config <location "/restriced/"> SSLRequireSSL AuthName ...
1
vote
1answer
107 views

Using Kerberos only for SSO

I've installed Kerberos on the Debian machine that hosts an internal application, to be able to use it to authenticate users against our AD. This works. However, Kerberos seems to feel responsible ...
2
votes
0answers
2k views

Synology DSM4.3 with Kerberos and NFSv4

According to the press releases of Synology DSM4.3 can do NFSv4 and Kerberos. Actually, in the Tab with NFS settings, there is a button for Kerberos settings. But I cannot find any guidance anywhere. ...
1
vote
1answer
142 views

Kerberos using app pool credentials

I have the following setup: ServerA, a web server with an asp.net mvc site ServerB, a web server with an asp.net Web Api service The MVC site on ServerA consumes the Web Api service on ServerB. ...
3
votes
3answers
682 views

Kerberos - Adding a SPN to a Domain User

When adding a new SPN into the Kerberos domain, you have the option of mapping the SPN to a user. In general, I join the domain through Integrated Windows Authentication, and this creates a new ...
0
votes
1answer
540 views

How does the Cisco Global Site Selector pass traffic?

I have reason to believe that the Cisco GSS 4400 Series behaves differently from Cisco ACE NLB's, in regards to the way they pass name references. I would like to know the details of how they differ, ...
0
votes
1answer
118 views

Is it possible to securely add an NFSv4 share to an ESXi Server?

I just wondered how to connect an NFSv4 share as storage extension to my ESXi. Since NFSv4 supports Kerberos, ESXi could use Username and Password to connect to the share, while no one else could ...
0
votes
1answer
108 views

Unable to disable Kerberos Single Sign On (SSO)

I've been exploring Kerberos Single Sign On (SSO) to replace NTLM for a Web Application hosted internally within a Windows Domain. After creating Service Principal Names (SPN) for a test service ...
3
votes
2answers
2k views

Web app running as NETWORK SERVICE can connect to SQL Server but windows service running as LOCAL SYSTEM cannot

I have installed a .net web application on a Windows Server 2003 IIS server, running in an Application Pool as NETWORK SERVICE and connecting to SQL Server on a different machine using Integrated ...
1
vote
1answer
271 views

Alfresco with only MIT Kerberos: What authentication.chain?

I want Alfresco to authenticate users using SSO with MIT Kerberos. What authentication.chain should I use? I tried authentication.chain=kerberos1:kerberos without success. Based on this answer I ...
1
vote
1answer
374 views

Why can't cron access a CIFS share using Kerberos authentication?

I'm on CentOS 6.4. Using kstart I have a TGT kept active using the machine account (ie computername$) from Active Directory. The ticket cache is assigned to root and is located at /tmp/krb5cc_0. I ...
3
votes
1answer
92 views

If an IIS hosted site is secured using Kerberos, can Linux machines connect to it?

I'm running into a problem configuring my IIS 7.0 website in a test environment with Kerberos. I have a trial version of Windows Server 2008 R2 with AD DS, AD RMS, DHCP, DNS & IIS roles installed. ...
1
vote
0answers
150 views

Alfresco with Kerberos: Error creating bean with name globalAuthenticationFilter

I configured Alfresco 4.2.c to work with MIT Kerberos, following the documentation. Because the documentation is only for Active Directory, I adapted some part to Kerberos by reading the forum. Upon ...
1
vote
2answers
145 views

Managing user and their credentials in kerberos and openldap system

I am learning to use openldap as backend database for kerberos credentials. It is good that all the programs are working with single sign on. The problem is - I can manage user from kadmin command ...
7
votes
3answers
486 views

Ubuntu 12.04, Windows 2012 Active Directory Integration, Kerberos won't resolve service principals

after having checked the whole internet literally, I hope that I might get help here. I am trying to accomplish integration of ubuntu 12.04 servers into a Windows 2012 active directory with nfs and ...
1
vote
1answer
85 views

krenew command not working : Permission Denied

I am using a Linux server to perform my simulations. The login and the file-system of the server are protected using kerberos. The file-system is supported using NFS. Since my simulations take a lot ...
0
votes
1answer
557 views

Autofs + NFS + LDAP sudo problems

I have a setup very similar to Dan Bishop's Ubuntu 12.04 Ultimate Server Guide. I actually created a series of ansible scripts to automate this process on my github. So I have ldap+kerberos set up ...
4
votes
1answer
4k views

Track Down Which Process/Program is Causing Kerberos pre-authentication error (Code 0x18)

We have a domain account that is being locked out via 1 of 2 servers. The built-in auditing only tells us that much (locked out from SERVER1, SERVER2). The account gets locked out within 5 minutes, ...
0
votes
0answers
1k views

krb5kdc: cannot initialize realm MYDOMAIN

On an out-of-the-box Turnkey Linux Domain Controller, I ran apt-get install krb5-admin-server, and while it ran fine, except for this error (warning?) in the middle of the execution: Setting up ...
1
vote
1answer
213 views

How exactly does the HOST/machine SPN work?

Normally when you set up Kerberos for IIS, you would do something like setspn -A HTTP/machine some_account. When IIS 7 is installed, it registers the SPN "HOST/machine" for its kernel-mode ...
1
vote
1answer
173 views

Root access to kerberized NFSv4 host on Ubuntu

I have a kerberized NFSv4 setup working well under Ubuntu for regular users, but I cannot get it working for root. For most systems, I do not want to allow root access, but I have a couple servers ...
1
vote
0answers
217 views

Problems with kvno + Consultation with kerberos authentication settings

I have clearly identified a problem that I can not solve. I suspect I'm missing something when setting the service running on Centos 6 on Windows Server 2003. First I tell the environment that I'm ...
0
votes
0answers
156 views

Splitting labs into subdomains without breaking Kerberos and Active Directory

So I have a vSphere environment with ever increasing pools of servers. Each pool/group of servers includes something like a firewall/proxy server, and two application servers (mixed environment, Linux ...
2
votes
1answer
76 views

How does one remove an encryption type from a kerberos principal?

I would like to remove all of the des keys from the principal below, but have no idea how to do so without someone inputting the password. kadmin: getprinc user Principal: user@EXAMPLE.COM ...