Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms

9
votes
2answers
824 views

Demoted domain controller still authenticating users

Why is a demoted domain controller still authenticating users? Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
0
votes
2answers
63 views

Configure MSSQL 2008 to use kerberos authentication

I would like to set my current mssql db (2008 and 2012) to authenticate using a linux kerberos server that I have in my environment . The windows station is in a workgroup and I would like to avoid ...
0
votes
0answers
372 views

How to enable kerberos authentication to a Java web app

I'm currently using Centrify to aid with Kerberos/AD integration in our environment. Right now we have Kerberos enabled on a Centrified version of Apache. We are trying to run jnlp files through ...
1
vote
1answer
127 views

Does Kerberos provide Encryption of Application Session data?

I understand kerberos provides authentication using encryption. I see it exchanges session keys. Are those session keys used for applications send their data over that network encryption after ...
1
vote
1answer
179 views

Create kerberos keytab from AD file with more than one SPN

I need to create a Kerberos keytab file from Active Directory with three different SPNs. It's no problem to add different SPNs with setspn -a but when I try to create a keytab file with ktpass ...
1
vote
1answer
281 views

What does squid proxy do when negating acl proxy_auth_regex in rule?

The NTLM auth helper only tags users as authorized if they are member of a AD group. The Kerberos auth helper tags a user as authorized, if he was able to log in, the group check can't be done by the ...
2
votes
2answers
253 views

Apache 2.2.14 / mod_auth_kerb 5.4 : Custom krb5.conf for Apache Instance

Objective: Use Apache/mod_auth_kerb using a custom krb5.conf file, not system standard /etc/krb5.conf. Issue: I've got a strongly regimented environment where we application owners are able to ...
1
vote
1answer
2k views

How to reset Keytab for FreeIPA Server and Client

I followed the standard documentation to install FreeIPA server and client on hosts 'SRV' and 'CLT' respectively. I then added a user 'X' to FreeIPA using Web UI. Now when i try to SSH as X to CLT, i ...
1
vote
0answers
551 views

Encounter an error when configuer secure hadoop : org.apache.hadoop.security.AccessControlException

I try to configure secure hadoop with kerberos. I have started KDC server , generated and copy related keytab to corresponding node. kerberos can work normally (use kinit) but when i try to start ...
0
votes
2answers
8k views

Windows Server Manager Kerberos error 0x80090322

I have been frustrated with this issue for two days now so I finally decided to ask this on serverfault. I'm setting up a Windows lab environment. It has a Win2012R2 domain controller (srv001) and ...
2
votes
1answer
70 views

How does a Kerberos Client determine the Service Name portion of an SPN?

If I deploy a server call FOO/host.example.com@myrealm how does a client become aware that the service name is FOO? ENV: Unix / MIT kerberos 1.4 or 1.10 I see windows has some sort of mapping: How ...
0
votes
1answer
355 views

Add custom headers to HTTP 401 responses from Kerberos mod_auth_kerb

I'm using Apache with mod_auth_kerb to perform HTTP authentication. How do I add custom headers to the 401 Authorization Required response generated by the auth module? The relevant sections of my ...
4
votes
1answer
911 views

How can I force sudo to accept a user's AD password on RHEL6

In our environment we do not join Linux boxes to the Microsoft Domain. We do however setup Kerberos. This allows us to log into the boxes using our AD credentials as long as there is a local account ...
1
vote
0answers
124 views

How Does an Exchange Alternative Service Account Credential work?

I recently had to assist with setting up an Exchange Alternative Service Account (ASA) credential on an Exchange CAS array. We did get the ASA working properly however I have some questions about how ...
2
votes
0answers
1k views

Windows 7 NFS Client Using Kerberos and Linux KDC

I am trying to configure a Windows 7 Enterprise client to mount a NFSv4 share on a Linux NFS server using Kerberos and a Linux KDC. The setup is: IPA Server (OS: Scientific Linux 6.4, Pkg: ...
2
votes
1answer
109 views

OpenLDAP+Kerberos authentication – id (NSS) works, but authentication says user is unknown

I have a central authentication server with OpenLDAP set up and populated, and Kerberos 5, also populated. On an Ubuntu LTS machine, I set up nslcd and kerberos client stuff. This way, issuing the ...
0
votes
1answer
361 views

setting kerberos ktpass ktab all that JAAS

I have a couple of questions on Kerberos on Windows. I want to find out what the purpose of mapping a user to a service using ktpass is. For example I am on windows and I run ktpass like this: ...
4
votes
2answers
5k views

SQL Server running under a domain account cannot register its SPN

I am trying to configure a fresh install of SQL Server to run under a domain account. However, I get intermittent errors when trying to connect to the server using another domain account, and I still ...
1
vote
2answers
2k views

Change local password as root after configuring for MS-AD Kerberos+LDAP

I have followed this excelent post to configure Kerberos + LDAP: http://koo.fi/blog/2013/01/06/ubuntu-12-04-active-directory-authentication/ However, there are some local users used for services. When ...
1
vote
1answer
45 views

Is it possible to set up cross realm Kerberos

We have a setup with an IIS and a SQL server and have implemented Kerberos to use SQL Sercurity directly. We have a AD forest: Internal.local and the setup works fine there. Now the customer wants ...
1
vote
0answers
224 views

Integrating Kerberos authentication on Apache with a Git server

First time asking a question here so I hope I'm in the right place to do so. I've also searched for similar problems on here, but couldn't find anything quite as similar. Here's my problem. We ...
0
votes
0answers
809 views

Mysterious kinit-failure on Debian Jessie

I have a machine with the Samba 4 AD and the second as a client. After two days of good operation, suddenly the kinit stopped working on the client-side. The reason is quite mysterious. It cannot ...
0
votes
2answers
394 views

kadmin interface not working - immediately closes connection

So far I've been doing most of the administration for kerberos with kadmin.local, however, I'm trying to migrate over to using the remote kadmin as it would be better practice and all. What I'm ...
0
votes
1answer
63 views

Mail client with support for gssapi

I have configured Postfix and Cyrus Imap to enable SSO using Kerberos and GSSAPI. I use Thunderbird as a mail client which supports GSSAPI but I wanted to try some other client also. I tried ...
2
votes
0answers
334 views

Authentization agains Samba4 domain controler and not working kinit

I've a problem with Samba 4 and Kerberos. If I call kinit, it writes Client not found in Kerberos database while getting initial credentials. I find out, that the Kerberos works with user name only, ...
1
vote
1answer
767 views

Kerberos on IIS 7.5, unknown error - how to troubleshoot

I have a asp.net site installed on a server owned by a client. The client now, due to using MobileIron for single-sign-on capabilites on mobile devices, requires my site to work with Kerberos ...
-1
votes
1answer
42 views

Setup kerberos on windows 7

I am developping a java web application application for a client which use kerberos spnego to authenticate its user. Kerberos itself is "plugged" to a LDAP They send me a documentation with what to ...
0
votes
1answer
54 views

AFS client error message “tokens have expired”

I see the following syslog entries about once or twice a day on one of my servers. This server backs up files to AFS space using a Kerberos service principal: Dec 6 04:01:06 myserver kernel: ...
1
vote
1answer
122 views

Connecting to Mac OS X VNC with Kerberos authentication [closed]

I'm running Mac OS X Server with remote administration. Apple uses VNC with (I believe) Kerberos authentication. I do NOT use a VNC password, just the user-based authentication. I need to find a VNC ...
2
votes
1answer
1k views

Problems mounting Kerberos authenticated NFS share on CentOS 6.4

I'm trying to mount a Kerberos authenticated NFS share on a CentOS 6.4 machine. I have tried exporting the protected share from both another CentOS 6.4 machine and from our NetApp with the same ...
0
votes
1answer
63 views

To identify which application uses kerberos authentication

i need to identify which application / process requesting kerberos authentication. Eg I have an PC for login i am using windows AD account. In that pc there are several applicationslike outlook, ...
0
votes
1answer
45 views

DNS Portability with regards to LDAP/Kerberos

How portable is a DNS server when it comes to LDAP, especially Kerberos which I am using for authentication? Meaning, how much do I have to change to use the same LDAP server with 2 different DNS ...
3
votes
1answer
328 views

Does IIS NTLM/Kerberos authentication still work with an offline domain controller?

We have multiple IIS instances spread across remote regional branches. Each IIS instance (v.7.5) is running the same application and authenticates its users with Integrated Authentication (NTLM in the ...
1
vote
4answers
14k views

kinit & pam_sss: Cannot find KDC for requested realm while getting initial credentials

I have a very similar problem as described in this thread on CentOS 6.3 authenticating against a 2008R2 AD DC. Here is my krb5.conf, I know for a fact that XXXXXXX.LOCAL is the true domain name: ...
1
vote
2answers
335 views

How does Cron interact with Kerberos for authentication?

I have a CentOS 6.4 machine which is set up with pam_ldap and pam_krb5. It is configured to use our Active Directory servers for authentication. I can SSH into the machine using AD accounts. I have ...
0
votes
1answer
271 views

Kerberos authentication of Windows clients and Redhat 5.5 with Samba PDC?

I already realize that configure Redhat 5.5 as PDC (Primary Domain Controller), and the clients (Windows XP and Windows 2003) can join the realm. The realm name of Linux server is EXAMPLE.COM. ...
0
votes
1answer
254 views

AD Login to Solaris Zone Periodically Not Working

I have a Solaris 11.1 zone named "AZone". I have the zone joined to an Active Directory domain (Windows Server 2008) with the goal of users being able to use their AD account to log in to the Solaris ...
4
votes
2answers
482 views

Is there a way to have tortisesvn use Windows 7 kerberos tickets to auth against an apache svn server?

I have putty able to use gssapi on my Windows 7 x64 clients against kerberos logins for SSH. I.e. it forwards the ticket you get when you log in to windows. I can't figure out how to get tortiseSVN to ...
-1
votes
1answer
62 views

Why there are three rounds of message exchanges for integrated windows authentication for IE

According to the result monitored by fiddler, there are totally 3 handshakes for integrated windows authentication for IE. GET /home - 401 Unauthorized WWW-Authenticate: Negotiate, NTLM GET ...
0
votes
1answer
83 views

Tool to allow Kerberos Authenticated users to modify Firewall settings

I run a firewall on a central router. Recently, several users want to use Skype. Since firewalling Skype virtually means to switch the firewall off, I consider to allow users to temporarily punch ...
1
vote
0answers
265 views

heimdal error Decrypt integrity check failed for checksum type

when I try to authentication with heimdal-kdc ,I get this error in kdc log : (enctype aes256-cts-hmac-sha1-96) error Decrypt integrity check failed for checksum type hmac-sha1-96-aes256, key type ...
2
votes
2answers
139 views

Adding new SPNs to existing service ids

We have a tomcat server using spring-security kerberos to authenticate users to the webpage against active directory. There are around 25 domain controllers. The site has two CNAME based DNS ...
1
vote
2answers
1k views

mounting windows shares on linux while keeping windows permissions

I have a windows share on a windows2003 server (WINJOE) which I want to back up to a Linux machine (LINUXJOE) that is properly joined to the domain. My goal is to backup shared folders of WINJOE to ...
2
votes
2answers
3k views

Apache SSO through Kerberos using Machine Account

I'm attempting to get Apache on Ubuntu 12.04 to authenticate users via Kerberos SSO to a Windows 2008 Active Directory server. Here are a few things that make my situation different: I don't have ...
0
votes
1answer
1k views

Kerberos & signle-sign-on for website

I have a website running on a Linux computer using Apache. I've employed mod_auth_kerb for single-sign-on Kerberos authentication against a Windows Active Directory server. In order for Kerberos to ...
1
vote
1answer
4k views

mod_auth_kerberos “Unspecified GSS failure”

I did an apache 2.4 fresh install. I'd like to use kerberos authentication. I compiled and install mod_auth_kerb modules. here is my config <location "/restriced/"> SSLRequireSSL AuthName ...
1
vote
1answer
110 views

Using Kerberos only for SSO

I've installed Kerberos on the Debian machine that hosts an internal application, to be able to use it to authenticate users against our AD. This works. However, Kerberos seems to feel responsible ...
2
votes
0answers
2k views

Synology DSM4.3 with Kerberos and NFSv4

According to the press releases of Synology DSM4.3 can do NFSv4 and Kerberos. Actually, in the Tab with NFS settings, there is a button for Kerberos settings. But I cannot find any guidance anywhere. ...
1
vote
1answer
293 views

Kerberos using app pool credentials

I have the following setup: ServerA, a web server with an asp.net mvc site ServerB, a web server with an asp.net Web Api service The MVC site on ServerA consumes the Web Api service on ServerB. ...
3
votes
3answers
1k views

Kerberos - Adding a SPN to a Domain User

When adding a new SPN into the Kerberos domain, you have the option of mapping the SPN to a user. In general, I join the domain through Integrated Windows Authentication, and this creates a new ...