Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

1
vote
1answer
113 views

Active Directory: Permissions to get Kerberos Service Ticket

I have an Active Directory with a KDC running on Windows Server 2012. At the moment, every user can request service tickets for every service from the TGS. I'm looking for a solution where the KDC ...
0
votes
1answer
99 views

Does “Kerberised” NFSv4 securely protect against a malicious client spoofing the user

I have read conflicting statements about whether shares exported via NFSv4 with sec=krb5 are cryptographically protected against a malicious client mounting the share and then spoofing the user to ...
0
votes
2answers
851 views

Apache 2.2 mod_auth_kerb SSO stopped working

I'm all out of ideas why has it just stopped working, here's what I checked: httpd-error.log: [Thu Jun 11 18:04:21 2015] [debug] src/mod_auth_kerb.c(1758): [client 10.105.5.131] ...
3
votes
1answer
164 views

Windows client damage authorization header (Kerberos) => IIS 400 (Bad Request)

We are facing strange behavior on about 5% of Windows (7 Pro and XP Pro, both 32 and 64 bits) client computers. These computers gets randomly error from IIS server - 400 Bad request. We are using ...
4
votes
1answer
792 views

Changing login-formats for Linux and Active Directory

On CentOS, I run realm list and see login-formats: %U@mydomain.local I'd like to change login-formats: %U@mydomain.local to login-formats: %U How would I go about doing this? I'm assuming there is a ...
2
votes
2answers
2k views

Linux AD integration, unable to login when using Windows Server 2012 DC

I am trying to integrate my CentOS 6.6 servers into Active Directory. I've followed this guide from Red Hat using configuration 3 (SSSD/Kerberos/LDAP). When using a Windows Server 2008 R2 server as ...
4
votes
0answers
341 views

Windows Authentication to a Remote Server within an Intranet Environment

I have several servers (all on the same DC) within an Intranet environment at my company. For simplicity, I'll focus my question on the IIS and SQL Servers. I have an IIS 7.5 web server and a remote ...
0
votes
2answers
65 views

Kerberos PuTTY from non-domain machine via VPN

Feels like I'm missing something fundamental here... Have a non-domain machine (personal machine off site) from which I VPN into our work network. Once connected, from 'klist', it appears my VPN ...
0
votes
1answer
335 views

Kerberos SSO virtualhost different domain

I have a running centos6.6 server who authenticates against a windows 2008 AD with realm EXAMPLE.LOCAL. I have successfully configured an apache webserver for authentication through kerberos keytab ...
0
votes
0answers
134 views

Kerberos constrained delegation

There is a small problem with the setting Kerberos constrained delegation in Active Directory. The scheme works as follows: 1. Client workstation. 2. Web server with Windows 2008 Ent installed IIS (...
0
votes
1answer
120 views

SCOM: SQL Server cannot authenticate using Kerberos

For past few months, we are getting these kind of alert in SCOM stating SQL Server cannot authenticate using Kerberos. One thing to note here is that this alert is coming from only one server not ...
0
votes
1answer
556 views

Samba4 and Kerberos configuration on a dedicated server

I try to set up Samba 4 on a dedicated server from kimsufi.com but I have difficulties configuring Kerberos and Samba4. I am very confused about IP, Realm, Domain, NetBIOS, DNS etc. in Kerberos and ...
0
votes
1answer
35 views

unable to change environment variable using setenv()

I have an a member server with a windows PDC with active directory. Security=ads. I am trying to set an environment variable(credential cache) using C: setenv("CCACHE","cache_name",1); However, ...
0
votes
1answer
4k views

Security-Kerberos Error, event ID 4

I have two new Domain Controllers on new Forest. Servers have DFS and IIS services installed. Everything seemed to go Ok for a While. After updating servers I got new errors. Now once in hour ...
1
vote
1answer
298 views

Unable to join AD domain using Kerberos from kickstart

I am trying to join to the Windows domain in the %post chroot section of my kickstart script using kinit and net commands after setting up the samba, kerberos and sssd configurations in %pre. My ...
2
votes
2answers
873 views

OpenSSH two factor authentication combined with Kerberos / public key

I'm trying to implement two-factor authentication for OpenSSH. The environment is Centos 7 (kernel: 3.10.0-229.1.2.el7.x86_64) with OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013. We have Active ...
1
vote
2answers
267 views

LDAP syncrepl with kerberos authentication

I'm trying to set up a replication server for LDAP using syncrepl. I would like to use Kerberos to authenticate the consumer, because we have it set up, and it seems more secure. The database ...
0
votes
1answer
722 views

Kerberos constrained delegation using Citrix NetScaler

I'm currently evaluating Citrix NetScaler VPX (NS10.5 56.12.nc) as a potential replacement for Microsoft TMG server. Kerberos Constrained Delegation is at the top of my list of mandatory features. ...
1
vote
1answer
7k views

Client not found in kerberos database while getting initial

I am installing Squid3 on Ubuntu 14.10 and I want to integrate it ADDS on windows server 2012 using kerberos 5. My infrastructure are as follows: Default Gateway: 192.168.1.1 DNS & Domain ...
0
votes
2answers
232 views

Integrate Squid Kerberos auth and Squidguard ldapusersearch into AD

I'm having trouble with Squid Kerberos auth and the Squidguard ldapusersearch that I use to apply ACLs by Active Directory groups membership. The problem is : Squid and Squidguard see my user as : ...
5
votes
3answers
3k views

Check Primary Authentication Protocol for Active Directory (NTLM or Kerberos?) [duplicate]

How can I check, from a client machine (in Global Group)(also is local admin), whether the domain controller is authenticating my login request to the domain using NTLM or Kerberos? I know that ...
4
votes
1answer
1k views

Kerberos KDC has no support for encryption type while getting credentials

I am configuring an apache/SSO authentication with an AD with Kerberos. My http server is a Debian Wheezy and the AD is a Windows Server 2012. I generated keytabs files on WS2012 with kpass command ...
0
votes
1answer
141 views

AWS EC2 Server can not access a fileshare over a VPC VPN using the machine name

I have a windows server on EC2 that is connected to my office via VPN. I'm having an issue connecting to file shares over the VPN. I'm able to connect if I use the IP address for example if I use \...
0
votes
1answer
712 views

Troubleshooting kerberos problems with Samba

I've run into an odd problem with Samba 3.6.23. Right now I have a Windows 2008 R2 machine that has trouble accessing shares on a domained Samba box. \\example_serv\my_share : Fails with LOGIN ...
0
votes
1answer
238 views

Mongodb + Kerberos BadValue SASL mechanism GSSAPI is not supported

I am trying to run an instance of mongodb with the authentication mechanism GSS-API. This is the command: mongod --dbpath /home/ec2-user/db/node2/data --auth --setParameter authenticationMechanisms=...
5
votes
2answers
4k views

March 10th Patch Tuesday appears to cause SQL Server client connection problems

Since applying the full set of patches on a Win 7.1 Pro desktop and a Windows 2012 R2 Datacenter Azure server running SQL 2014, SQL Management Studio (2008 and 2014 versions) won't connect to the SQL ...
4
votes
3answers
16k views

SQL Server Windows Authentication fails after tonight's security updates: The login is from an untrusted domain

We have the following setup: One Domain Controller (DC, Server 2003 R2 Standard x64) One SQL Server (SQL, Server 2008 R2 Standard x64) some clients. All machines are in the same domain. All user ...
0
votes
0answers
63 views

Obtain krb ticket for another user

I have a system account in my domain (DOM\sys) and it has access to service cifs/server@DOM. I want to obtain a ticket for this service using my own account (DOM\user). In other words I need sudo-like ...
1
vote
1answer
486 views

Kerberos keytab permissions

Can you share some thoughts on whether a Kerberos keytab should be readable only by root - under all circumstances? Or are there exceptions to this rule? I am setting up a Squid proxy on Debian ...
1
vote
1answer
412 views

Ldap+kerberos authentication through AD

Is it possible to configure ldap+kerberos authentication on a linux machine without joining it to windows domain? I have to create a pool of VMs using RHEVM with a pretty short lifetime and I do not ...
0
votes
1answer
107 views

Slave Kerberos behind NAT - kprop fails: Incorrect net address while decoding database size from client

I want to synchronize MIT Kerberos database from master to slave, which is in a different geographical location. kprop synchronization fails because of a NAT. Is there any solution to have kprop ...
1
vote
1answer
142 views

Kerberos, Active Directory, and Linux/Unix Servers

I have done some research on the topic, but I can't quite find a straight answer to my question. Please tell me if my understanding is correct. Kerberos can be used as the bridge between a Linux/...
1
vote
1answer
861 views

Ubuntu 14.04 Active Directory auth fails after static ip config

I'm having 6 Ubuntu 14.04 servers that are joined to active directory (2003 domain functional level 2008r2 schema) All of the servers work's fine when network interface is configured to use DHCP. But ...
0
votes
2answers
498 views

Authentication fails when using ARR to load balance Lync 2013 internal web services

I'm using Application Request Routing 3.0 on Windows Server 2012 R2 to load balance the internal web services on a Lync 2013 front-end pool; I'm not using it to reverse proxy the external web services ...
4
votes
1answer
53 views

At which point becomes a changed computer group membership active?

When adding a computer object to an AD group, at which point in time does the group membership become active? Is there some kind of kerberos refresh interval (similar to group policy refresh)? I ...
0
votes
1answer
62 views

Client not requesting Kerberos authentication

My client is not requesting Kerberos tickets, but does when using fiddler. I was then advised not to use fiddler and use Wireshark, using this I can see that the client is sending an NTLM ...
0
votes
0answers
122 views

Establish FAST encrypted channel between linux client and windows server

I am trying to setup windows server for FAST encrypted channel support to test OTP pre authentication in kerberos. I have already tested on linux machine by deploying KDC using krb5-1.12.1 source ...
0
votes
3answers
1k views

Alternatives to Kerberos for passwordless server access

I have a bunch of Linux servers and three Windows servers 2008 R2. I would need a solution which would enable passwordless SSH login from each of those servers to all others. I could do this by ...
0
votes
2answers
574 views

kadmin cannot list principals “requires list privileges”

I can authenticate fine via kadmin however cannot list principals? [root@server ~]# kadmin -p admin Authenticating as principal admin with password. Password for admin@org.domain.com: kadmin: ...
2
votes
1answer
750 views

Why is sshd engaging PAM still?

Background/Behavior is: if you ssh to box via and GSSAPI/Kerberos succeeds and you have a local user in /etc/passwd, you login fine per below PAM config. All Good there. But if you don't have a ...
0
votes
1answer
281 views

Setting up Secure Hadoop Cluster - Kerberos security

I setup a HDP 2.2 cluster successfully (1 NM, 3 DNs and 1 client). User accounts to access HDP cluster are created in client and checked these users can submit jobs, by SSH to client node and run ...
0
votes
1answer
4k views

[root@pcm-ipa-01 tmp]# klist klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0)freeipa kadmin admin principal not found

I have installed freeipa on centos and after restarting the service seems to have lost authentication for "kadmin" [root@pcm-ipa-01 ~]# kadmin init Authenticating as principal root/admin@MY.DOMAIN T ...
1
vote
0answers
140 views

JBoss SPNEGO Authentication Renewing Server Kerberos Tickets

We have successfully configured SPNEGO with our webapp on JBoss EAP 6.2, Windows Server 2008, and IE10 using JBoss Negotiation. What is best operational practice for renewing the ticket issued to ...
1
vote
1answer
37 views

Password Delegation with Windows 2008 Server Trusts?

I have a trust setup between two Windows 2008 Active Directory forests. My domains are "local.ad" and "remote.ad". All of my corporate users belong to the remote.ad forest. I have to add the "...
1
vote
1answer
123 views

Kerberos Errors

Need help with the below error. I haven't been able to find much that has helped. Event Source: Security-Kerberos Event ID: 4 Qualifiers: 16384 Version: 0 Level: 2 Task: 0 Opcode: 0 Keywords: ...
0
votes
2answers
297 views

Windows Integrated Authentication with IIS Farm and subapplications

Assume the following site layout www.contoso.com - runs as CONTOSO\sitePool www.contoso.com/subSite1 - runs as CONTOSO\subPool1 www.contoso.com/subSite2 - runs as CONTOSO\subPool2 The pages should ...
3
votes
2answers
4k views

Possible to authenticate Samba via Kerberos but without domain-join?

With a Kerberos config file... [realms] DOMAIN.COM = { kdc = dc1.domain.com admin_server = dc1.domain.com } ...it is possible for Linux to talk to Active Directory for password ...
0
votes
2answers
264 views

Apache/mod_auth_gss authentication failure

Sorry if this is the wrong stackexchange site for this. Based upon the documentation (for reference I also used this blog post) I have this in httpd.conf: # Increase max size of HTTP request headers ...
1
vote
0answers
327 views

IIS 8.5 / Windows Authentication - 401 response on certain clients

We are running a Tomcat application behind a IIS 8.5 Windows Authentication Proxy, the redirect is via the tomcat AJP connector. We now have the problem that on certain clients, the authentication ...
1
vote
0answers
49 views

Kerberized root user on RHEL 5/6

I'm currently involved with getting NFSv4 and Kerberos. We've decided to bite the bullet and try and make the transition. Our environment is: Windows AD LDAP auth on Linux against said AD. RHEL5/...