Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms

1
vote
1answer
262 views

Cannot change Kerberos password with passwd

I setted it up a common kerberos authentication for my domain. After that , its working fine without any issues. But a user cannot change the passwordd using linux command. On analysis on this , I ...
0
votes
2answers
89 views

Kerberos with active directory from linux

I have windows stations and a linux server - and I would like to perform SSO using Windows-Kerberos (via Active Directory - the same one all users on the windows station use). And so - I have ...
1
vote
2answers
4k views

2008 DC GPO - “Advanced Audit Policy Configuration” missing?

I'm trying to enable Kerberos Authentication auditing in a GPO for the purpose of sending auth events to an AD-integrated web filter appliance, and the instructions have me enable auditing of the ...
1
vote
1answer
1k views

Active Directory Kerberos issue KDC_ERR_S_PRINCIPAL_UNKNOWN

We are implementing a system where our clients are Windows XP and our server is Windows Server 2008 R2. Ours clients use DCOM to connect COM+ components in our Windows 2008 Server. It works fine when ...
1
vote
0answers
107 views

Kerberos with AuthnProviderAlias

I was configuring some AuthnProviderAliases today and I want to add kerberos to it. The problem is that when I added kerberos apache wouldn't restart and I got the following error in my syslog: ...
1
vote
1answer
647 views

Bind DN entry missing in stash file - while initializing database for realm

I'm trying to run kerberos with ldap back-end on Centos 6.3 After creating Realm with: kdb5_ldap_util -D "cn=admin,dc=example,dc=com" create -sscope sub -sf ...
0
votes
1answer
379 views

NFS + Kerberos: can regular users access mounted directory without Kerberos ticket (kinit)?

I had this issue, which turned out to be caused by lack of Kerberos ticket. So the user can access NFS mount after doing kinit. Is there any way to let users access NFS mounts without a need to ...
0
votes
1answer
73 views

NFS4 with Kerberos: DNS not enough, need entries in /etc/hosts (Why?)

I've had some hard time configuring NFS4 with Kerberos last time. Finally I made it but there are few things I do not fully understand yet. One of them is: why DNS resolution of hostnames is not ...
2
votes
1answer
1k views

Company Wide Windows Auth with Chrome and Firefox

I know that we can allow Firefox to allow passing through of Windows credentials by editing the following about:config settings --If using Kerberos-- network.negotiate-auth.trusted-uris ...
1
vote
1answer
189 views

Dig Connection Error on SRV Records

Using Bind9 running on localhost. I have two records in my DNS zone file: _kerberos._udp.GROUP-42.SNOOPY.ISP IN SRV 0 0 88 kirby.group-42.snoopy.isp. kirby.group-42.snoopy.isp. IN A ...
0
votes
1answer
147 views

How to list Samba 4 shares using server's IP and Kerberos authentication?

I am successfully able to list the Samba 4.0.3 shares by using smbclient -L myhostname -k command. However I am unable to do the same by using smbclient -L 192.168.1.2 -k and I get the session ...
1
vote
1answer
174 views

Kerberized SSH Failed

I want to authenticate ssh login with Kerberos, however fail. The following is a snippet of ssh debug information with the command ssh -vvv localhost. debug3: Wrote 80 bytes for a total of 1125 ...
0
votes
1answer
1k views

NFS4 + Kerberos: BAD_ENCRYPTION_TYPE, GSS: Encryption type not permitted, hang on “doing downcall”

I am trying to get NFS4 + Kerberos to work on Debian Squeeze. I have 3 test machines: nfsserver, nfsclient, nfskerberos What I've got is: root@nfsclient:~# mount -v -t nfs4 -o sec=krb5 ...
2
votes
1answer
1k views

Active Directory: Thunderbird LDAP autocompletion not working with Kerberos auth

The Problem: I'm trying to configure an LDAP mail autocompletion - a built-in functionality of Mozilla Thunderbird 17.0.5 @ Windows 7 x64 in 2008R2 domain environment. The OS is a fresh, ...
6
votes
0answers
2k views

Kerberos NFS4 permission denied [closed]

** Edit: ** I am not using Sabayon Linux anymore and this problem didn't occur on other distributions. I suggest to close this question. Update: I realized that because of bad hosts file, both ...
0
votes
1answer
775 views

Multihop Kerberos delegation on IIS7 / Windows 2008

So here I am again dealing with probably the number one support question on IIS, SPNs. I am not a novice when it comes to this, having lived the pains of getting SSRS front ends to delegate for SQL ...
1
vote
0answers
382 views

IIS7, Kerberos, sometimes no response from browser to 401

SharePoint 2010 hosted on IIS7, Kerberos enabled. Clients log on through Citrix on several terminal servers. Kerberos is working on several clients, so SPN's are defined correctly, but on some clients ...
0
votes
1answer
153 views

Lag between PAM password acceptance and session open on CentOS5

I have a very interesting situation. I have a server running CentOS5.5, and whenever I try to ssh in using any external interface, there is a 4+ second delay, consistently. There is no such delay ...
1
vote
1answer
572 views

What is the kerberos keytab file used for in UNIX/AD kerberos authentication?

I have proved that UNIX/AD Kerberos authentication works without the presence of a keytab file so I'd like to know whether I should worry about it (given I'll need an individual keytab for each server ...
0
votes
2answers
549 views

RDP in 2008 R2 domain no longer working - possible Kerberos issue

Everything was working fine and no changes were made. For no apparent reason, we can no longer RDP to any domain computers except for the domain controllers themselves. This includes Windows 7 clients ...
1
vote
0answers
658 views

CUPS Negotiate authentication woes

I have been struggling to Kerberize certain services within our domain, one of which is CUPS. The setup is as follows: a central print server connects to each individual printer around the domain and ...
1
vote
1answer
36 views

How do I find out the current remaining lifetime of my AFS tokens?

I can use klog to renew my AFS token, but I am wondering whether there is an equivalent command to view the remaining lifetime of my AFS token.
2
votes
1answer
2k views

SSH instant logout after ssh login kerberos / winbind

I set up a ubuntu server which is authenticating against the active directory of our W2k8 Domain. Everything went well and I see all the users in getent passwd, and wbinfo. I want to be able to use ...
0
votes
2answers
755 views

Kerberos authentication for Git server?

I have a Git server, and I want to make it usable by all Kerberos-logged users. eg: if a user has a valid Kerberos ticket, she can start pushing to Git without having to provide any ...
2
votes
2answers
3k views

Will kerberos work with CNAMEs if I have the SPN created for the A record as well?

We are currently setting up a SQL 2012 environment and it will be used for storing data that will be accessed by SSRS in sharepoint integrated mode. We will be using Kerberos for authentication. ...
1
vote
3answers
316 views

SSH + Kerberos but WITHOUT DNS

I was wondering if there's a way to set up SSH with Kerberos authentication without using a DNS server at all ?
1
vote
1answer
348 views

IIS, SQLServer, Google Chrome and Windows Authentication

I'm searching the internet for almost 4 days now and I'm stuck. I've created a simple ASP MVC4 Intranet website and I have deployed it to server called: iis. That computer is inside the same domain ...
5
votes
3answers
2k views

SSH Kerberos authentication fails with “Wrong principal in request/Got no client credentials” on debian squeeze

I have a debian squeeze host where I can't log in with kerberos without a password prompt. An identically configured ubuntu 12.04 host works fine and can log in without getting a password prompt. ...
1
vote
1answer
1k views

Problems set-up Single Sign-On using Kerberos authentication

I need for Ruby on Rail application set authentication via Active Directory using Kerberos authentication. Some technical information: I are using Apache installed mod_auth_kerb In httpd.conf I ...
7
votes
3answers
482 views

Permissions are not taking effect with Kerberised NFSv4 on FreeBSD

I'm currently trying to set up an NFSv4 server on FreeBSD. I have extensive experience with doing this on other Unices (Solaris and Linux), but I'm fairly new to FreeBSD. My goal is to achieve the ...
0
votes
2answers
161 views

openafs over internet /afs/mycell connection timed out

I am trying to connect to my openafs-server from the internet. kinit user; aklog works, I get the ticket from the kerberos server and the token for afs. As a measure of desperation I put the ...
0
votes
1answer
183 views

F5 authentication using kerberos keytab

Our network gear use tacplus for authentication and authorization. tac itself authenticates using kerberos. For one of the projects we need automated login to a F5 device using a script. Does anyone ...
0
votes
1answer
661 views

Get a user's kerberos ticket updated over VPN

We run a Windows 2008 network (2008 DC level). There are many users who work only from home and connect to the network via VPN. Recently group membership was changed for many of these users and ...
1
vote
1answer
889 views

Can't get postgres and kerberos (gss) working together

I am trying to get postgres and kerberos, via GSSAPI, working together. Having trouble at this point. It does not help that I am really a newbie for both technologies. I have both postgres and ...
1
vote
1answer
233 views

Meaning of Kerberos e-data field value

I'm using Kerberos on Windows (non-Windows software generates the token) and have been trying to debug a problem. In a network trace, I can see KRB5KRB_ERR_GENERIC is being returned by the IIS ...
2
votes
1answer
3k views

Kerberos authentication failing with 401

We have a .NET MVC 3 application deployed in IIS 7 on our Windows 2008 server (let's call it PROD). The application has Anonymous and Windows Authentication enabled - all others are disabled. The ...
0
votes
1answer
59 views

How to make SSO work on remote machine

I'm fighting with SSO and SSH on Debian Wheezy. Locally it works fine. I'm getting ticket successfully at login. But when I've logged in to the remote machine by SSH without password, klist on the ...
2
votes
1answer
2k views

SSO with Apache and Kerberos issues

I am trying to set up SSO on my Apache web server using Kerberos so that users logged into the local domain are recognised and logged in immediately. I have followed this guide to the letter but I ...
0
votes
1answer
185 views

Fedora 389 ds sasl mapping issue?

I have a fedora client that is authenticating to a centos server running 389 ds and kerberos I can run kinit <my-user-principal> on the fedora client successfully and get a ticket, but no ...
2
votes
3answers
536 views

Unified Authentication between Windows AD and Linux LDAP Server

Does anyone know of a solution that would allow me to do user account synchronization between Windows Active Directory and an LDAP Server hosted on a Linux Server? I'm currently looking at FreeIPA ...
1
vote
0answers
205 views

Mixing Redmine and custom authentication method in a single apache virtualhost for Redmine

I developed on Redmine a plugin to automatically log users using the REMOTE_USER given by Apache when its Kerberos ticket is accepted. This plugin works as long as the user has a corporate login, but ...
1
vote
0answers
129 views

Winbind info shows local users that do not exist

I am setting up Samba on a Linux machine running CentOS 6 (called localhost, and the AD computer I am connecting to is dc.companyname.com), and I have done everything successfully, except when I type ...
2
votes
2answers
2k views

Is there a Kerberos testing tool?

I often use openssl s_client to test and debug SSL connections (to LDAPS or HTTPS services). It allows me to isolate the problem down to SSL, without anything getting in the way. I want to do ...
0
votes
1answer
497 views

Default username format in Active Directory

Since Windows 2000 NTLM has been replaced with Kerberos. Thus Kerberos uses UPNs to identify the users. UPN is also the preferred usernaming format. Now, why does Windows 7 still display a logged in ...
0
votes
3answers
698 views

Kerberos Authentication for workstations not on domain

I have a base understanding of how Kerberos works in an Active Directory environment and the methods it uses to authenticate users and workstations onto the network, but my question is.. since ...
0
votes
1answer
756 views

Mounting samba share authenticated by kerberos automatically through /etc/fstab

I have a samba server working and I can access the different shares with the command smbclient -k //$server.$my_domain.$net/$my_share I would like the mount to be automatically provided at boot ...
9
votes
1answer
390 views

Kerberos authentication, service host and access to KDC

I have a web application (hostname: service.domain.com) and I wish to use Kerberos authentication to identify users that are logged into a Windows domain. Microsoft AD (Windows Server 2008 R2) is ...
1
vote
1answer
805 views

Linux Client Active Directory Authentication stops working when failover

I have an issue with Linux clients trying to AD authentication by targeting a DNS name (corp.example.com). I have 2 Domain Controller servers DC1(10.0.0.3/24), DC2(10.1.0.3/24) both domain controllers ...
2
votes
1answer
3k views

Kerberos broken when upgrading Snow Leopard Server to Mountain Lion

I work for a small company where there's no dedicated system admin. I was tasked with upgrading our file and calendar server to 10.8, which I did by upgrading the OS then installing the server tools ...
1
vote
1answer
110 views

Kerberos credential cache type “DIR:”

How do I set the MIT Kerberos 5 credential cache type to "DIR:"? See Release Notes at http://web.mit.edu/kerberos/krb5-1.10/ "Major changes in 1.10: Add the DIR credential cache type, which can hold ...