Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

1
vote
1answer
4k views

mod_auth_kerberos “Unspecified GSS failure”

I did an apache 2.4 fresh install. I'd like to use kerberos authentication. I compiled and install mod_auth_kerb modules. here is my config <location "/restriced/"> SSLRequireSSL AuthName ...
1
vote
1answer
110 views

Using Kerberos only for SSO

I've installed Kerberos on the Debian machine that hosts an internal application, to be able to use it to authenticate users against our AD. This works. However, Kerberos seems to feel responsible ...
2
votes
0answers
2k views

Synology DSM4.3 with Kerberos and NFSv4

According to the press releases of Synology DSM4.3 can do NFSv4 and Kerberos. Actually, in the Tab with NFS settings, there is a button for Kerberos settings. But I cannot find any guidance anywhere. ...
1
vote
1answer
312 views

Kerberos using app pool credentials

I have the following setup: ServerA, a web server with an asp.net mvc site ServerB, a web server with an asp.net Web Api service The MVC site on ServerA consumes the Web Api service on ServerB. ...
3
votes
3answers
2k views

Kerberos - Adding a SPN to a Domain User

When adding a new SPN into the Kerberos domain, you have the option of mapping the SPN to a user. In general, I join the domain through Integrated Windows Authentication, and this creates a new ...
0
votes
1answer
1k views

How does the Cisco Global Site Selector pass traffic?

I have reason to believe that the Cisco GSS 4400 Series behaves differently from Cisco ACE NLB's, in regards to the way they pass name references. I would like to know the details of how they differ, ...
0
votes
1answer
177 views

Is it possible to securely add an NFSv4 share to an ESXi Server?

I just wondered how to connect an NFSv4 share as storage extension to my ESXi. Since NFSv4 supports Kerberos, ESXi could use Username and Password to connect to the share, while no one else could ...
0
votes
1answer
125 views

Unable to disable Kerberos Single Sign On (SSO)

I've been exploring Kerberos Single Sign On (SSO) to replace NTLM for a Web Application hosted internally within a Windows Domain. After creating Service Principal Names (SPN) for a test service ...
4
votes
2answers
3k views

Web app running as NETWORK SERVICE can connect to SQL Server but windows service running as LOCAL SYSTEM cannot

I have installed a .net web application on a Windows Server 2003 IIS server, running in an Application Pool as NETWORK SERVICE and connecting to SQL Server on a different machine using Integrated ...
1
vote
1answer
393 views

Alfresco with only MIT Kerberos: What authentication.chain?

I want Alfresco to authenticate users using SSO with MIT Kerberos. What authentication.chain should I use? I tried authentication.chain=kerberos1:kerberos without success. Based on this answer I ...
1
vote
1answer
544 views

Why can't cron access a CIFS share using Kerberos authentication?

I'm on CentOS 6.4. Using kstart I have a TGT kept active using the machine account (ie computername$) from Active Directory. The ticket cache is assigned to root and is located at /tmp/krb5cc_0. I ...
3
votes
2answers
152 views

If an IIS hosted site is secured using Kerberos, can Linux machines connect to it?

I'm running into a problem configuring my IIS 7.0 website in a test environment with Kerberos. I have a trial version of Windows Server 2008 R2 with AD DS, AD RMS, DHCP, DNS & IIS roles installed. ...
1
vote
0answers
202 views

Alfresco with Kerberos: Error creating bean with name globalAuthenticationFilter

I configured Alfresco 4.2.c to work with MIT Kerberos, following the documentation. Because the documentation is only for Active Directory, I adapted some part to Kerberos by reading the forum. Upon ...
1
vote
2answers
187 views

Managing user and their credentials in kerberos and openldap system

I am learning to use openldap as backend database for kerberos credentials. It is good that all the programs are working with single sign on. The problem is - I can manage user from kadmin command ...
7
votes
3answers
852 views

Ubuntu 12.04, Windows 2012 Active Directory Integration, Kerberos won't resolve service principals

after having checked the whole internet literally, I hope that I might get help here. I am trying to accomplish integration of ubuntu 12.04 servers into a Windows 2012 active directory with nfs and ...
1
vote
1answer
110 views

krenew command not working : Permission Denied

I am using a Linux server to perform my simulations. The login and the file-system of the server are protected using kerberos. The file-system is supported using NFS. Since my simulations take a lot ...
0
votes
1answer
763 views

Autofs + NFS + LDAP sudo problems

I have a setup very similar to Dan Bishop's Ubuntu 12.04 Ultimate Server Guide. I actually created a series of ansible scripts to automate this process on my github. So I have ldap+kerberos set up ...
4
votes
1answer
9k views

Track Down Which Process/Program is Causing Kerberos pre-authentication error (Code 0x18)

We have a domain account that is being locked out via 1 of 2 servers. The built-in auditing only tells us that much (locked out from SERVER1, SERVER2). The account gets locked out within 5 minutes, ...
0
votes
0answers
2k views

krb5kdc: cannot initialize realm MYDOMAIN

On an out-of-the-box Turnkey Linux Domain Controller, I ran apt-get install krb5-admin-server, and while it ran fine, except for this error (warning?) in the middle of the execution: Setting up ...
2
votes
1answer
513 views

How exactly does the HOST/machine SPN work?

Normally when you set up Kerberos for IIS, you would do something like setspn -A HTTP/machine some_account. When IIS 7 is installed, it registers the SPN "HOST/machine" for its kernel-mode ...
1
vote
1answer
296 views

Root access to kerberized NFSv4 host on Ubuntu

I have a kerberized NFSv4 setup working well under Ubuntu for regular users, but I cannot get it working for root. For most systems, I do not want to allow root access, but I have a couple servers ...
1
vote
0answers
268 views

Problems with kvno + Consultation with kerberos authentication settings

I have clearly identified a problem that I can not solve. I suspect I'm missing something when setting the service running on Centos 6 on Windows Server 2003. First I tell the environment that I'm ...
0
votes
0answers
232 views

Splitting labs into subdomains without breaking Kerberos and Active Directory

So I have a vSphere environment with ever increasing pools of servers. Each pool/group of servers includes something like a firewall/proxy server, and two application servers (mixed environment, Linux ...
2
votes
1answer
93 views

How does one remove an encryption type from a kerberos principal?

I would like to remove all of the des keys from the principal below, but have no idea how to do so without someone inputting the password. kadmin: getprinc user Principal: user@EXAMPLE.COM ...
0
votes
2answers
1k views

Windows Server 2003 -Ktpass - crypto: enum value 'rc4-hmac' is not known

I'm trying to create a keytab with Ktpass on a Windows Server 2003 with: Ktpass -princ host/prueba-mail.ejemplo.org@EJEMPLO.ORG -mapuser host -pass password -crypto rc4-hmac -out UNIXhost.keytab I ...
2
votes
1answer
652 views

Duplicate SPNs causing NTLM fallback

I have duplicate SPNs which are threatening to downgrade the authentication from Kerberos to NTLM showing in the event viewer. How can I safely remove the duplicate SPN's for a SQL account? I have ...
1
vote
0answers
2k views

Server not found in Kerberos database while getting credentials for imap

When running kvno imap/prueba-mail.ejemplo.org@EJEMPLO.ORG get the following error: kvno: Server not found in Kerberos database while getting credentials for imap/prueba-mail.ejemplo.org@EJEMPLO.ORG ...
1
vote
1answer
64 views

Samba need an ip of same network of Windows Active Directory to make the join?

Im working to setup samba in windows network. The goal is windows users from Active Direcotry uses their passwords to log in samba shares. I am not sure if, in this setup, AD server and Samba Server ...
2
votes
1answer
205 views

replace Lock screen with Switch Account screen

User successfully logs in as user@EXAMPLE.COM . User is then mapped to user@ad.example.com via altSecurityIdentities: Kerberos:user@EXAMPLE.COM When the user locks the screen, the lock screen is ...
0
votes
1answer
100 views

kerberos: kadmin interface not working

We are using kerberos for authentication with pam module. We need to reinstall kerberos on another machine. So , I took kerberos dump and planned to restore using it. kdb5_util -sf stash load ...
1
vote
1answer
1k views

Kerberos says there is no KDC at my server's location while getting initial credentials

This is probably some stupid error I've overlooked, but I've been working on this on and off for about a week. Running version 1.10.3 release 17.fc18 This is my krb5.conf [logging] default = ...
0
votes
1answer
42 views

Kerberos authentication between 2 applications

We work on a server 2003 and server 2008 R2 enviroment. I'm familiar with the basic usage of the Kerberos protocol where the protocol authenticates a client when he tries to use a shared resource ...
9
votes
1answer
2k views

IPA vs just LDAP for Linux boxes - looking for a comparison

There are few (~30) Linux (RHEL) boxes and I'm looking for centralized and easy managed solution, mostly for control user accounts. I'm familiar with LDAP, and I deployed a pilot of IPA ver2 from Red ...
1
vote
1answer
577 views

House roaming profiles on realm trusted samba server?

Raison D'être I am attempting, so far unsuccessfully, to house roaming profiles for an Active Directory domain on a realm trusted Ubuntu 12.04LTS ZFS-on-Linux file server. The end goal is to have an ...
3
votes
1answer
152 views

Does Windows (Active Directory) kerberos use DNS for Realm mapping?

Will Windows clients use DNS to map hosts to specific kerberos realms? Specifically, do they use _kerberos.host.example.com IN TXT OTHERREALM.COM records?
0
votes
1answer
3k views

AD accounts on centos 6.4 not showing up despite successfull wbinfo -u

I have a centos 6.4 box with samba 3.6.9 which I have connected to MS server 2008 R2. That part seems to work fine, since I can see my AD users and groups with wbinfo -u and wbinfo -g. What does not ...
2
votes
1answer
1k views

Why is Kerberos security failing for our ADFS proxy server?

We have a WCF service that uses active federation to authenticate callers via AD FS 2.0 and it's working fine internally. Now we want to expose it to the outside world, so our server team set up a ...
1
vote
1answer
104 views

Conditional authentication based on group membership in AD

I need to authenticate AD users logging into their workstations only if they belong to the security group AT THE MOMENT OF AUTHENTICATION. They're being added to this privileged group right before ...
1
vote
0answers
88 views

Kerberos Single Sign On

I am trying to implement Single Sign On using kerberos with ssh. I changed the below files and restarted the ssh daemon. /etc/ssh_config GSSAPIAuthentication yes GSSAPIDelegateCredentials yes ...
3
votes
1answer
158 views

SPNs and Kerberos Delegation

I would like to check my understanding. This is a fully hypothetical scenario below as I am currently studying for a certification. I have an IIS App Pool with a basic website, which accesses data ...
5
votes
4answers
469 views

Locking a user's account locally when kerberos is enabled

I'm trying to set up Chef-managed accounts for a group of machines with the following characteristics: If there is no local account, login is blocked. If there is a local account with SSH keys, use ...
0
votes
1answer
298 views

Kerberos + Ldap Setup not working with ssh

I have a Kerberos 5 + LDAP configuration in the same server. They both work well (I assume). Kerberos works fine when asking for a TGT. The problem comes when I try to login from client1 to ...
3
votes
1answer
2k views

How to enable Kerberos Authentication Service auditing on 2008 server

I have a 2008-level Windows domain running 5 x 2008 (non-R2) DCs (it's on the roadmap to migrate to R2 or possibly 2012 in the next 9-12 months, but this project needs to be working first), and I need ...
0
votes
1answer
2k views

kerberos cifs multiuser mount from AD PDC

I'm trying to mount a cifs folder on a ubuntu server with multiuser support from a windows DC. I can get user kerberos tickets as root on the server and mount the directory with kerberos without any ...
0
votes
1answer
1k views

Kerberos pre-authentication failed on nfs mount

I have the following nfs export: /home/users 192.168.1.0/24(rw,sec=krb5p,no_subtree_check,nohide,async,anonuid=65534,anongid=65534) When trying to mount that on a client I get: client:/home # ...
0
votes
1answer
250 views

Troubleshooting NFS authentication problems

I am trying to mount a krb5p NFS export. For this I have followed these instructions. Line in /etc/exports: /home/users ...
1
vote
1answer
365 views

Cannot change Kerberos password with passwd

I setted it up a common kerberos authentication for my domain. After that , its working fine without any issues. But a user cannot change the passwordd using linux command. On analysis on this , I ...
0
votes
2answers
118 views

Kerberos with active directory from linux

I have windows stations and a linux server - and I would like to perform SSO using Windows-Kerberos (via Active Directory - the same one all users on the windows station use). And so - I have ...
1
vote
2answers
5k views

2008 DC GPO - “Advanced Audit Policy Configuration” missing?

I'm trying to enable Kerberos Authentication auditing in a GPO for the purpose of sending auth events to an AD-integrated web filter appliance, and the instructions have me enable auditing of the ...
1
vote
1answer
1k views

Active Directory Kerberos issue KDC_ERR_S_PRINCIPAL_UNKNOWN

We are implementing a system where our clients are Windows XP and our server is Windows Server 2008 R2. Ours clients use DCOM to connect COM+ components in our Windows 2008 Server. It works fine when ...