Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms

0
votes
1answer
37 views

Configuring “compat” mode for users in Linux OL5x

I wish to enable the "compat" mode for users using the /etc/passwd approach in my Linux OEL5x server. But I am not really sure how "compat" works in linux. I have made the following configurations- ...
1
vote
0answers
538 views

heimdal kerberos in openldap issue

I think I posted this on the wrong 'sister site', so here it is. I'm having a bit of trouble getting Kerberos (Heimdal version) to work nicely with OpenLDAP. The kerberos database is being stored in ...
2
votes
0answers
274 views

issue with heimdal kerberos in ldap backend

I'm having a bit of trouble getting Kerberos (Heimdal version) to work nicely with OpenLDAP. The kerberos database is being stored in LDAP itself. The KDC uses SASL EXTERNAL authentication as root to ...
5
votes
2answers
327 views

Risks of Kerberos Delegation

I've been spending hours upon hours trying to learn and understand Windows Authentication, Kerberos, SPNs, and Constrained Delegation in IIS 7.5. One thing I just don't get is why it is "risky" to ...
3
votes
5answers
4k views

error reading keytab file krb5.keytab

I've noticed these kerberos keytab error messages on both SLES 11.2 and CentOS 6.3: sshd[31442]: pam_krb5[31442]: error reading keytab 'FILE: / etc/ krb5. keytab' /etc/krb5.keytab does not exist on ...
0
votes
1answer
175 views

Updating delegated Kerberos credentials through SSH using GSSAPIRenewalForcesRekey

I've been investigating options for minimizing the amount of credentials that need to be retyped as credentials expire. One of the big problems I'm having now is dealing with delegated credentials, ...
4
votes
1answer
353 views

Kerberos issues after new server of same name joined to domain

Environment: Windows Server 2012, 2 Domain Controllers, 1 domain. A server called Sharepoint1 was joined to the domain (running Sharepoint 2013 using NTLM). The fresh install for Sharepoint1 (OS and ...
1
vote
1answer
352 views

Can a Windows machine authenticate against Samba with Kerberos when users are stored in AD?

I understand the title is probably less clear that it should be, but I couldn't think of anything better. We have two domains, let's call them example.com and subnet.example.com. The former is ...
2
votes
1answer
3k views

“KDC has no support for encryption type” when setting up cross-realm trust between MIT Kerberos and Active Directory

I am currently setting up an environment where I have a set of Solaris and Linux machines, using a dedicated Krberos 5 realm (MIT, on Solaris 11, krb5-config --version returns: Solaris Kerberos (based ...
1
vote
2answers
918 views

Using Apache / Kerberos / Keytab to Authenticate Redmine Users Against Active Directory

Please bare with me, as I am still fresh to these technologies. We have a Debian (squeeze) server to which I have root access. It is running Apache, and Redmine is deployed to the server (currently ...
5
votes
0answers
347 views

What breaks in a Windows domain if a member has a high time skew? [closed]

It's taken for granted by most IT people that in a Windows domain, if a member server's clock is off by more than 5 minutes (or however many minutes you've configured it for) from that of its domain ...
0
votes
1answer
240 views

proxypass and mod_auth_kerb

We have a web application that is protected with mod_auth_kerb. This application works fine inside the LAN. Now we would like to give access to users outside of the LAN to this application. Is there ...
3
votes
1answer
3k views

Impact of increasing the MaxTokenSize for Kerberos Tickets

Recently by migrating form Netware to Windows file servers we have ended up creating a boat load of AD groups. We have now run in to some problems with authenticating and gaining access to resources. ...
0
votes
1answer
266 views

Authentication through mod_auth_kerb should provide website with no user if no TGT provided

Users are authenticated by mod_auth_kerb which works great. Therefore I need to set Require valid-user If there is no valid user Apache fails with an 401 Authorization Required. I would like ...
1
vote
1answer
364 views

Immediate logout after login with PAM, Kerberos, and LDAP

I've set up remote login on a computer using Kerberos and LDAP. I've also configured NFS to mount onto /home so that the user's home directory is the same wherever they login. Kerberos authentication ...
3
votes
2answers
2k views

0x19 KDC_ERR_PREAUTH_REQUIRED in my event log

So I have a server, and every time a user or service account logs on to the machine, an error event is generated in the System log: A Kerberos Error Message was received: on logon session ...
4
votes
2answers
3k views

Setting up a Mac Mountain Lion NFS client to securely access Debian NFS server

Okay, I’m going just about insane here. Trying to set up an OS X (10.8.2) NFS client to connect to Debian (6.0.6) nfs server. I’ve mostly been following instructions here: ...
0
votes
2answers
464 views

Kerberos with LDAP backend still using db2

I've installed and configured LDAP, installed and configured kerberos to use LDAP as the backend, as follows: [dbdefaults] ldap_kerberos_container_dn = dc=voltage,dc=com [dbmodules] ...
0
votes
1answer
316 views

Does Windows 7 store domain account and password in SAM

If my machine has Windows 7 and connect to domain, what happens when domain controller is unavailable ? How do I exactly log in when domain controller is unavailable ? I mean normally it should use ...
1
vote
0answers
467 views

Firefox proxy authentication with Kerberos: one service ticket per connection (Linux)

I am trying to enable proxy authentication via Kerberos for Firefox. The setup is: Active Directory domain (for LDAP and Kerberos; this works and I can log in the computer and get Kerberos tickets ...
1
vote
2answers
982 views

How to cache authentication in Linux using PAM/Kerberos authentication (for CVS)?

We have several Linux servers that authenticate Linux user passwords on our Windows Active Directory Server using PAM and Kerberos 5. The Linux distro we use is CentOS 6. On one system, we have ...
0
votes
1answer
1k views

Kerberos setup on Red Hat

I'm using Red Hat 5 client to authenticate to a Windows 2003 KDC (or trying to anyway), but when I run kinit vwwebseal@VWXAUTHN.LOCAL I get kinit(v5): Cannot find KDC for requested realm while ...
1
vote
0answers
259 views

LSA Cache Entries - NTLM versus Negotiate Windows Authentication Providers

We have a situation, due to a recent employee name change, where the HttpContext.Current.User.Identity.Name property of an ASP.NET web application resolves to the old username. This has been ...
1
vote
1answer
833 views

Apache Kerberos/LDAP: A required input parameter could not be read: An invalid name was supplied (, Unknown error)

(Debian Squeeze) I have Apache authenticating via Kerberos - that works fine. Now I want to restrict the site to a single group only, so I need to add LDAP authorization. I enabled authnz_ldap and ...
1
vote
2answers
1k views

How to automate kinit process to obtain TGT for Kerberos?

I'm currently writing a puppet module to automate the process of joining RHEL servers to an AD domain, with support for Kerberos. Currently I have problems with automatically obtain and cache ...
1
vote
1answer
726 views

nagios - Web interface: authentication through kerberos OK, what about authorization on cgi.cfg?

I have successfully installed nagios, and it provides authentication through apache2 which contacts a kerberos authentication server to authenticate users. Now, users are authenticated, but they ...
0
votes
2answers
433 views

apache using mod_auth_kerb always asks for the password twice

(Debian Squeeze) I'm trying to set apache up to use Kerberos authentication to allow AD users to log in. It is working, but prompts the user twice for a username and password, with the first time ...
0
votes
1answer
343 views

Why does ktutil list show some clients, but kinit says client unknown?

When I run ktutil list, I get a list of several clients. However, when I run kinit for any of the listed clients, I always get client unknown. Any ideas?
3
votes
4answers
11k views

How can I check if my IIS site is using NTLM or Kerberos?

How can I check if my IIS site is using NTLM or Kerberos? And how can I change authentication from Kerberos to NTLM? I'm using IIS 7.5 and I couldn't find any answer to this question, can help me a ...
0
votes
1answer
263 views

kadmin.local -q “addprinc” adds REALM unnecessarily

When I run the command kadmin.local -q "addprinc admin/admin" it adds the realm to the end of user. So admin/admin becomes admin/admin@LBOX.COM This is what I ran. Any suggestions would be awesome. ...
0
votes
1answer
2k views

CIFS SPN Missing

My domain does not have a SPN for CIFS/mydomain.com. My DC is throwing ErrorCode: KDC_ERR_S_PRINCIPAL_UNKNOWN. There are a number of windows workstations on the domain that are trying to use this SPN. ...
1
vote
1answer
399 views

How can I set up an authentication system with single instance storage of credentials and several authentication methods/interfaces?

Background: I have a collection of Linux-based servers (let's say a few dozen) that are hosted in different locations. Some servers are lone satellites while others are hosted together in the same ...
0
votes
1answer
76 views

Accessing Kerberised NFS server from daemons on specific client servers

I have an NFS tree exported from a file server that is secured using Kerberos and uses LDAP for authentication and uid/gid management. Everything works swimmingly for each client machine and each ...
2
votes
0answers
473 views

Grant Kerberos Constrained Delegation to SQL Server 2012 running as Managed Service Account

I can't see how to grant Kerberos Constrained Delegation for a service identified by a Managed Service Account. I have a Windows 2008 R2 functional level single domain single forest, two 2008 R2 SP1 ...
10
votes
2answers
741 views

How can I log into a Domain controller that doesn't trust itself

I have a windows 2008 R2 standalone Domain Controller that I restored from backup. The original DC is offline. When I log in with valid user credentials I get the error: "The security database ...
3
votes
2answers
1k views

RHEL 5.8 Kerberos Active Directory Windows 2003 Server SP2

I am going nuts here trying to debug a problem. So I need to connect this Linux Box to an AD Domain through Kerberos. here is my krb5.conf: [libdefaults] default_realm=OURDOMAIN.COM ...
2
votes
1answer
348 views

Adding local users / passwords on Kerberized Linux box

Right now if I try to add a non-system user not in the university's Kerberos realm I am prompted for a Kerberos password anyway. Obviously there is no password to be entered, so I just press enter and ...
0
votes
1answer
237 views

How to change a Kerberos password on Fedora

How do you forcefully change a user's Kerberos password in Fedora? The only docs I could find mention kpasswd <username>, but this requires the user's current password, which the admin probably ...
1
vote
0answers
178 views

Problems mounting kerberos protected NFS share from a client machine

I have a client Linux (Fedora 16) PC that I want to use to access a NFS share. Running the command mount -v -t nfs4 -o sec=krb5 server.company.com:/home/share/username /media/nfs results in ...
0
votes
0answers
50 views

Deleting file in AFS slow in the morning

When I come into work in the morning the first thing I do is authenticate to Kerberos and run aklog so I can access my AFS file system. I then delete an old tripwire report in my AFS space that I ...
3
votes
2answers
3k views

Integrated Windows Authentication with Apache HTTP Server on Linux

What is the best way to enable Integrated Windows Authentication for a PHP web application running on Apache2/Linux? There is a Windows Domain Controller in the network which should be used for ...
2
votes
2answers
1k views

Apache: how to set custom 401 error page and save original behaviour

I have Kerberos-based authentication with Apache/2.2.3 (Linux/SUSE). When user is trying to open some url, browser ask him about domain login and password like in HTTP Basic Auth. If user cancel such ...
1
vote
3answers
2k views

How can I disable Kerberos authentication for only the root of my site?

I have Kerberos-based authentication and I want to disable it on only root url: http://mysite.com/. And I want it to continue to work fine on any other page like http://mysite.com/page1. I have such ...
0
votes
1answer
351 views

VM image including ready-to-use Kerberos server? [closed]

I implemented client-side Kerberos support to an open source software, and I want to test it. Is there a Virtual Machine image that I could quickly fire up, and that would include a properly working ...
1
vote
1answer
447 views

Firefox not using Kerberos despite being configured to

I am deploying Linux/Firefox on a corporate Kerberos network. I followed this Kerberos-on-Firefox procedure but still Firefox does not connect via the company's Kerberos. I am using Firefox 3.0.18 ...
4
votes
1answer
850 views

Credentials can not be delegated - Alfresco Share

I've hit a brick wall configuring Alfresco 4.0.d on Redhat 6. I'm using Kerberos authentication, it seems to be working normally, and single sign on is working on the main alfresco app itself. I've ...
1
vote
1answer
1k views

ISA 2006 switch to kerberos causes authentication problems for some users

In our large corporate environment we have 4 ISA 2006 servers set up. The users (WinXP IE8) are configured with an automatic proxy configuration script. Recently, the PAC was modified to return FQDN ...
0
votes
1answer
252 views

Cadaver with Kerberos: 401 Unauthorized

How to make Cadaver connect to a WebDAV server that uses Kerberos authentication? Usually cadaver http://localhost:8080/alfresco/webdav works, I can browse files, but on a network with Kerberos I ...
0
votes
4answers
2k views

How to determine the Kerberos realm from an LDAP directory?

I have two Kerberos realms I can authenticate against. One of them I can control, and the other one is external from my point of view. I also have an internal user database in LDAP. Let's say the ...
1
vote
2answers
217 views

iPad revocable vpn access

I'm a programmer at my organization, but somehow got drafted into looking into some server stuff so forgive me of my ignorance: They want to give our sales people secure access to our internal sites ...