Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms

0
votes
1answer
1k views

NFS4 + Kerberos: BAD_ENCRYPTION_TYPE, GSS: Encryption type not permitted, hang on “doing downcall”

I am trying to get NFS4 + Kerberos to work on Debian Squeeze. I have 3 test machines: nfsserver, nfsclient, nfskerberos What I've got is: root@nfsclient:~# mount -v -t nfs4 -o sec=krb5 ...
2
votes
1answer
1k views

Active Directory: Thunderbird LDAP autocompletion not working with Kerberos auth

The Problem: I'm trying to configure an LDAP mail autocompletion - a built-in functionality of Mozilla Thunderbird 17.0.5 @ Windows 7 x64 in 2008R2 domain environment. The OS is a fresh, ...
6
votes
0answers
2k views

Kerberos NFS4 permission denied [closed]

** Edit: ** I am not using Sabayon Linux anymore and this problem didn't occur on other distributions. I suggest to close this question. Update: I realized that because of bad hosts file, both ...
0
votes
1answer
724 views

Multihop Kerberos delegation on IIS7 / Windows 2008

So here I am again dealing with probably the number one support question on IIS, SPNs. I am not a novice when it comes to this, having lived the pains of getting SSRS front ends to delegate for SQL ...
1
vote
0answers
353 views

IIS7, Kerberos, sometimes no response from browser to 401

SharePoint 2010 hosted on IIS7, Kerberos enabled. Clients log on through Citrix on several terminal servers. Kerberos is working on several clients, so SPN's are defined correctly, but on some clients ...
0
votes
1answer
148 views

Lag between PAM password acceptance and session open on CentOS5

I have a very interesting situation. I have a server running CentOS5.5, and whenever I try to ssh in using any external interface, there is a 4+ second delay, consistently. There is no such delay ...
1
vote
1answer
557 views

What is the kerberos keytab file used for in UNIX/AD kerberos authentication?

I have proved that UNIX/AD Kerberos authentication works without the presence of a keytab file so I'd like to know whether I should worry about it (given I'll need an individual keytab for each server ...
0
votes
2answers
525 views

RDP in 2008 R2 domain no longer working - possible Kerberos issue

Everything was working fine and no changes were made. For no apparent reason, we can no longer RDP to any domain computers except for the domain controllers themselves. This includes Windows 7 clients ...
1
vote
0answers
628 views

CUPS Negotiate authentication woes

I have been struggling to Kerberize certain services within our domain, one of which is CUPS. The setup is as follows: a central print server connects to each individual printer around the domain and ...
1
vote
1answer
36 views

How do I find out the current remaining lifetime of my AFS tokens?

I can use klog to renew my AFS token, but I am wondering whether there is an equivalent command to view the remaining lifetime of my AFS token.
2
votes
1answer
2k views

SSH instant logout after ssh login kerberos / winbind

I set up a ubuntu server which is authenticating against the active directory of our W2k8 Domain. Everything went well and I see all the users in getent passwd, and wbinfo. I want to be able to use ...
0
votes
2answers
688 views

Kerberos authentication for Git server?

I have a Git server, and I want to make it usable by all Kerberos-logged users. eg: if a user has a valid Kerberos ticket, she can start pushing to Git without having to provide any ...
2
votes
2answers
3k views

Will kerberos work with CNAMEs if I have the SPN created for the A record as well?

We are currently setting up a SQL 2012 environment and it will be used for storing data that will be accessed by SSRS in sharepoint integrated mode. We will be using Kerberos for authentication. ...
1
vote
3answers
299 views

SSH + Kerberos but WITHOUT DNS

I was wondering if there's a way to set up SSH with Kerberos authentication without using a DNS server at all ?
1
vote
1answer
338 views

IIS, SQLServer, Google Chrome and Windows Authentication

I'm searching the internet for almost 4 days now and I'm stuck. I've created a simple ASP MVC4 Intranet website and I have deployed it to server called: iis. That computer is inside the same domain ...
5
votes
3answers
2k views

SSH Kerberos authentication fails with “Wrong principal in request/Got no client credentials” on debian squeeze

I have a debian squeeze host where I can't log in with kerberos without a password prompt. An identically configured ubuntu 12.04 host works fine and can log in without getting a password prompt. ...
1
vote
1answer
1k views

Problems set-up Single Sign-On using Kerberos authentication

I need for Ruby on Rail application set authentication via Active Directory using Kerberos authentication. Some technical information: I are using Apache installed mod_auth_kerb In httpd.conf I ...
7
votes
3answers
465 views

Permissions are not taking effect with Kerberised NFSv4 on FreeBSD

I'm currently trying to set up an NFSv4 server on FreeBSD. I have extensive experience with doing this on other Unices (Solaris and Linux), but I'm fairly new to FreeBSD. My goal is to achieve the ...
0
votes
2answers
146 views

openafs over internet /afs/mycell connection timed out

I am trying to connect to my openafs-server from the internet. kinit user; aklog works, I get the ticket from the kerberos server and the token for afs. As a measure of desperation I put the ...
0
votes
1answer
175 views

F5 authentication using kerberos keytab

Our network gear use tacplus for authentication and authorization. tac itself authenticates using kerberos. For one of the projects we need automated login to a F5 device using a script. Does anyone ...
0
votes
1answer
622 views

Get a user's kerberos ticket updated over VPN

We run a Windows 2008 network (2008 DC level). There are many users who work only from home and connect to the network via VPN. Recently group membership was changed for many of these users and ...
1
vote
1answer
845 views

Can't get postgres and kerberos (gss) working together

I am trying to get postgres and kerberos, via GSSAPI, working together. Having trouble at this point. It does not help that I am really a newbie for both technologies. I have both postgres and ...
1
vote
1answer
219 views

Meaning of Kerberos e-data field value

I'm using Kerberos on Windows (non-Windows software generates the token) and have been trying to debug a problem. In a network trace, I can see KRB5KRB_ERR_GENERIC is being returned by the IIS ...
2
votes
1answer
2k views

Kerberos authentication failing with 401

We have a .NET MVC 3 application deployed in IIS 7 on our Windows 2008 server (let's call it PROD). The application has Anonymous and Windows Authentication enabled - all others are disabled. The ...
0
votes
1answer
59 views

How to make SSO work on remote machine

I'm fighting with SSO and SSH on Debian Wheezy. Locally it works fine. I'm getting ticket successfully at login. But when I've logged in to the remote machine by SSH without password, klist on the ...
2
votes
1answer
2k views

SSO with Apache and Kerberos issues

I am trying to set up SSO on my Apache web server using Kerberos so that users logged into the local domain are recognised and logged in immediately. I have followed this guide to the letter but I ...
0
votes
1answer
175 views

Fedora 389 ds sasl mapping issue?

I have a fedora client that is authenticating to a centos server running 389 ds and kerberos I can run kinit <my-user-principal> on the fedora client successfully and get a ticket, but no ...
2
votes
3answers
517 views

Unified Authentication between Windows AD and Linux LDAP Server

Does anyone know of a solution that would allow me to do user account synchronization between Windows Active Directory and an LDAP Server hosted on a Linux Server? I'm currently looking at FreeIPA ...
1
vote
0answers
201 views

Mixing Redmine and custom authentication method in a single apache virtualhost for Redmine

I developed on Redmine a plugin to automatically log users using the REMOTE_USER given by Apache when its Kerberos ticket is accepted. This plugin works as long as the user has a corporate login, but ...
1
vote
0answers
126 views

Winbind info shows local users that do not exist

I am setting up Samba on a Linux machine running CentOS 6 (called localhost, and the AD computer I am connecting to is dc.companyname.com), and I have done everything successfully, except when I type ...
2
votes
2answers
1k views

Is there a Kerberos testing tool?

I often use openssl s_client to test and debug SSL connections (to LDAPS or HTTPS services). It allows me to isolate the problem down to SSL, without anything getting in the way. I want to do ...
0
votes
1answer
483 views

Default username format in Active Directory

Since Windows 2000 NTLM has been replaced with Kerberos. Thus Kerberos uses UPNs to identify the users. UPN is also the preferred usernaming format. Now, why does Windows 7 still display a logged in ...
0
votes
3answers
642 views

Kerberos Authentication for workstations not on domain

I have a base understanding of how Kerberos works in an Active Directory environment and the methods it uses to authenticate users and workstations onto the network, but my question is.. since ...
0
votes
1answer
710 views

Mounting samba share authenticated by kerberos automatically through /etc/fstab

I have a samba server working and I can access the different shares with the command smbclient -k //$server.$my_domain.$net/$my_share I would like the mount to be automatically provided at boot ...
9
votes
1answer
378 views

Kerberos authentication, service host and access to KDC

I have a web application (hostname: service.domain.com) and I wish to use Kerberos authentication to identify users that are logged into a Windows domain. Microsoft AD (Windows Server 2008 R2) is ...
1
vote
1answer
775 views

Linux Client Active Directory Authentication stops working when failover

I have an issue with Linux clients trying to AD authentication by targeting a DNS name (corp.example.com). I have 2 Domain Controller servers DC1(10.0.0.3/24), DC2(10.1.0.3/24) both domain controllers ...
2
votes
1answer
3k views

Kerberos broken when upgrading Snow Leopard Server to Mountain Lion

I work for a small company where there's no dedicated system admin. I was tasked with upgrading our file and calendar server to 10.8, which I did by upgrading the OS then installing the server tools ...
1
vote
1answer
102 views

Kerberos credential cache type “DIR:”

How do I set the MIT Kerberos 5 credential cache type to "DIR:"? See Release Notes at http://web.mit.edu/kerberos/krb5-1.10/ "Major changes in 1.10: Add the DIR credential cache type, which can hold ...
0
votes
1answer
126 views

Kerberos: Running an app with a parameter using krenew

I need to run an application with krenew, but the application also needs to receive a parameter via command line and I need to send its output to a file. From the documentation, it looks like this ...
1
vote
0answers
131 views

Kerberos: connection from win app running from IIS to SQL failed

I have an IIS web-application with Windows authentication and impersonation. This application connects to SQL server. In this case Kerberos works fine. But there is a problem. Web-application runs ...
1
vote
1answer
733 views

Cannot access shares via \\servername but \\ip works

To set up the scenario: One of our techs set one of the domain controllers to use Microsoft time. The time IS correct (including Time Zone) and DOES match the other domain controller's time; it was ...
0
votes
1answer
41 views

Configuring “compat” mode for users in Linux OL5x

I wish to enable the "compat" mode for users using the /etc/passwd approach in my Linux OEL5x server. But I am not really sure how "compat" works in linux. I have made the following configurations- ...
1
vote
0answers
739 views

heimdal kerberos in openldap issue

I think I posted this on the wrong 'sister site', so here it is. I'm having a bit of trouble getting Kerberos (Heimdal version) to work nicely with OpenLDAP. The kerberos database is being stored in ...
2
votes
0answers
330 views

issue with heimdal kerberos in ldap backend

I'm having a bit of trouble getting Kerberos (Heimdal version) to work nicely with OpenLDAP. The kerberos database is being stored in LDAP itself. The KDC uses SASL EXTERNAL authentication as root to ...
5
votes
2answers
459 views

Risks of Kerberos Delegation

I've been spending hours upon hours trying to learn and understand Windows Authentication, Kerberos, SPNs, and Constrained Delegation in IIS 7.5. One thing I just don't get is why it is "risky" to ...
3
votes
4answers
5k views

error reading keytab file krb5.keytab

I've noticed these kerberos keytab error messages on both SLES 11.2 and CentOS 6.3: sshd[31442]: pam_krb5[31442]: error reading keytab 'FILE: / etc/ krb5. keytab' /etc/krb5.keytab does not exist on ...
0
votes
1answer
226 views

Updating delegated Kerberos credentials through SSH using GSSAPIRenewalForcesRekey

I've been investigating options for minimizing the amount of credentials that need to be retyped as credentials expire. One of the big problems I'm having now is dealing with delegated credentials, ...
4
votes
1answer
439 views

Kerberos issues after new server of same name joined to domain

Environment: Windows Server 2012, 2 Domain Controllers, 1 domain. A server called Sharepoint1 was joined to the domain (running Sharepoint 2013 using NTLM). The fresh install for Sharepoint1 (OS and ...
1
vote
1answer
523 views

Can a Windows machine authenticate against Samba with Kerberos when users are stored in AD?

I understand the title is probably less clear that it should be, but I couldn't think of anything better. We have two domains, let's call them example.com and subnet.example.com. The former is ...
2
votes
1answer
5k views

“KDC has no support for encryption type” when setting up cross-realm trust between MIT Kerberos and Active Directory

I am currently setting up an environment where I have a set of Solaris and Linux machines, using a dedicated Krberos 5 realm (MIT, on Solaris 11, krb5-config --version returns: Solaris Kerberos (based ...