Questions tagged [kerberos]

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.

Filter by
Sorted by
Tagged with
2 votes
0 answers
351 views

How to delete Samba and Kerberos data to start everything from scratch?

I'm doing some experiments with Samba and Kerberos on Ubuntu Server Cuttlefish, by installing samba, krb5-config, and winbind. When installing Kerberos in interactive mode, it asked some questions to ...
Livy's user avatar
  • 163
0 votes
0 answers
3k views

The Kerberos client received a KRB_AP_ERR_MODIFIED error from server

I have a situation where Kerberos authentication is failing. I have checked that the SPN is registered under the correct AD user account that runs the service that needs to use Kerberos to ...
Ringo's user avatar
  • 119
2 votes
1 answer
2k views

Kerberos Ticket Hand-off No Good on Chrome on macOS X

I am implementing Okta as a single-sign on provider in an enterprise environment of about 90 users. One of Okta's features is Desktop Single Sign On - the ability for users to be authenticated with ...
user490549's user avatar
1 vote
1 answer
888 views

Can not start sshd service: relocation error

After updating openssh version from 5.3 to 7.9 I am having problems when I try to start sshd service, The script that I executed is: rpm -Uvh openssh-latest-7.9p1-1.el6.cgsl7741.x86_64.rpm --...
AndresM's user avatar
  • 39
1 vote
1 answer
646 views

Kerberos - TCP client wants 1195725856 bytes, cap is 1048572

I'm having some difficulties debugging this error. I'm running nginx as an api gateway built to make a sub-request to kerberos whenever an endpoint gets called using the SPNEGO method. But whenever I ...
Kenpachi's user avatar
0 votes
1 answer
1k views

Kerberos authentication not working with Apache and PHP-FPM

I have configured kerberos authentication in apache with a php-fpm drupal backend. Checking the apache logs it looks fine at first glance but somehow it seems that the authenticated user gets lost ...
macbert's user avatar
  • 153
2 votes
1 answer
3k views

SSSD+Samba+SSH GSSAPI authentication issues

I am configuring SSSD+Samba+SSH on CentOS 7.6. So far I have managed to get all 3 at least working. SSSD is configured and joined using realm join. Samba is configured and connected to AD via net ads ...
Eroji's user avatar
  • 203
3 votes
1 answer
2k views

Can Jenkins utilize the user's Kerberos ticket?

I'm setting up a new Jenkins server. It will authenticate users against the corporate AD. Most of the tasks we have in mind require logging-in to other hosts (via ssh). Can Jenkins be configured to, ...
Mikhail T.'s user avatar
  • 2,377
-1 votes
2 answers
152 views

RedHat Linux : Configure both ldap and Kerberos

Our RHEL servers are setup with LDAP and they work just fine. Users are able to login using their credentials just fine. There is one application that needs kerberos. We are trying to get both LDAP ...
souser's user avatar
  • 197
0 votes
1 answer
1k views

Authentication policy silo failure on Windows Server 2008 R2

We're deploying Active Directory authentication policies and silos to restrict domain admins to domain controllers and server admins to servers which has worked fine on all of our servers from Hyper-V ...
mythofechelon's user avatar
0 votes
1 answer
858 views

Kerberos SPN for one FQDN on multiple servers

This is a bit of a weird one. I'm building a new web server hosted on a LAMP stack to replace an old IIS server. Its intended DNS name is currently occupied by the old server. I have SSL certificates ...
Philippe Haussmann's user avatar
0 votes
1 answer
3k views

Why would setspn -q return "no such spn found" when setspn -l finds the spn?

I'm attempting to troubleshoot why windows authentication is failing for a website hosted in IIS at a customer site. When executing setspn -l serviceUser to list the spns associated with a service ...
Aaron Carlson's user avatar
4 votes
0 answers
11k views

SSSD - Server not found in kerberos database

I've been trying to setup SSSD on a CentOS 7 machine to join with a windows AD for user management. I've managed to get Kerberos working independently of this setup, using LDAPS as the transport ...
lgg's user avatar
  • 41
1 vote
1 answer
4k views

WebSphere SPNEGO - Cannot get credential from JAAS Subject for principal

PROBLEM I get an error trying to enable SPNEGO on the WebSphere application server (WAS ND, single node) 9.0.0.7 . I have succeeded on another server, but for this one I can't find the problem. I ...
nize's user avatar
  • 121
1 vote
1 answer
2k views

mounting DFS filesystem with remote shares in it on Arch Linux

I have laptop joined to domain AAA. Have two DFS namespace servers which are also AD DC with Win Server 2012 R2. NAS is Synology server with CIFS enabled/domain joined. Servers: dc1.domain1.local - ...
pszafer's user avatar
  • 131
1 vote
1 answer
1k views

Kerberos delegation with Apache, SSSD and FreeIPA

Let me start from describing my real goal, because I am not sure that I am trying to solve it in a proper way =) I am simply trying to make my web application obtain Kerberos credentials on behalf of ...
Dmitry Perets's user avatar
1 vote
1 answer
328 views

Recommended deployment for public kerberos

I have configured and enabled an environment that does seamless X.509 / Kerberos authentication for iOS devices. The security concern is the KDC needs to be exposed to the public internet for this to ...
jekennedy's user avatar
  • 113
1 vote
0 answers
648 views

NFS3/4 Performance Issues (Lock-ups) with macOS client using Kerberos

I am trying to access an NFS share using macOS High Sierra and I am having momentary system lock-up issues regardless of whether I use Finder or the command line to copy files to the share. For ...
user3814483's user avatar
0 votes
1 answer
3k views

Kerberos: mount.nfs: access denied by server while mounting

An IPA server providing DNS, NTP and Kerberos auth to two of my lab servers, when tried to mount a Kerberised NFS share, I am getting this error: mount.nfs: access denied by server while mounting ...
Ardneliahs's user avatar
1 vote
0 answers
1k views

Ansible - Kerberos. Can´t find client principal

I have a problem with ansible and Kerberos. If I start a playbook I get the follwing message: fatal: [sgtest002]: UNREACHABLE! => {"changed": false, "msg": "kerberos: authGSSClientInit() failed: ...
Steffen's user avatar
  • 11
2 votes
0 answers
311 views

Is it possible to limit SSRS authentication to Kerberos only?

We have an instance of SSRS (SQL Server Reporting Services) which uses Kerberos Constrained Delegation to fetch data for its reports from SQL Server on behalf of its users. For this purpose, SSRS was ...
Cat Mucius's user avatar
1 vote
1 answer
477 views

Unable to find Plugin

I'm trying to execute this command, kdb5_ldap_util -D cn=ldapadm,dc=c4ilietest,dc=com stashsrvpw -f /etc/krb5.d/stash.keyfile cn=kerberos,dc=c4ilietest,dc=com I get this error kdb5_ldap_util: ...
allthenutsandbolts's user avatar
2 votes
1 answer
46 views

Synchronisation between office365 and local Active Directory via Custom field

I'm trying co connect local Active Directory to office365 for usersync. In this documentation i have found that i need make resolvable suffix in userPrincipalName and move legacy Kerberos principal ...
UNIm95's user avatar
  • 123
0 votes
0 answers
202 views

Is it possible to join two kerberos realms inside the same domain?

In the current environment I am working with there are two LDAP directories, one is a Microsoft Active Directory and the other is a RedHat IDM LDAP Directory. Currently both kerberos realms exist ...
Mark Jackson's user avatar
3 votes
1 answer
2k views

macOS High Sierra issues mounting Kerberized NFSv4 shares

I'm using FreeIPA for LDAP/Kerberos and I've created a principal for a storage appliance (Dell/EMC UnityVSA VM). I have setup the VSA with a keytab from IPA, I've also setup within the VSA the LDAP ...
user3814483's user avatar
1 vote
1 answer
3k views

kdb5_util: Improper format of Kerberos configuration file while initializing Kerberos code

I have this file and when I execute the coammand kdb5_util create -s I get the error"Improper Format" Here is the file includedir /etc/krb5.conf.d/ [logging] default = FILE:/var/log/krb5libs.log ...
allthenutsandbolts's user avatar
0 votes
0 answers
1k views

Duplicate SPN for File Server Alias

I have two Samba4 AD domain members that serve a couple of replicated shares to users at two sites (same domain, different subnets). Bandwidth and latency don't allow for a clustered solution, so ...
canut's user avatar
  • 1
1 vote
2 answers
388 views

Kerberos - what if TGT is stolen en-route?

In Kerberos, the KDC (Key Distribution Center) creates a TGT and sends it back to the client. The client cannot open it and is not supposed to be opened. What if someone is eavesdropping and they ...
CodingYoshi's user avatar
0 votes
1 answer
4k views

CentOS 7 + Apache with LDAP Configuration Issues

I am working on getting a web app set up behind LDAP. We are running Apache 2.4.6 on CentOS 7.6 (Core). Kerberos is configured and working on the server to provide user access via SSH and SCP. In my /...
Wes's user avatar
  • 111
0 votes
2 answers
952 views

ktpass.exe failing with ldap_open failed for default server: 0x3a

I am trying to generate a keytab file using the instructions online here. No matter what I do, whether I run this on a domain controller, a member server, in PowerShell as administrator, in cmd as ...
tacos_tacos_tacos's user avatar
0 votes
1 answer
3k views

SSSD : id don't display groups name subdomain (Child trust)

In dev environnement, with SSSD 1.16.2 (release 13.el7_6.5) on RHEL 7.6 SSSD is configured to request on mch.dev domain. trusted subdomain sub.mch.dev exist (Win2k16) On mch.dev, I have an user '...
Isopote42's user avatar
  • 157
1 vote
2 answers
2k views

Dovecot IMAP authenticating proxy using Kerberos/GSSAPI

I'm trying to set up Dovecot as authenticating reverse proxy, in front of an already running IMAP server to accomplish the following: Have Dovecot authenticate users using Kerberos/GSSAPI (to allow ...
gertvdijk's user avatar
  • 3,574
2 votes
1 answer
3k views

manually expire a kerberos ticket for a session

I am using NFS service over kerberos. The client mounting the NFS share obtains the ticket from kdc server and works perfect in terms of accessing the NFS share. My requirement is that I need to ...
pynix's user avatar
  • 21
0 votes
1 answer
3k views

Kerberos Apache keeps asking for BASIC

After struggling for a very long time with kerberos authentication on my website, I am finally coming to you because I am lost. I am currently creating a classic PHP website and I want to include a ...
B. Clerc's user avatar
0 votes
1 answer
174 views

Compound Permissions on windows 2012R2 using Kerberos Armoring

I am trying to setup NTFS Compound Permissions to limit access from certian devices using Kerberos Armoring. As far as I can tell it should be very easy you just set 2 GPO settings. One for the server ...
JamesT's user avatar
  • 1
1 vote
1 answer
833 views

Kerberos shared secret key creation

There are 3 things that I don't fully understand about kerberos. Let's say that we are adding new server to an AD Domain. KDC creates a shared secret for this server and how is this key send securly ...
varrimatrass's user avatar
2 votes
2 answers
5k views

Kerberos KDC server in a docker container

I'm running a MIT Kerberos KDC and Kadmin server instances on a docker container for convenience. Am able to build it and run it without a problem, with only extracting important configs do a docker ...
runr's user avatar
  • 133
1 vote
2 answers
939 views

Machine Account Password Resets on server and invalid Kerberos tickets on client

According to this TechNet article https://blogs.technet.microsoft.com/askds/2009/02/15/machine-account-password-process-2/ Machine Accounts (Computer Objects) reset internal passwords every 30 days. ...
arainchi's user avatar
  • 141
1 vote
1 answer
564 views

Kerberos authentication to root domain in Active Directory

I have an environment in Active Directory that is composed of a root and a child domain, let's call them my.root.domain.com and root.domain.com I have a RHEL7 server I've spun up which has no problem ...
Eirik Toft's user avatar
0 votes
0 answers
176 views

Prevent LDAP requests

I have a work laptop that I connect to my local lan as well. On it I have a pi-hole. On it I can see that the laptop makes an awful lot of requests to the office domain which of course is not ...
jayb42's user avatar
  • 1
4 votes
1 answer
3k views

PAM with pam_krb5 to authenticate nginx requests

I am aware of the gazzilion pam / nginx questions here and on "Unix/Linux" but they are either unanswered or not related to my setup - so i try again :) TL;dr While the setup works perfectly with an ...
Eugen Mayer's user avatar
2 votes
1 answer
3k views

Authenticate AD user after joining CentOS 7 to Active Directory Domain

I am trying to join a CentOS 7.5 to a Windows Active Directory Domain for authenticating AD users. Although, the joining process has been successful, I'm unable to authenticate any users though. ...
hypersonics's user avatar
4 votes
2 answers
3k views

Exchange 2016 and Sever 2016 DCs: Unknown KDC Encryption type

Team, Exchange environment is all 2016, no mix. Parent and child domains exist, but the functional level of each domain and forest is 2012R2. All domain controllers have been 2012R2 until recently. ...
Joseph's user avatar
  • 218
1 vote
1 answer
1k views

How does NFS figure out which Kerberos creds / principals to give access to?

I'm setting up NFS with Kerberos and following various guides, like NFSv4 with Kerberos on Ubuntu Wiki and How To Use Kerberos to Control Access to NFS Network Shares, amongst others. All guides ...
Saurabh Nanda's user avatar
0 votes
0 answers
476 views

Diagnosing NFSv4 Authentication Issues

I've got a couple of NFSv4 shares (with Kerberos authentication). Most of the time they work quite well, but when there's an issue they can be a pain to fix. I put this down to them being quite ...
Adam Luchjenbroers's user avatar
0 votes
1 answer
335 views

How to configure Kerberos authentication on the browsers which are on CITRIX page?

We are connecting to our secure client network via CITRIX. We are using chrome to open all quick links. like ambari etc. They open and we are good there, but other useful links like RM and HISTORY ...
akash sharma's user avatar
0 votes
1 answer
3k views

How does ssh logins with Kerberos authentication exactly work from every client while Kerberos uses mutual authentication model?

I have my system authentication managed with SSSD which uses Kerberos. As kerberos support mutual authentication model i.e., both client and server should support Kerberos, how exactly does SSH to ...
GP92's user avatar
  • 741
2 votes
1 answer
3k views

How do you setup an NFS4 server that utilises Kerberos authentication from an Active Directory KDC using CentOS Linux release 7.6.1810 (Core)

How do you setup an NFS4 server with Kerberos from Active Directory? I can install and configure an NFS4 server and connect to it, but I can not get Kerberos to work under any circumstances where the ...
Tobias's user avatar
  • 86
0 votes
0 answers
148 views

Configuration NFS v3 Kerberos on Centos 5.x

Platform: CentOS release 5.5 Installed the kb5-libs , krb5-server krb5-workstation in the NFS Server. The NFS Server IP and Machine IP are different. Machine IP : 172.xx.xx.xx NFS Server IP: 169....
BRAJU's user avatar
  • 1
2 votes
2 answers
2k views

Joining workstations to the domain as a member of Protected Users group (Delegation vs User Rights)

Implementing "Protected Users" and coming across this problem that I couldn't find a solution to anywhere. Cannot join computers to the domain with delegation permissions. Instead "Add workstation to ...
Igor Akula's user avatar

1
4 5
6
7 8
24