Questions tagged [kerberos]
Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.
1,198
questions
2
votes
0
answers
351
views
How to delete Samba and Kerberos data to start everything from scratch?
I'm doing some experiments with Samba and Kerberos on Ubuntu Server Cuttlefish, by installing samba, krb5-config, and winbind. When installing Kerberos in interactive mode, it asked some questions to ...
0
votes
0
answers
3k
views
The Kerberos client received a KRB_AP_ERR_MODIFIED error from server
I have a situation where Kerberos authentication is failing.
I have checked that the SPN is registered under the correct AD user account that runs the service that needs to use Kerberos to ...
2
votes
1
answer
2k
views
Kerberos Ticket Hand-off No Good on Chrome on macOS X
I am implementing Okta as a single-sign on provider in an enterprise environment of about 90 users. One of Okta's features is Desktop Single Sign On - the ability for users to be authenticated with ...
1
vote
1
answer
888
views
Can not start sshd service: relocation error
After updating openssh version from 5.3 to 7.9 I am having problems when I try to start sshd service,
The script that I executed is:
rpm -Uvh openssh-latest-7.9p1-1.el6.cgsl7741.x86_64.rpm --...
1
vote
1
answer
646
views
Kerberos - TCP client wants 1195725856 bytes, cap is 1048572
I'm having some difficulties debugging this error. I'm running nginx as an api gateway built to make a sub-request to kerberos whenever an endpoint gets called using the SPNEGO method. But whenever I ...
0
votes
1
answer
1k
views
Kerberos authentication not working with Apache and PHP-FPM
I have configured kerberos authentication in apache with a php-fpm drupal backend.
Checking the apache logs it looks fine at first glance but somehow it seems that the authenticated user gets lost ...
2
votes
1
answer
3k
views
SSSD+Samba+SSH GSSAPI authentication issues
I am configuring SSSD+Samba+SSH on CentOS 7.6. So far I have managed to get all 3 at least working. SSSD is configured and joined using realm join. Samba is configured and connected to AD via net ads ...
3
votes
1
answer
2k
views
Can Jenkins utilize the user's Kerberos ticket?
I'm setting up a new Jenkins server. It will authenticate users against the corporate AD. Most of the tasks we have in mind require logging-in to other hosts (via ssh).
Can Jenkins be configured to, ...
-1
votes
2
answers
152
views
RedHat Linux : Configure both ldap and Kerberos
Our RHEL servers are setup with LDAP and they work just fine. Users are able to login using their credentials just fine.
There is one application that needs kerberos. We are trying to get both LDAP ...
0
votes
1
answer
1k
views
Authentication policy silo failure on Windows Server 2008 R2
We're deploying Active Directory authentication policies and silos to restrict domain admins to domain controllers and server admins to servers which has worked fine on all of our servers from Hyper-V ...
0
votes
1
answer
858
views
Kerberos SPN for one FQDN on multiple servers
This is a bit of a weird one. I'm building a new web server hosted on a LAMP stack to replace an old IIS server. Its intended DNS name is currently occupied by the old server. I have SSL certificates ...
0
votes
1
answer
3k
views
Why would setspn -q return "no such spn found" when setspn -l finds the spn?
I'm attempting to troubleshoot why windows authentication is failing for a website hosted in IIS at a customer site. When executing setspn -l serviceUser to list the spns associated with a service ...
4
votes
0
answers
11k
views
SSSD - Server not found in kerberos database
I've been trying to setup SSSD on a CentOS 7 machine to join with a windows AD for user management.
I've managed to get Kerberos working independently of this setup, using LDAPS as the transport ...
1
vote
1
answer
4k
views
WebSphere SPNEGO - Cannot get credential from JAAS Subject for principal
PROBLEM
I get an error trying to enable SPNEGO on the WebSphere application server (WAS ND, single node) 9.0.0.7 . I have succeeded on another server, but for this one I can't find the problem.
I ...
1
vote
1
answer
2k
views
mounting DFS filesystem with remote shares in it on Arch Linux
I have laptop joined to domain AAA.
Have two DFS namespace servers which are also AD DC with Win Server 2012 R2.
NAS is Synology server with CIFS enabled/domain joined.
Servers:
dc1.domain1.local - ...
1
vote
1
answer
1k
views
Kerberos delegation with Apache, SSSD and FreeIPA
Let me start from describing my real goal, because I am not sure that I am trying to solve it in a proper way =)
I am simply trying to make my web application obtain Kerberos credentials on behalf of ...
1
vote
1
answer
328
views
Recommended deployment for public kerberos
I have configured and enabled an environment that does seamless X.509 / Kerberos authentication for iOS devices. The security concern is the KDC needs to be exposed to the public internet for this to ...
1
vote
0
answers
648
views
NFS3/4 Performance Issues (Lock-ups) with macOS client using Kerberos
I am trying to access an NFS share using macOS High Sierra and I am having momentary system lock-up issues regardless of whether I use Finder or the command line to copy files to the share.
For ...
0
votes
1
answer
3k
views
Kerberos: mount.nfs: access denied by server while mounting
An IPA server providing DNS, NTP and Kerberos auth to two of my lab servers, when tried to mount a Kerberised NFS share, I am getting this error:
mount.nfs: access denied by server while mounting
...
1
vote
0
answers
1k
views
Ansible - Kerberos. Can´t find client principal
I have a problem with ansible and Kerberos.
If I start a playbook I get the follwing message:
fatal: [sgtest002]: UNREACHABLE! => {"changed": false, "msg":
"kerberos: authGSSClientInit() failed: ...
2
votes
0
answers
311
views
Is it possible to limit SSRS authentication to Kerberos only?
We have an instance of SSRS (SQL Server Reporting Services) which uses Kerberos Constrained Delegation to fetch data for its reports from SQL Server on behalf of its users.
For this purpose, SSRS was ...
1
vote
1
answer
477
views
Unable to find Plugin
I'm trying to execute this command,
kdb5_ldap_util -D cn=ldapadm,dc=c4ilietest,dc=com stashsrvpw -f /etc/krb5.d/stash.keyfile cn=kerberos,dc=c4ilietest,dc=com
I get this error
kdb5_ldap_util: ...
2
votes
1
answer
46
views
Synchronisation between office365 and local Active Directory via Custom field
I'm trying co connect local Active Directory to office365 for usersync.
In this documentation i have found that i need make resolvable suffix in userPrincipalName and move legacy Kerberos principal ...
0
votes
0
answers
202
views
Is it possible to join two kerberos realms inside the same domain?
In the current environment I am working with there are two LDAP directories, one is a Microsoft Active Directory and the other is a RedHat IDM LDAP Directory. Currently both kerberos realms exist ...
3
votes
1
answer
2k
views
macOS High Sierra issues mounting Kerberized NFSv4 shares
I'm using FreeIPA for LDAP/Kerberos and I've created a principal for a storage appliance (Dell/EMC UnityVSA VM). I have setup the VSA with a keytab from IPA, I've also setup within the VSA the LDAP ...
1
vote
1
answer
3k
views
kdb5_util: Improper format of Kerberos configuration file while initializing Kerberos code
I have this file and when I execute the coammand kdb5_util create -s I get the error"Improper Format"
Here is the file
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
...
0
votes
0
answers
1k
views
Duplicate SPN for File Server Alias
I have two Samba4 AD domain members that serve a couple of replicated shares to users at two sites (same domain, different subnets). Bandwidth and latency don't allow for a clustered solution, so ...
1
vote
2
answers
388
views
Kerberos - what if TGT is stolen en-route?
In Kerberos, the KDC (Key Distribution Center) creates a TGT and sends it back to the client. The client cannot open it and is not supposed to be opened.
What if someone is eavesdropping and they ...
0
votes
1
answer
4k
views
CentOS 7 + Apache with LDAP Configuration Issues
I am working on getting a web app set up behind LDAP. We are running Apache 2.4.6 on CentOS 7.6 (Core). Kerberos is configured and working on the server to provide user access via SSH and SCP.
In my /...
0
votes
2
answers
952
views
ktpass.exe failing with ldap_open failed for default server: 0x3a
I am trying to generate a keytab file using the instructions online here. No matter what I do, whether I run this on a domain controller, a member server, in PowerShell as administrator, in cmd as ...
0
votes
1
answer
3k
views
SSSD : id don't display groups name subdomain (Child trust)
In dev environnement, with SSSD 1.16.2 (release 13.el7_6.5) on RHEL 7.6
SSSD is configured to request on mch.dev domain. trusted subdomain sub.mch.dev exist (Win2k16)
On mch.dev, I have an user '...
1
vote
2
answers
2k
views
Dovecot IMAP authenticating proxy using Kerberos/GSSAPI
I'm trying to set up Dovecot as authenticating reverse proxy, in front of an already running IMAP server to accomplish the following:
Have Dovecot authenticate users using Kerberos/GSSAPI (to allow ...
2
votes
1
answer
3k
views
manually expire a kerberos ticket for a session
I am using NFS service over kerberos. The client mounting the NFS share obtains the ticket from kdc server and works perfect in terms of accessing the NFS share.
My requirement is that I need to ...
0
votes
1
answer
3k
views
Kerberos Apache keeps asking for BASIC
After struggling for a very long time with kerberos authentication on my website, I am finally coming to you because I am lost. I am currently creating a classic PHP website and I want to include a ...
0
votes
1
answer
174
views
Compound Permissions on windows 2012R2 using Kerberos Armoring
I am trying to setup NTFS Compound Permissions to limit access from certian devices using Kerberos Armoring. As far as I can tell it should be very easy you just set 2 GPO settings. One for the server ...
1
vote
1
answer
833
views
Kerberos shared secret key creation
There are 3 things that I don't fully understand about kerberos.
Let's say that we are adding new server to an AD Domain. KDC creates a shared secret for this server and how is this key send securly ...
2
votes
2
answers
5k
views
Kerberos KDC server in a docker container
I'm running a MIT Kerberos KDC and Kadmin server instances on a docker container for convenience. Am able to build it and run it without a problem, with only extracting important configs do a docker ...
1
vote
2
answers
939
views
Machine Account Password Resets on server and invalid Kerberos tickets on client
According to this TechNet article https://blogs.technet.microsoft.com/askds/2009/02/15/machine-account-password-process-2/ Machine Accounts (Computer Objects) reset internal passwords every 30 days.
...
1
vote
1
answer
564
views
Kerberos authentication to root domain in Active Directory
I have an environment in Active Directory that is composed of a root and a child domain, let's call them my.root.domain.com and root.domain.com
I have a RHEL7 server I've spun up which has no problem ...
0
votes
0
answers
176
views
Prevent LDAP requests
I have a work laptop that I connect to my local lan as well. On it I have a pi-hole. On it I can see that the laptop makes an awful lot of requests to the office domain which of course is not ...
4
votes
1
answer
3k
views
PAM with pam_krb5 to authenticate nginx requests
I am aware of the gazzilion pam / nginx questions here and on "Unix/Linux" but they are either unanswered or not related to my setup - so i try again :)
TL;dr
While the setup works perfectly with an ...
2
votes
1
answer
3k
views
Authenticate AD user after joining CentOS 7 to Active Directory Domain
I am trying to join a CentOS 7.5 to a Windows Active Directory Domain for authenticating AD users. Although, the joining process has been successful, I'm unable to authenticate any users though. ...
4
votes
2
answers
3k
views
Exchange 2016 and Sever 2016 DCs: Unknown KDC Encryption type
Team,
Exchange environment is all 2016, no mix. Parent and child domains exist, but the functional level of each domain and forest is 2012R2. All domain controllers have been 2012R2 until recently. ...
1
vote
1
answer
1k
views
How does NFS figure out which Kerberos creds / principals to give access to?
I'm setting up NFS with Kerberos and following various guides, like NFSv4 with Kerberos on Ubuntu Wiki and How To Use Kerberos to Control Access to NFS Network Shares, amongst others. All guides ...
0
votes
0
answers
476
views
Diagnosing NFSv4 Authentication Issues
I've got a couple of NFSv4 shares (with Kerberos authentication). Most of the time they work quite well, but when there's an issue they can be a pain to fix.
I put this down to them being quite ...
0
votes
1
answer
335
views
How to configure Kerberos authentication on the browsers which are on CITRIX page?
We are connecting to our secure client network via CITRIX. We are using chrome to open all quick links. like ambari etc. They open and we are good there, but other useful links like RM and HISTORY ...
0
votes
1
answer
3k
views
How does ssh logins with Kerberos authentication exactly work from every client while Kerberos uses mutual authentication model?
I have my system authentication managed with SSSD which uses Kerberos.
As kerberos support mutual authentication model i.e., both client and server should support Kerberos, how exactly does SSH to ...
2
votes
1
answer
3k
views
How do you setup an NFS4 server that utilises Kerberos authentication from an Active Directory KDC using CentOS Linux release 7.6.1810 (Core)
How do you setup an NFS4 server with Kerberos from Active Directory?
I can install and configure an NFS4 server and connect to it, but I can not get Kerberos to work under any circumstances where the ...
0
votes
0
answers
148
views
Configuration NFS v3 Kerberos on Centos 5.x
Platform:
CentOS release 5.5
Installed the kb5-libs , krb5-server krb5-workstation in the NFS Server.
The NFS Server IP and Machine IP are different.
Machine IP : 172.xx.xx.xx
NFS Server IP: 169....
2
votes
2
answers
2k
views
Joining workstations to the domain as a member of Protected Users group (Delegation vs User Rights)
Implementing "Protected Users" and coming across this problem that I couldn't find a solution to anywhere. Cannot join computers to the domain with delegation permissions. Instead "Add workstation to ...