Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

7
votes
5answers
48k views

Kinit Won't Connect to a Domain Server : Realm not local to KDC while getting initial credentials

I am setting up a testbed environment where Linux (Ubuntu 10.04) clients will authenticate to a Windows Server 2008 R2 Domain Server. I am following the official Ubuntu guide to set up a Kerberos ...
0
votes
0answers
10 views

Set up Samba with Active Directory and local user authentication

My main goal is to set up a Samba-Server, to where users can connect to by using their Active-Directory credentials. Additionally, local linux users on the Samba-Server should be able to authenticate. ...
1
vote
1answer
3k views

Can't get postgres and kerberos (gss) working together

I am trying to get postgres and kerberos, via GSSAPI, working together. Having trouble at this point. It does not help that I am really a newbie for both technologies. I have both postgres and ...
0
votes
1answer
14 views

How can extended file permissions (ACLs) be managed by Kerberos in Linux?

Is it possible to have extended file permissions (ACLs) in Linux be managed (enforced?) by adding permissions authenticated by Kerberos?
1
vote
0answers
10 views

Configure HTTP SPN for a domain user account on Windows Server 2012R2

I have a Windows 2012R2 Server and I would like to use Kerberos authentication with my IIS web applications. How do I set the SPN and map the users for HTTP and HTTPS services for a given use account ...
0
votes
1answer
9 views

nslcd and kerberos without Reverse DNS

I am trying to get nslcd to connect with an ldap instance using GSSAPI and kerberos authentication. Problem i'm having is that nslcd keeps using the wrong principal to try and connected with the ...
2
votes
2answers
678 views

Windows 7 versus 8 Access CNAME'd Share

Here's a situation that came up yesterday: we have a share on a machine we have to access using an alias (CNAME). The machine is running Windows Server 2012 R2, and services Windows 7 and 8 clients. ...
1
vote
1answer
846 views

Cannot change Kerberos password with passwd

I set up a common kerberos authentication for my domain. After that, it's working fine without any issues. But a user cannot change the password using Linux command. On analysis on this, I got the ...
2
votes
1answer
1k views

Apache mod_auth_kerb asking 2 authentication

I've configured Apache to use mod_auth_kerberos. So far everything is working nicely for client thats connected to Active Directory and have their browser to NTLM enabled. When clients are not in the ...
3
votes
1answer
2k views

Linux Client Active Directory Authentication stops working when failover

I have an issue with Linux clients trying to AD authentication by targeting a DNS name (corp.example.com). I have 2 Domain Controller servers DC1(10.0.0.3/24), DC2(10.1.0.3/24) both domain controllers ...
0
votes
1answer
11 views

Can Windows Authenticate Against ApacheDS?

ApacheDS claims to have support for ldap and Kerberos, so is it possible to authenticate Windows machines using it?
-1
votes
0answers
21 views

Ubuntu Samba 4 SSH [on hold]

I have a Samba 4 up and running as a (single) DC on my ubuntu 16.04 machine. (My setup is based on this and this tutorial) Now I'd like to allow the samba 4 users to authenticate on ssh with their ...
0
votes
1answer
4k views

Security-Kerberos Error, event ID 4

I have two new Domain Controllers on new Forest. Servers have DFS and IIS services installed. Everything seemed to go Ok for a While. After updating servers I got new errors. Now once in hour ...
2
votes
4answers
24k views

kinit: Cannot contact any KDC for realm 'UBUNTU' while getting initial credentials

I am installing Kerberos5-1.12.1 on ubuntu machine with these instructions. Whenever i am trying to do : kinit user1 I am facing an error: kinit: Cannot contact any KDC for realm 'UBUNTU' while ...
0
votes
0answers
8 views

FreeIPA fail to log in to Web UI on only one replication node

I run a FreeIPA cluster with 6 nodes I recently upgraded 4 of the nodes and encountered two issues. Couldn't run sudo commands as a user I was able to resolve this issue by clearing the SSSD ...
3
votes
2answers
7k views

Impact of increasing the MaxTokenSize for Kerberos Tickets

Recently by migrating form Netware to Windows file servers we have ended up creating a boat load of AD groups. We have now run in to some problems with authenticating and gaining access to resources. ...
0
votes
1answer
6k views

Samba4 & Active Directory Kerberos [Cannot contact any KDC for realm 'INTERNAL.CORP.COM' while getting initial credentials

Yesterday I configured an Active Directory Server using Arch Linux and Samba 4 following this guide. I even added a client to the domain and was able to log in successfuly on my client. After a ...
4
votes
1answer
1k views

Kerberos KDC has no support for encryption type while getting credentials

I am configuring an apache/SSO authentication with an AD with Kerberos. My http server is a Debian Wheezy and the AD is a Windows Server 2012. I generated keytabs files on WS2012 with kpass command ...
2
votes
1answer
1k views

Adding local users / passwords on Kerberized Linux box

Right now if I try to add a non-system user not in the university's Kerberos realm I am prompted for a Kerberos password anyway. Obviously there is no password to be entered, so I just press enter and ...
6
votes
1answer
415 views

Joining AD domain with Windows 10 using smart card

My Windows "domain-centric" company has abruptly decided to make the switch from Windows 7 to Windows 10, and it has become my job to make their prepared image join our domain with our smart card/...
0
votes
1answer
11 views

How can I federate between two Kerberos realms?

I want to design my own micro services framework - API lifecycle mgmt, service discovery and security. Authentication surely must be encryption based but how do we go about federating across two ...
0
votes
0answers
4 views

Resources to Learn About Identity Federation and PKI / Kerberos [closed]

I am trying to comprehend/design my own micro services framework - API lifecycle mgmt, service discovery and security. Authentication surely must be encryption based but how do we go about federating ...
0
votes
0answers
26 views

How to connect to remote Kadmin KDC interface?

I have kerberos installed on my Windows Active Directory server however I cannot connect to KAdmin in UNIX. I'm able to create users and principals in Windows, export keytabs to remote linux servers ...
4
votes
2answers
4k views

IIS 7.5 web application failing with NT Authority\Anonymous Logon

I am finding various google results, but none seem to fix my problem. I am setting up a new WINDOWS 2008 R2 box at work that is to communicate with an existing SQL 2012 box via web tools running in ...
0
votes
0answers
22 views

WinRM Kerberos Authentication With Multiple Domain Controllers

I have configured a Rundeck instance on a Ubuntu host on AWS with the overthere-winrm plugin in order to execute scripts against Windows hosts. The instance is configured to access these hosts as an ...
0
votes
0answers
14 views

Setting NTAuthenticationProviders:negotiate at iis6 virtual directory level

My understanding is that in IIS6 I have to edit metabase.xml to be able to set the NTAuthenticationProviders value. I wish to set it to 'Negotiate' to use kerberos authentication. My non-production ...
0
votes
1answer
25 views

Apache authentication against FreeIPA's Kerberos

I'm currently trying to set up Apache as an authentication portal. It's supposed to act as a reverse proxy with krb authentication. My apache server is named portal.example.com (debian container) My ...
0
votes
2answers
111 views

LDAP+KERBEROS server configuration

I am following this guide to setup up kerberos server. the system configuration for kerberos server is below, can someone help me to resolve the issue, any help will be appreciated. Here is the ...
0
votes
0answers
8 views

Error in krb5_recvauth: No such file or directory

Trying to propagate a slave dump file from a master KDC and it keeps on failing so I look at the log files to see what is up. In the krb5kdc.log file in the master this is the last two entries Jun 28 ...
1
vote
1answer
49 views

SELinux rules in CentOS 7 with Samba and SSSD on Kerberos Ticket generation

I've built a simple File Server with Samba and Netatalk running on CentOS 7.2. Everything is working as expected except for SELinux that's denying Samba to authenticate due to a policy of denying ...
0
votes
0answers
10 views

Need some clarification on Kerberos Constrained Delegation and SPN's

I can't seem to get a grip on what Kerberos Constrained Delegation and SPN's are... I've been reading up on IIS and these topics play a huge part when it comes to IIS. I've read about creating SPN's ...
3
votes
2answers
50 views

Does Active Directory send a user's access token across the network?

Question: does AD send a user's access token across the network? Research: The following two passages contradict themselves--given that TGTs are transmitted across the network by design. From the ...
0
votes
0answers
17 views

Why is my sshd looking for a wrong kvno in keytab?

My FreeBSD box is using Heimdal Kerberos-implementation. It is registered with the corporate AD, its msDS-KeyVersionNumber-attribute is set to 2, and its keytab has the following entries: FILE:/etc/...
0
votes
0answers
27 views

kerberos - active directory domain trust - SSO only working for linux machines

I have an Active Directory Server (2008r2) and a MIT Kerberos Server. Between the realms "AD.EXAMPLE.COM" and "INTERN.EXAMPLE.COM" is a two-way transitive trust, set up on the windows-side with the ...
1
vote
2answers
36 views

Can a Unix host obtain Kerberos keytabs for another host from Active Directory?

We use Puppet to configure our servers, but creating Kerberos keytabs for them is currently a manual process. We would like the Kerberos keytabs of the Unix machines to be automatically generated, ...
1
vote
1answer
21 views

FreeIPA AD Trust based Integration using SunLDAP to store Policies

If we want to use the FreeIPA Active Directory Trust Integration Option, can we use an existing implementation of SunLDAP to store the Policies (e.g. sudo, hbac etc.) Essentially we don't to create ...
0
votes
2answers
62 views

Can Foreman register a new host with Active Directory?

We use Foreman and Puppet to manage our Unix systems here, but the Kerberos infrastructure is implemented over Active Directory (because Exchange). Registering the newly bootsrapped hosts with AD is ...
2
votes
0answers
21 views

Kerberos Double Hop - SQL2014 HA - MSA's

OK, so i'm at my wits end. We have a system which works perfectly in our UAT environment (not HA) but will not work in live. so the config is: dns A record to iis box binding in iis on :80 to ...
0
votes
1answer
36 views

Calling an URL from a Windows Server 2012 + IE 11 fails with KRB_AP_ERR_MODIFIED error

My problem : Calling an URL from a Windows Server 2012 with IE 11 fails on a IIS Application (with Windows Authentication and Kerberos activated) : After 3 captures of the correct password, I get a ...
7
votes
4answers
1k views

Multiple Realms and Multiple TGTs under MIT Kerberos for Windows

My local computer uses Windows 7 Pro and belongs to realm LR, managed by AD servers. I login to my computer while attached to that realm's network. I can view the TGT with MIT Kerberos for Windows ver....
5
votes
1answer
175 views

SSH works with expired Kerberos Password

I have setup SSH - single sign on using kerberos V5. When a user password has expired , it returns 'Warning: password has expired.' and allows the user to login! I even made changes in the /etc/pam.d/...
0
votes
0answers
18 views

Kerberized NFS mount suddenly failing, permission denied errors

I'm trying to track down a bug with an NFS mount that seems to have appeared rather suddenly. Most of the time, if I try to ls /mnt, I get output that looks like this: ls: cannot access /mnt/dir1: ...
0
votes
1answer
27 views

IIS 8.5, Kerberos and DFS Backend files

We have a new IIS app (8.5 on server 2012 R2).Some of the links on the site forward to files stored on a DFS (AD Integrated) share. The setup is : IIS 8.5 --> Two DFSN servers --> File server (all ...
0
votes
1answer
67 views

gssapi/kerberos/active directory/ubuntu - Wrong principal in request

I'm trying to setup a Clientserver with a Webservice to which Users of an Active Directory should be able to login with SSO. I'm using SPNEGO with Kerberos on a Ubuntu 14.04 Server and nginx proxy to ...
0
votes
0answers
23 views

kinit unable to connect

I'm trying to connect to a Kerberos running on ApacheDS. Here is the initial LDIF I've loaded on LDAP: dn: ou=Users,dc=example,dc=com ou: Users description: Example.Com Users objectClass: ...
2
votes
1answer
9k views

Apache kerberos authentication to Active Directory not happening. (Is KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN related?)

My goal is to have Apache authenticate authenticate against AD, without prompting for a username and password, using Kerberos. It currently always shows "401 Unauthorized", and appears to be not ...
1
vote
3answers
1k views

Unable to join domain using samba tool net or realm/sssd

On a rhel7 server I am trying to join the server to a domain, but I am getting the following failure: net ads join -S domain.example.org -U name Enter name's password: Failed to join domain: failed ...
2
votes
3answers
926 views

Using SSH Keys with Kerberos

So there's an issue that we've been having at our company causing me to pull my hair out for the past week: We have hundreds of server boxes (a mix of CentOS6/7, if it matters) that need to quickly ...
6
votes
2answers
23k views

Track Down Which Process/Program is Causing Kerberos pre-authentication error (Code 0x18)

We have a domain account that is being locked out via 1 of 2 servers. The built-in auditing only tells us that much (locked out from SERVER1, SERVER2). The account gets locked out within 5 minutes, ...
3
votes
3answers
4k views

Retreive the current Kerberos KVNO from Active Directory

I have a Kerberos problem with a Linux host connecting to a Windows KDC. I suspect that Kerberos key with the wrong version is to blame. One way to be shure would be to delete the SPN and create it ...