Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

3
votes
2answers
3k views

IIS 7.5 web application failing with NT Authority\Anonymous Logon

I am finding various google results, but none seem to fix my problem. I am setting up a new WINDOWS 2008 R2 box at work that is to communicate with an existing SQL 2012 box via web tools running in ...
1
vote
1answer
60 views

wbinfo -u does not show AD users (is empty)

We have a problem on a Ubuntu Server 14.04 (fileserver) connected to AD on a Windows Server 2008 R2 using Samba (version 4.3.8)/WinBind and Kerberos. The problem is that users do not have writing ...
1
vote
2answers
1k views

How to avoid frequent KVNO increases, when using Apache HTTPD with mod_auth_kerb talking to AD?

I've setup Apache HTTPD 2.4 with mod_auth_kerb, created a service account on Active Directory, added a SPN for my http hostname, created a keytab file on the linux machine, and had SSO start working ...
0
votes
1answer
22 views

Forward service records from main DNS to IPA server

I have a production DNS server (dns1.local) in Data Center environment, I build recently IPA server (ipa.example.com) that runs DNS as well in the same environment and it forwards requests to ...
0
votes
2answers
59 views

Kerberos PuTTY from non-domain machine via VPN

Feels like I'm missing something fundamental here... Have a non-domain machine (personal machine off site) from which I VPN into our work network. Once connected, from 'klist', it appears my VPN ...
1
vote
2answers
22 views

Initialise Kerberos ticket on ssh login using PAM

Right, so I am struggling a bit with PAM in Centos7. I have no idea how to configure it manually and make the changes permanent so that I get a kerberos ticket after a successful ssh login. The ...
0
votes
1answer
22 views

Kerberos and LDAP login

I want to manually login to a ldap-server. For authentication Kerberos is used. I am registered there with username and pw. kinit username@servername It works fine and a valid TGT is created which ...
3
votes
2answers
78 views

creating an SPN from a linux build server

I'm setting up a process which would automatically create the SPNs for newly exposed service URLs. I am aware of how to create an SPN with Windows using the setspn -A command with the right ...
3
votes
3answers
22k views

kinit: Cannot contact any KDC for realm 'UBUNTU' while getting initial credentials

I am installing Kerberos5-1.12.1 on ubuntu machine with these instructions. Whenever i am trying to do : kinit user1 I am facing an error: kinit: Cannot contact any KDC for realm 'UBUNTU' while ...
3
votes
0answers
67 views

Questions about ktpass/kerberos with Active Directory

I got a few questions about Kerberos with Active Directory, specifically about the ktpass tool. The example AD I'm using (everything is on 2012R2 level): Active Directory Domain Name: ...
1
vote
1answer
2k views

Can't get postgres and kerberos (gss) working together

I am trying to get postgres and kerberos, via GSSAPI, working together. Having trouble at this point. It does not help that I am really a newbie for both technologies. I have both postgres and ...
1
vote
2answers
334 views

Samba Authentication

I know it's going to seem like I haven't done the research here, because I have done it, and I know how many related questions and tutorials there are. I have read every tutorial I can find online for ...
-1
votes
0answers
21 views

Kerberos-based SSH login requires local user account

I've recently set up a linux system (Debian-Jesse) which has joined an MS-Based Kerberos domain and been set up to allow Kerberos-based authentication for remote access. The only issue is, ...
0
votes
1answer
23 views

What kind of SPN is required to delegate client credentials to a SMB Share?

I'm trying to delegate KERBEROS authentication from an SQL Server to a file server over OLEDB. Is there a particular Service Principle Name that is used to delegate credentials from an SQL Server ...
0
votes
1answer
226 views

Mongodb + Kerberos BadValue SASL mechanism GSSAPI is not supported

I am trying to run an instance of mongodb with the authentication mechanism GSS-API. This is the command: mongod --dbpath /home/ec2-user/db/node2/data --auth --setParameter ...
-1
votes
1answer
70 views

Samba file server as domain member: error when joining domain

I would like to set up samba 4 to share a local directory, so that domain users are allowed to mount the directory. I don't want domain users to be able to log in the linux machine, they should only ...
0
votes
1answer
24 views

What changes with Kerberos authentication in IPv6 when everyone has a public IPv6 Address?

How should Kerberos authentication be set up with IPv6? What implications are there when client devices each use a public, globally routeable IPv6 IP address? What changes when setup this way ...
0
votes
0answers
12 views

What changes with Kerberos Authentication in IPv6 when using NAT? [duplicate]

How should Kerberos Authentication be setup with IPv6? Of you're using NAT for IPv6 where there is a single public IPv6 address and it translates to the machines inside in the ULA range?
4
votes
1answer
16k views

Create SPN with setspn.exe - Insufficient access rights

On a Windown Server 2008 Domain Controller, I'm attempting to add a Service Principal Name (SPN) to a user account 'Postmaster' in order to enable Kerberos authentication from a Communigate email ...
0
votes
2answers
39 views

Build a production IPA server without integrate DNS and NTP with client

We are going to deploy a centralized authentication Linux server (RHEL6) for our RedHat/CentOS servers in Data Center environment. I made some search I believe Free IPA is the best choice since it's ...
3
votes
1answer
2k views

Linux Client Active Directory Authentication stops working when failover

I have an issue with Linux clients trying to AD authentication by targeting a DNS name (corp.example.com). I have 2 Domain Controller servers DC1(10.0.0.3/24), DC2(10.1.0.3/24) both domain controllers ...
2
votes
1answer
1k views

Apache mod_auth_kerb asking 2 authentication

I've configured Apache to use mod_auth_kerberos. So far everything is working nicely for client thats connected to Active Directory and have their browser to NTLM enabled. When clients are not in the ...
6
votes
1answer
144 views

Joining AD domain with Windows 10 using smart card

My Windows "domain-centric" company has abruptly decided to make the switch from Windows 7 to Windows 10, and it has become my job to make their prepared image join our domain with our smart ...
14
votes
2answers
10k views

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of ...
3
votes
2answers
108 views

Are SPNs specific to Windows and Active Directory?

Are Service Principle Names specific to Active Directory on Windows? Or do they exist in Linux OpenLDAP / Kerberos KDC servers too?
0
votes
1answer
3k views

Security-Kerberos Error, event ID 4

I have two new Domain Controllers on new Forest. Servers have DFS and IIS services installed. Everything seemed to go Ok for a While. After updating servers I got new errors. Now once in hour ...
2
votes
2answers
297 views

How to add principals to a keytab when using realmd on CentOS

I joined a server to a MS Active Directory using realmd/sssd. I installed apache with mod_auth_kerb and created a keytab on a windows server. But, I need to add more SPNs to the keytab. I have tried ...
1
vote
0answers
20 views

Unspecified GSS failure. after setting up krb5/ldap authentication

new here, so I recently setup ldap/krb5 authentication on an centos7.2 vm. Krb5/ldap is working correclty as I can login using ldap user account. However, when I check the logs in the client machine ...
0
votes
1answer
37 views

Multi-factor auth with Kerberos and RADIUS

I am looking for a solution in order to allow a multi-factor authentication for a Kerberos-based logon service. By reading some articles, I found some good references about RADIUS, that provides a set ...
0
votes
1answer
287 views

HBase Kerberos SaslException: GSS initiate failed (Mechanism level: Failed to find any Kerberos tgt)

I am trying to set up Kerberos authentication for HBase using this http://hbase.apache.org/0.94/book/security.html documentation and have very little progress so far. HBase 1.1.1 from Apache without ...
0
votes
1answer
34 views

Error trying to enable LDAP with kerberos authentication with GPFS

I have 3 RHEL7 nodes with GPFS / Spectrum Scale 4.2.0.0 installed. The 3 nodes have been setup with GPFS as a cluster with a GPFS filesystem created. I am trying enable LDAP based authentication ...
0
votes
0answers
20 views

Mounting NFS v4 on Linux with Username

I'm trying to mount a NFS v4 share on a Redhat Linux machine where the share is restricted to a particular user account. I have a kerberos ticket for the server and SSSD with LDAP used to populate ...
0
votes
1answer
3k views

Samba4 & Active Directory Kerberos [Cannot contact any KDC for realm 'INTERNAL.CORP.COM' while getting initial credentials

Yesterday I configured an Active Directory Server using Arch Linux and Samba 4 following this guide. I even added a client to the domain and was able to log in successfuly on my client. After a ...
0
votes
0answers
28 views

Kerberos authentication failure with strange account name [closed]

Recently, I observed a lot of authentication failures(about 600 failures per day) coming from one of my company servers with account name "@@CyBAAAAUBQYAMHArBwUAMGAoBQZAQGA1B...."(about 150 characters ...
11
votes
3answers
7k views

How does Kerberos work with SSH?

Suppose I have four computers, Laptop, Server1, Server2, Kerberos server: I log in using PuTTY or SSH from L to S1, giving my username / password From S1 I then SSH to S2. No password is needed as ...
1
vote
0answers
32 views

Client to IIS to SQL Server Kerberos authentication

I would like to have a setup where my IIS web server sits on a different virtual server from where my SQL Server is installed, and Windows Authentication should be used for all connections. I am ...
1
vote
1answer
2k views

Kerberos Configuration Manager for SQL Server error “unable to access user principal information from the system”

When I launch the Kerberos Configuration Manager for SQL Server and try to connect to the local machine it's on, I am getting the error "Kerberos Configuration Manager for SQL Server error "unable to ...
0
votes
1answer
30 views

Apache not finding the kerberos principal in keytab file

Virtual host has been configured with these options; AuthType Kerberos AuthName "Kerberos Login" KrbMethodNegotiate On KrbMethodK5Passwd Off KrbAuthRealms EXAMPLE.COM KrbAuthoritative On ...
5
votes
3answers
12k views

SQL Server running under a domain account cannot register its SPN

I am trying to configure a fresh install of SQL Server to run under a domain account. However, I get intermittent errors when trying to connect to the server using another domain account, and I still ...
0
votes
0answers
31 views

SSO, Kerberos, multiple domains, multiple Linux servers

I have successfully implemented SSO for one production application running on Centos 6 + apache 2.2. connecting to Windows 2008 AD server. Users are coming from 2 different domains: a.com and b.net, ...
0
votes
1answer
15 views

NFSv4 with Kerberos - idmap stops working after ~35 minutes

All machines are running CentOS 6.5. We have about 85 client machines doing a Kerberized NFSv4 mount (sec=krb5p) to a server. This weekend, the server was changed (serverA changed to serverB). ...
2
votes
0answers
75 views

Forward Kerberos Authentication on Ansible

I have an ansible control machine (host-A) that need to talk with host-C, an Windows machine that doesn't have local users (It's an Active Directory). host-A doesn't have network access to host-C, ...
4
votes
1answer
2k views

Why does a SPN on a different host cause a server to lose its trust? How should I fix it?

I have a brand new server image that loses its trust as soon as it's joined to the domain. I suspect it's because of the duplicate SPN I discovered using the LDAP version of this Powershell script ...
3
votes
0answers
33 views

Kerberos keytab file not working

I have two AD domains and I'm trying to use NFS with Kerberos to both of them. Part of the procedure requires creating keytab files for the host and nfs principals for the client and server ...
0
votes
0answers
17 views

Why do i need freeradius's keytab?

I'm trying to set up 802.1x for the wifi. I'm working with freeradius an windows server 2012. I need SSO ... help :) Currently I'm not able to set up freeradius krb. 'radtest' doesn't make it trough. ...
1
vote
0answers
35 views

Does FTP service (IIS 7.5) on Windows 2008 R2 support kerberos authentication?

I have configured http service on IIS 7.5 for kerberos authentication. And it works fine. I have checked from linux box # klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: alex@EXAMPLE.NET ...
1
vote
1answer
20 views

Having a Kerberos issue, and can't trace the traffic in NetMon

I'm trying to get Kerberos to work for a new Sharepoint server I'm installing. It works fine for the server name, but not the FQDN. I've done setspn for both, and I've added the domain to trusted ...
0
votes
0answers
60 views

kinit pre-authentication fails

I have a centos 6.4 that someone setup a while back. The admin is not sure how he installed it, but it works very well with Kerberos. I used authconfig to set the domain and the Kerberos settings. I ...
1
vote
3answers
143 views

CentOS7 Kerberos Auth: Improper format of Kerberos configuration file;

I'm working on setting up a Squid 4.0 explicit proxy for group based AD authentication against a Active Directory domain (Server 2012 R2) with SSL bumping on a minimal CentOS 7 (64b) install. The ...
2
votes
1answer
67 views

Integrating squid with active directory

I am trying to integrate squid as a web proxy for my users in active directory. I have followed the tutorial in the squid site in here. When i run the command : msktutil -c -b "CN=Administrator" -s ...