Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms

2
votes
1answer
1k views

How to enable Kerberos Authentication Service auditing on 2008 server

I have a 2008-level Windows domain running 5 x 2008 (non-R2) DCs (it's on the roadmap to migrate to R2 or possibly 2012 in the next 9-12 months, but this project needs to be working first), and I need ...
0
votes
2answers
1k views

Windows Server 2003 -Ktpass - crypto: enum value 'rc4-hmac' is not known

I'm trying to create a keytab with Ktpass on a Windows Server 2003 with: Ktpass -princ host/prueba-mail.ejemplo.org@EJEMPLO.ORG -mapuser host -pass password -crypto rc4-hmac -out UNIXhost.keytab I ...
0
votes
0answers
5 views

Kerberos and SQL server connection string

I am working on a project to migrate a legacy ASP program (NOT .NET!!) from W2k3 to W2K12 R2 (also from SQL server 2K -> 2K12). The ASP program file has a config for SQL server connection string which ...
4
votes
2answers
4k views

SQL Server running under a domain account cannot register its SPN

I am trying to configure a fresh install of SQL Server to run under a domain account. However, I get intermittent errors when trying to connect to the server using another domain account, and I still ...
0
votes
0answers
13 views

Password Delegation with Windows 2008 Server Trusts?

I have a trust setup between two Windows 2008 Active Directory forests. My domains are "local.ad" and "remote.ad". All of my corporate users belong to the remote.ad forest. I have to add the ...
1
vote
1answer
868 views

Linux Client Active Directory Authentication stops working when failover

I have an issue with Linux clients trying to AD authentication by targeting a DNS name (corp.example.com). I have 2 Domain Controller servers DC1(10.0.0.3/24), DC2(10.1.0.3/24) both domain controllers ...
9
votes
5answers
6k views

How do I get /dev/random to work on an Ubuntu virtual machine?

Apparently, /dev/random is based on hardware interrupts or similar unpredictable aspects of physical hardware. Since virtual machines don't have physical hardware, running cat /dev/random within a ...
0
votes
2answers
70 views

Windows Integrated Authentication with IIS Farm and subapplications

Assume the following site layout www.contoso.com - runs as CONTOSO\sitePool www.contoso.com/subSite1 - runs as CONTOSO\subPool1 www.contoso.com/subSite2 - runs as CONTOSO\subPool2 The pages should ...
0
votes
1answer
2k views

Lookup Active Directory entry by implicit UPN

In our company exists a forest-wide UPN suffix company.com and almost all user accounts have the explicit UPN set to fistname.lastname@company.com. This value is also set in the Active Directory ...
1
vote
1answer
937 views

Can't get postgres and kerberos (gss) working together

I am trying to get postgres and kerberos, via GSSAPI, working together. Having trouble at this point. It does not help that I am really a newbie for both technologies. I have both postgres and ...
1
vote
2answers
917 views

Cannot access shares via \\servername but \\ip works

To set up the scenario: One of our techs set one of the domain controllers to use Microsoft time. The time IS correct (including Time Zone) and DOES match the other domain controller's time; it was ...
1
vote
0answers
20 views

Kerberos Errors

Need help with the below error. I haven't been able to find much that has helped. Event Source: Security-Kerberos Event ID: 4 Qualifiers: 16384 Version: 0 Level: 2 Task: 0 Opcode: 0 Keywords: ...
0
votes
2answers
57 views

Apache/mod_auth_gss authentication failure

Sorry if this is the wrong stackexchange site for this. Based upon the documentation (for reference I also used this blog post) I have this in httpd.conf: # Increase max size of HTTP request headers ...
0
votes
0answers
22 views

Reporting Services 2008 and kerberos delegation/impersonation

I've spent quite some time configuring the use of Kerberos and Windows 2008 SQL Reporting Services - I've registered all the SPNs, configured the various authentication options in the XML files and ...
0
votes
2answers
6k views

kinit: Cannot contact any KDC for realm 'UBUNTU' while getting initial credentials

I am installing Kerberos5-1.12.1 on ubuntu machine by following the link: http://techpubs.spinlocksolutions.com/dklar/kerberos.html#krb-install Whenever i am trying to do : kinit user1 I am ...
1
vote
2answers
858 views

need help in setting up SPN for Kerberos Authentication

I am using IIS 7 for setting up a website under windows authentication. I am seeing authentication issue which i am almost sure that it is related to kerberos issue and i am wrongly setting up SPN. ...
1
vote
2answers
59 views

Possible to authenticate Samba via Kerberos but without domain-join?

With a Kerberos config file... [realms] DOMAIN.COM = { kdc = dc1.domain.com admin_server = dc1.domain.com } ...it is possible for Linux to talk to Active Directory for password ...
2
votes
2answers
877 views

Problem with testsaslauthd and kerberos5 (“saslauthd internal error”)

The error message “saslauthd internal error” seems like a catch-all for saslauthd, so I’m not sure if it’s a red herring, but here’s the brief description of my problem: This Kerberos command works ...
2
votes
0answers
55 views

IIS 8.5 / Windows Authentication - 401 response on certain clients

We are running a Tomcat application behind a IIS 8.5 Windows Authentication Proxy, the redirect is via the tomcat AJP connector. We now have the problem that on certain clients, the authentication ...
1
vote
1answer
1k views

DCOM Authentication Fails to use Kerberos, Falls back to NTLM

I have a webservice that is written in Classic ASP. In this web service it attempts to create a VirtualServer.Application object on another server via DCOM. This fails with Permission Denied. However ...
1
vote
0answers
16 views

Kerberized root user on RHEL 5/6

I'm currently involved with getting NFSv4 and Kerberos. We've decided to bite the bullet and try and make the transition. Our environment is: Windows AD LDAP auth on Linux against said AD. ...
1
vote
4answers
11k views

kinit & pam_sss: Cannot find KDC for requested realm while getting initial credentials

I have a very similar problem as described in this thread on CentOS 6.3 authenticating against a 2008R2 AD DC. Here is my krb5.conf, I know for a fact that XXXXXXX.LOCAL is the true domain name: ...
0
votes
2answers
2k views

winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm

While looking for reasons why logging in to a samba machines joined to Active Directory is slow I have the strong impression that the following error in my log file could be a hint. Apr 3 14:44:14 ...
7
votes
7answers
31k views
0
votes
0answers
39 views

kinit won't connect to samba4 domain controller, cannot resolve hostname

i have set up a domain controller on my virtual machine. At first i will post all important configs, so you know what works already. Hostname: affenhirn2 Domain Name: example.affenhirn2.local (i am ...
1
vote
0answers
12 views

Setting environment variables based on passing Require directive

I finally succeed on configuring Apache as a SPNEGO reverse proxy for my app, and I'm using the AUTHORIZE_SAMACCOUNTNAME, AUTHORIZE_CN and AUTHORIZE_MAIL to figure out some information about the ...
2
votes
2answers
1k views

How do I re-enable Kerberos authentication after upgrading to Mac OS X 10.10 Yosemite?

In previous versions of Mac OS X, one could enable Kerberos authentication when a user logs in by following a support document. Specifically, this document explains that the file ...
1
vote
2answers
2k views

Change local password as root after configuring for MS-AD Kerberos+LDAP

I have followed this excelent post to configure Kerberos + LDAP: http://koo.fi/blog/2013/01/06/ubuntu-12-04-active-directory-authentication/ However, there are some local users used for services. When ...
3
votes
1answer
2k views

SSO with Apache and Kerberos issues

I am trying to set up SSO on my Apache web server using Kerberos so that users logged into the local domain are recognised and logged in immediately. I have followed this guide to the letter but I ...
0
votes
0answers
33 views

Why does Hyper V differs in authentication methods for live-migration and replication

Hyper-V provides different authentication methods for replication and live migration (2012 R2 based). Live Migration is using CredSSP and Kerberos and replication Kerberos or PKI-based authentication. ...
1
vote
0answers
9 views

Kerberized NFSv4 share (deleted) after token expiry

I set up a NFSv4 server with Kerberos authentication and it runs well. However, some users stay logged in for long times such that they have to renew their tickets after some days. If during the time ...
1
vote
0answers
1k views

Apache Kerberos/LDAP: A required input parameter could not be read: An invalid name was supplied (, Unknown error)

(Debian Squeeze) I have Apache authenticating via Kerberos - that works fine. Now I want to restrict the site to a single group only, so I need to add LDAP authorization. I enabled authnz_ldap and ...
1
vote
0answers
31 views

How can one determine what Kerberos key encryption algorithms are supported on a Cisco IOS device?

When attempting to load an SRVTAB over TFTP, I receive an "Unsupported keytype" error: abc(config)#kerberos srvtab remote 1.2.3.4 abc.srvtab Loading abc.srvtab from 1.2.3.4 (via Vlan123): ! [OK - 121 ...
5
votes
1answer
65 views

How can one enable DES-encrypted keys on an Apple KDC?

We are running a KDC on OS X 10.10 Yosemite, to which we have added a service principal for remotely accessing a (legacy) host: $ kadmin add -r host/a.b.c.d@REALM Since the host only supports ...
2
votes
1answer
860 views

Problems mounting Kerberos authenticated NFS share on CentOS 6.4

I'm trying to mount a Kerberos authenticated NFS share on a CentOS 6.4 machine. I have tried exporting the protected share from both another CentOS 6.4 machine and from our NetApp with the same ...
1
vote
1answer
221 views

Kerberized SSH Failed

I want to authenticate ssh login with Kerberos, however fail. The following is a snippet of ssh debug information with the command ssh -vvv localhost. debug3: Wrote 80 bytes for a total of 1125 ...
2
votes
1answer
366 views

How exactly does the HOST/machine SPN work?

Normally when you set up Kerberos for IIS, you would do something like setspn -A HTTP/machine some_account. When IIS 7 is installed, it registers the SPN "HOST/machine" for its kernel-mode ...
3
votes
1answer
48 views

Why does a SPN on a different host cause a server to lose its trust? How should I fix it?

I have a brand new server image that loses its trust as soon as it's joined to the domain. I suspect it's because of the duplicate SPN I discovered using the LDAP version of this Powershell script ...
2
votes
1answer
18 views

What is “Ticket Options” Referring to in Domain Controller Event Logs?

I'm trying to figure out what Ticket Options is referring too within this event log off my domain controller. It is in response to a kerberos authentication request. AgentDevice=WindowsLog ...
0
votes
0answers
22 views

Kerberos Authenticator Encryption Type NULL

So, I've been working on a SSO enabled XMPP application on our network for a couple weeks. I have 95% of the bugs worked out, and everything is running smoothly. The problem is that I have a couple ...
2
votes
0answers
28 views

CUPS remote print queues

In my network, there are multiple printers over many locations, all connected to a single CUPS server via whatever protocols they require. Client machines on the network need to print to the printers ...
3
votes
2answers
124 views

If an IIS hosted site is secured using Kerberos, can Linux machines connect to it?

I'm running into a problem configuring my IIS 7.0 website in a test environment with Kerberos. I have a trial version of Windows Server 2008 R2 with AD DS, AD RMS, DHCP, DNS & IIS roles installed. ...
3
votes
4answers
5k views

error reading keytab file krb5.keytab

I've noticed these kerberos keytab error messages on both SLES 11.2 and CentOS 6.3: sshd[31442]: pam_krb5[31442]: error reading keytab 'FILE: / etc/ krb5. keytab' /etc/krb5.keytab does not exist on ...
1
vote
1answer
305 views

problems creating a keytab file on win server

I am trying to create a keytab file. i see a warning WARNING: pType and account type do not match. This might cause problems. The command i use is ktpass -princ ...
5
votes
3answers
236 views

In a Windows PKI, what is a Workstation Authentication CA Template used for? What happens if it expires?

Many workstations have an expiring computer certificate that was issued using the Workstation Authentication CA template. The CA of this template expires in 2 days. I've deployed a new CA, with an ...
2
votes
2answers
1k views

nfs4 and kerberos: Wrong principal in request

My client/servers are both running Ubuntu 14.04 and kerberos user authentication works as intended. regular nfs4 mounts also work fine. All machines are running heimdal libraries. I haven't been able ...
2
votes
1answer
80 views

IIS 7.5 web application failing with NT Authority\Anonymous Logon

I am finding various google results, but none seem to fix my problem. I am setting up a new WINDOWS 2008 R2 box at work that is to communicate with an existing SQL 2012 box via web tools running in ...
1
vote
0answers
496 views

Encounter an error when configuer secure hadoop : org.apache.hadoop.security.AccessControlException

I try to configure secure hadoop with kerberos. I have started KDC server , generated and copy related keytab to corresponding node. kerberos can work normally (use kinit) but when i try to start ...
0
votes
1answer
221 views

ADFS & WAP with SP 2013 - Login redirect to blank page

I set up ADFS and WAP on server 2012 R2 in order to login into SharePoint 2013. I follow several how-to, and all seems fine except one thing : When I log into ADFS form, its ok, then I land on a blank ...
1
vote
1answer
975 views

Kerberos says there is no KDC at my server's location while getting initial credentials

This is probably some stupid error I've overlooked, but I've been working on this on and off for about a week. Running version 1.10.3 release 17.fc18 This is my krb5.conf [logging] default = ...