Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms

0
votes
1answer
8 views

Windows Authentication KRB5KRB_AP_ERR_MODIFIED

Let me preface by saying, I've been on this issue for about a week and a half now and I can't figure it out. I think I'm close, but every time I've thought that so far, I was wrong. I've looked at ...
1
vote
1answer
28 views

Integrated Windows Authentication not working on PC bound to AD network

Background: Web server running LAMP stack Web server has VPN tunnel to AD network at HQ Multiple AD networks around the globe with VPN tunnels and trust relationships to HQ network Kerberos ...
0
votes
1answer
826 views

Lookup Active Directory entry by implicit UPN

In our company exists a forest-wide UPN suffix company.com and almost all user accounts have the explicit UPN set to fistname.lastname@company.com. This value is also set in the Active Directory ...
1
vote
2answers
763 views

How to cache authentication in Linux using PAM/Kerberos authentication (for CVS)?

We have several Linux servers that authenticate Linux user passwords on our Windows Active Directory Server using PAM and Kerberos 5. The Linux distro we use is CentOS 6. On one system, we have ...
1
vote
2answers
23 views

Does Kerberos provide Encryption of Application Session data?

I understand kerberos provides authentication using encryption. I see it exchanges session keys. Are those session keys used for applications send their data over that network encryption after ...
0
votes
0answers
6 views

Any other option than HTTPS + Basic auth for reverse proxied IIS site that uses double hop authentication to SQL server

We've been struggling for a while to get, what I had assumed would be a relatively common scenario to work and would appreciate any pointers. We have 2 x Windows 2012 Servers running IIS Server SQL ...
1
vote
0answers
31 views

Why is my OSX client having so much trouble connecting to our SMB server?

I'm asking this here because I think I'm more likely to find SMB/kerberos experts here than in Ask Different, which seems to be mostly related to OSX client issues. When I first connect to our SMB ...
0
votes
1answer
19 views

IIS / kerberos not prompting for credentials from Mac clients

I have an IIS server (Server 2008R2/IIS 7.5) configured for kerberos authentication. The kerberos authentication works from clients on Windows (IE and Opera both tested), but when I access the site ...
2
votes
1answer
1k views

SSO with Apache and Kerberos issues

I am trying to set up SSO on my Apache web server using Kerberos so that users logged into the local domain are recognised and logged in immediately. I have followed this guide to the letter but I ...
0
votes
2answers
298 views

Windows Server 2003 -Ktpass - crypto: enum value 'rc4-hmac' is not known

I'm trying to create a keytab with Ktpass on a Windows Server 2003 with: Ktpass -princ host/prueba-mail.ejemplo.org@EJEMPLO.ORG -mapuser host -pass password -crypto rc4-hmac -out UNIXhost.keytab I ...
1
vote
1answer
736 views

Apache Kerberos/LDAP: A required input parameter could not be read: An invalid name was supplied (, Unknown error)

(Debian Squeeze) I have Apache authenticating via Kerberos - that works fine. Now I want to restrict the site to a single group only, so I need to add LDAP authorization. I enabled authnz_ldap and ...
0
votes
0answers
12 views

Change apache config based on connecting OS

I'm looking for a way to add an "if statement" to an Apache httpd.conf file. I would like to know if it is possible to do something like this: -if OS is Linux- EnableKerberosAuth true ...
0
votes
1answer
20 views

winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm

While looking for reasons why logging in to a samba machines joined to Active Directory is slow I have the strong impression that the following error in my log file could be a hint. Apr 3 14:44:14 ...
0
votes
1answer
19 views

IIS Credential Delegation for AppPool in Integrated Pipeline mode

I know there have been mkore than a dozen articles on this topic, but for some reason I have not been able to find a solution. Server WEB1 has IIS7.5 with a site using Windows Authentication (kernel ...
8
votes
2answers
240 views

Demoted domain controller still authenticating users

Why is a demoted domain controller still authenticating users? Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
0
votes
2answers
29 views

Configure MSSQL 2008 to use kerberos authentication

I would like to set my current mssql db (2008 and 2012) to authenticate using a linux kerberos server that I have in my environment . The windows station is in a workgroup and I would like to avoid ...
1
vote
2answers
701 views

Problem with testsaslauthd and kerberos5 (“saslauthd internal error”)

The error message “saslauthd internal error” seems like a catch-all for saslauthd, so I’m not sure if it’s a red herring, but here’s the brief description of my problem: This Kerberos command works ...
0
votes
1answer
833 views

AD + Postfix + Dovecot problems with query_filter

I set up a mail server AD + Postfix + Dovecot + Kerberos This works fine for only one domain In the attribute mail=test@test.com, in otherMailbox=vasya@otherdoamin.com,petya@another.net Config ...
0
votes
0answers
27 views

How to enable kerberos authentication to a Java web app

I'm currently using Centrify to aid with Kerberos/AD integration in our environment. Right now we have Kerberos enabled on a Centrified version of Apache. We are trying to run jnlp files through ...
1
vote
0answers
18 views

Create kerberos keytab from AD file with more than one SPN

I need to create a Kerberos keytab file from Active Directory with three different SPNs. It's no problem to add different SPNs with setspn -a but when I try to create a keytab file with ktpass ...
0
votes
1answer
974 views

DCOM Authentication Fails to use Kerberos, Falls back to NTLM

I have a webservice that is written in Classic ASP. In this web service it attempts to create a VirtualServer.Application object on another server via DCOM. This fails with Permission Denied. However ...
1
vote
1answer
732 views

./configure error installing PHP with Kerberos support on Ubuntu

I am trying to install PHP on Ubuntu 11.04. I am compiling from source. Here are my installation dependencies: apt-get -y install php5-dev php-pear apt-get -y install libxml2-dev libevent-dev ...
0
votes
0answers
19 views

Cannot authenticate as diradmin - OS X Server 10.6 Workgroup Manager

As far as I can tell, not an uncommon problem: when I try to authenticate as 'diradmin' in Workgroup Manager for /LDAPv3/127.0.0.1 it fails with a login problem: "The login information is not valid ...
2
votes
1answer
27 views

Apache 2.2.14 / mod_auth_kerb 5.4 : Custom krb5.conf for Apache Instance

Objective: Use Apache/mod_auth_kerb using a custom krb5.conf file, not system standard /etc/krb5.conf. Issue: I've got a strongly regimented environment where we application owners are able to ...
2
votes
4answers
2k views

apache poor performance with Kerberos Authentication

I have an apache instance that uses kerberos for SSO with an internal application that we have running. However the performance is very very poor. I believe from a tcp dump that when a user hits ...
0
votes
1answer
54 views

How to reset Keytab for FreeIPA Server and Client

I followed the standard documentation to install FreeIPA server and client on hosts 'SRV' and 'CLT' respectively. I then added a user 'X' to FreeIPA using Web UI. Now when i try to SSH as X to CLT, i ...
1
vote
1answer
50 views

What does squid proxy do when negating acl proxy_auth_regex in rule?

The NTLM auth helper only tags users as authorized if they are member of a AD group. The Kerberos auth helper tags a user as authorized, if he was able to log in, the group check can't be done by the ...
0
votes
0answers
10 views

How to find a service making schannel / Kerberos requests?

A few of my 2008 R2 servers is attempting to make and failing a Kerberos request once per minute. This corresponds to two events in the security log, both 4625. Logon Process: Schannel ...
3
votes
1answer
403 views

Does an NFS export with sec=krb5 *require* that the parent directory also be exported with sec=krb5?

I copied somebody's NFS server/client setup verbatim and am having trouble making sense of what's going on with it. This is the /etc/exports: /export ...
1
vote
0answers
38 views

Encounter an error when configuer secure hadoop : org.apache.hadoop.security.AccessControlException

I try to configure secure hadoop with kerberos. I have started KDC server , generated and copy related keytab to corresponding node. kerberos can work normally (use kinit) but when i try to start ...
0
votes
2answers
387 views

RDP in 2008 R2 domain no longer working - possible Kerberos issue

Everything was working fine and no changes were made. For no apparent reason, we can no longer RDP to any domain computers except for the domain controllers themselves. This includes Windows 7 clients ...
0
votes
2answers
194 views

Windows Server Manager Kerberos error 0x80090322

I have been frustrated with this issue for two days now so I finally decided to ask this on serverfault. I'm setting up a Windows lab environment. It has a Win2012R2 domain controller (srv001) and ...
0
votes
1answer
43 views

Add custom headers to HTTP 401 responses from Kerberos mod_auth_kerb

I'm using Apache with mod_auth_kerb to perform HTTP authentication. How do I add custom headers to the 401 Authorization Required response generated by the auth module? The relevant sections of my ...
0
votes
3answers
231 views

Kerberos Authentication for workstations not on domain

I have a base understanding of how Kerberos works in an Active Directory environment and the methods it uses to authenticate users and workstations onto the network, but my question is.. since ...
4
votes
1answer
66 views

How can I force sudo to accept a user's AD password on RHEL6

In our environment we do not join Linux boxes to the Microsoft Domain. We do however setup Kerberos. This allows us to log into the boxes using our AD credentials as long as there is a local account ...
3
votes
2answers
145 views

Why do kerberos HOWTOs specify to copy keytabs securely to the host? Is networked kadmin not secure?

Kerberos HOWTOs often have words similar to these: Securely transfer (via flash drive, disk, or encrypted connection) the keytab to the client host. Is logging in on the client host as root, ...
0
votes
1answer
36 views

setting kerberos ktpass ktab all that JAAS

I have a couple of questions on Kerberos on Windows. I want to find out what the purpose of mapping a user to a service using ktpass is. For example I am on windows and I run ktpass like this: ...
2
votes
1answer
29 views

How does a Kerberos Client determine the Service Name portion of an SPN?

If I deploy a server call FOO/host.example.com@myrealm how does a client become aware that the service name is FOO? ENV: Unix / MIT kerberos 1.4 or 1.10 I see windows has some sort of mapping: How ...
1
vote
1answer
213 views

IIS, SQLServer, Google Chrome and Windows Authentication

I'm searching the internet for almost 4 days now and I'm stuck. I've created a simple ASP MVC4 Intranet website and I have deployed it to server called: iis. That computer is inside the same domain ...
1
vote
3answers
146 views

SSH + Kerberos but WITHOUT DNS

I was wondering if there's a way to set up SSH with Kerberos authentication without using a DNS server at all ?
1
vote
0answers
26 views

How Does an Exchange Alternative Service Account Credential work?

I recently had to assist with setting up an Exchange Alternative Service Account (ASA) credential on an Exchange CAS array. We did get the ASA working properly however I have some questions about how ...
2
votes
1answer
39 views

OpenLDAP+Kerberos authentication – id (NSS) works, but authentication says user is unknown

I have a central authentication server with OpenLDAP set up and populated, and Kerberos 5, also populated. On an Ubuntu LTS machine, I set up nslcd and kerberos client stuff. This way, issuing the ...
1
vote
0answers
132 views

Windows 7 NFS Client Using Kerberos and Linux KDC

I am trying to configure a Windows 7 Enterprise client to mount a NFSv4 share on a Linux NFS server using Kerberos and a Linux KDC. The setup is: IPA Server (OS: Scientific Linux 6.4, Pkg: ...
7
votes
3answers
312 views

Ubuntu 12.04, Windows 2012 Active Directory Integration, Kerberos won't resolve service principals

after having checked the whole internet literally, I hope that I might get help here. I am trying to accomplish integration of ubuntu 12.04 servers into a Windows 2012 active directory with nfs and ...
1
vote
2answers
203 views

mounting windows shares on linux while keeping windows permissions

I have a windows share on a windows2003 server (WINJOE) which I want to back up to a Linux machine (LINUXJOE) that is properly joined to the domain. My goal is to backup shared folders of WINJOE to ...
0
votes
1answer
312 views

Kerberos pre-authentication failed on nfs mount

I have the following nfs export: /home/users 192.168.1.0/24(rw,sec=krb5p,no_subtree_check,nohide,async,anonuid=65534,anongid=65534) When trying to mount that on a client I get: client:/home # ...
2
votes
1answer
2k views

Kerberos broken when upgrading Snow Leopard Server to Mountain Lion

I work for a small company where there's no dedicated system admin. I was tasked with upgrading our file and calendar server to 10.8, which I did by upgrading the OS then installing the server tools ...
3
votes
2answers
157 views

SQL Server running under a domain account cannot register its SPN

I am trying to configure a fresh install of SQL Server to run under a domain account. However, I get intermittent errors when trying to connect to the server using another domain account, and I still ...
0
votes
0answers
63 views

Change local password as root after configuring for MS-AD Kerberos+LDAP

I have followed this excelent post to configure Kerberos + LDAP: http://koo.fi/blog/2013/01/06/ubuntu-12-04-active-directory-authentication/ However, there are some local users used for services. When ...
2
votes
1answer
341 views

Company Wide Windows Auth with Chrome and Firefox

I know that we can allow Firefox to allow passing through of Windows credentials by editing the following about:config settings --If using Kerberos-- network.negotiate-auth.trusted-uris ...