Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

1
vote
2answers
47 views

LDAP syncrepl with kerberos authentication

I'm trying to set up a replication server for LDAP using syncrepl. I would like to use Kerberos to authenticate the consumer, because we have it set up, and it seems more secure. The database ...
0
votes
1answer
2k views

Lookup Active Directory entry by implicit UPN

In our company exists a forest-wide UPN suffix company.com and almost all user accounts have the explicit UPN set to fistname.lastname@company.com. This value is also set in the Active Directory ...
0
votes
1answer
12 views

Kerberos SSO virtualhost different domain

I have a running centos6.6 server who authenticates against a windows 2008 AD with realm EXAMPLE.LOCAL. I have successfully configured an apache webserver for authentication through kerberos keytab ...
1
vote
2answers
1k views

need help in setting up SPN for Kerberos Authentication

I am using IIS 7 for setting up a website under windows authentication. I am seeing authentication issue which i am almost sure that it is related to kerberos issue and i am wrongly setting up SPN. ...
2
votes
1answer
1k views

Apache mod_auth_kerb asking 2 authentication

I've configured Apache to use mod_auth_kerberos. So far everything is working nicely for client thats connected to Active Directory and have their browser to NTLM enabled. When clients are not in the ...
0
votes
0answers
25 views

Kerberos constrained delegation

There is a small problem with the setting Kerberos constrained delegation in Active Directory. The scheme works as follows: 1. Client workstation. 2. Web server with Windows 2008 Ent installed IIS ...
0
votes
1answer
22 views

SCOM: SQL Server cannot authenticate using Kerberos

For past few months, we are getting these kind of alert in SCOM stating SQL Server cannot authenticate using Kerberos. One thing to note here is that this alert is coming from only one server not ...
4
votes
2answers
2k views

March 10th Patch Tuesday appears to cause SQL Server client connection problems

Since applying the full set of patches on a Win 7.1 Pro desktop and a Windows 2012 R2 Datacenter Azure server running SQL 2014, SQL Management Studio (2008 and 2014 versions) won't connect to the SQL ...
1
vote
1answer
48 views

Unable to join AD domain using Kerberos from kickstart

I am trying to join to the Windows domain in the %post chroot section of my kickstart script using kinit and net commands after setting up the samba, kerberos and sssd configurations in %pre. My ...
0
votes
2answers
1k views

Kerberos Event 4 servername showing username

We have a .Net Windows Service that uses a Httplistener and authenticates requests using Kerberos. When users are connecting via their browser, an error in the users event log shows a Kerberos Event ...
0
votes
1answer
87 views

Kerberos constrained delegation using Citrix NetScaler

I'm currently evaluating Citrix NetScaler VPX (NS10.5 56.12.nc) as a potential replacement for Microsoft TMG server. Kerberos Constrained Delegation is at the top of my list of mandatory features. ...
1
vote
1answer
1k views

DCOM Authentication Fails to use Kerberos, Falls back to NTLM

I have a webservice that is written in Classic ASP. In this web service it attempts to create a VirtualServer.Application object on another server via DCOM. This fails with Permission Denied. However ...
0
votes
0answers
23 views

Samba4 and Kerberos configuration on a dedicated server

I try to set up Samba 4 on a dedicated server from kimsufi.com but I have difficulties configuring Kerberos and Samba4. I am very confused about IP, Realm, Domain, NetBIOS, DNS etc. in Kerberos and ...
4
votes
3answers
5k views

0x19 KDC_ERR_PREAUTH_REQUIRED in my event log

So I have a server, and every time a user or service account logs on to the machine, an error event is generated in the System log: A Kerberos Error Message was received: on logon session ...
0
votes
2answers
4k views

winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm

While looking for reasons why logging in to a samba machines joined to Active Directory is slow I have the strong impression that the following error in my log file could be a hint. Apr 3 14:44:14 ...
0
votes
1answer
83 views

Integrate Squid Kerberos auth and Squidguard ldapusersearch into AD

I'm having trouble with Squid Kerberos auth and the Squidguard ldapusersearch that I use to apply ACLs by Active Directory groups membership. The problem is : Squid and Squidguard see my user as : ...
0
votes
1answer
24 views

unable to change environment variable using setenv()

I have an a member server with a windows PDC with active directory. Security=ads. I am trying to set an environment variable(credential cache) using C: setenv("CCACHE","cache_name",1); However, ...
2
votes
2answers
56 views

OpenSSH two factor authentication combined with Kerberos / public key

I'm trying to implement two-factor authentication for OpenSSH. The environment is Centos 7 (kernel: 3.10.0-229.1.2.el7.x86_64) with OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013. We have Active ...
0
votes
1answer
62 views

Security-Kerberos Error, event ID 4

I have two new Domain Controllers on new Forest. Servers have DFS and IIS services installed. Everything seemed to go Ok for a While. After updating servers I got new errors. Now once in hour ...
1
vote
1answer
1k views

Can't get postgres and kerberos (gss) working together

I am trying to get postgres and kerberos, via GSSAPI, working together. Having trouble at this point. It does not help that I am really a newbie for both technologies. I have both postgres and ...
1
vote
2answers
2k views

Windows Server 2003 -Ktpass - crypto: enum value 'rc4-hmac' is not known

I'm trying to create a keytab with Ktpass on a Windows Server 2003 with: Ktpass -princ host/prueba-mail.ejemplo.org@EJEMPLO.ORG -mapuser host -pass password -crypto rc4-hmac -out UNIXhost.keytab I ...
1
vote
0answers
29 views

Nagios Apache publishing

I am deploying a NagiosXI server (CentOS 6.6) and I would like to publish the site externally to allow team members to use the mobile app without the need for a VPN client. I have worked out the ...
2
votes
1answer
880 views

problems creating a keytab file on win server

I am trying to create a keytab file. i see a warning WARNING: pType and account type do not match. This might cause problems. The command i use is ktpass -princ ...
0
votes
2answers
11k views

kinit: Cannot contact any KDC for realm 'UBUNTU' while getting initial credentials

I am installing Kerberos5-1.12.1 on ubuntu machine by following the link: http://techpubs.spinlocksolutions.com/dklar/kerberos.html#krb-install Whenever i am trying to do : kinit user1 I am ...
2
votes
1answer
1k views

Linux Client Active Directory Authentication stops working when failover

I have an issue with Linux clients trying to AD authentication by targeting a DNS name (corp.example.com). I have 2 Domain Controller servers DC1(10.0.0.3/24), DC2(10.1.0.3/24) both domain controllers ...
0
votes
0answers
11 views

Kerberos transitive trust and Auth to local

I need to connect users belonging to a realm to services that resides to another realm. These two realms are not trusted together, but realm A (where users are) is trusted by realm B. This one is ...
0
votes
0answers
13 views

How to authenticate RHEL 6.6 to Windows Server 2012 Active Directory and LDAP? [duplicate]

Need help with setting up LDAP on Windows Server 2012 R2, I have AD setup already, but not sure what all I need to do to get LDAP running. Then I can't find any good resources online to authenticate ...
0
votes
0answers
24 views

What is the authentication flow when Exchange 2013 proxies to Exchange 2010?

Issue Outlook users, who are on LAN, and have an email address that is different from the UPN get prompted for authentication. Topology 1,000 clients connect to a central DAG & CAS array on ...
0
votes
1answer
112 views

Client not found in kerberos database while getting initial

I am installing Squid3 on Ubuntu 14.10 and I want to integrate it ADDS on windows server 2012 using kerberos 5. My infrastructure are as follows: Default Gateway: 192.168.1.1 DNS & Domain ...
5
votes
3answers
224 views

Check Primary Authentication Protocol for Active Directory (NTLM or Kerberos?) [duplicate]

How can I check, from a client machine (in Global Group)(also is local admin), whether the domain controller is authenticating my login request to the domain using NTLM or Kerberos? I know that ...
0
votes
1answer
354 views

[root@pcm-ipa-01 tmp]# klist klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0)freeipa kadmin admin principal not found

I have installed freeipa on centos and after restarting the service seems to have lost authentication for "kadmin" [root@pcm-ipa-01 ~]# kadmin init Authenticating as principal root/admin@MY.DOMAIN T ...
0
votes
0answers
21 views

What are the implications of removing Negotiate as a Windows Authentication provider?

A single user of our internal website is getting the following message when using IE9 to access one of our internal websites hosted on IIS 7.5: 401 - Unauthorized: Access is denied due to invalid ...
2
votes
0answers
81 views

Kerberos KDC has no support for encryption type while getting credentials

I am configuring an apache/SSO authentication with an AD with Kerberos. My http server is a Debian Wheezy and the AD is a Windows Server 2012. I generated keytabs files on WS2012 with kpass command ...
1
vote
2answers
1k views

FreeIPA: command-line tools do not work, 'No Kerberos credentials available'

We have a working FreeIPA installation, it's in production since February. Almost everything works as expected but when we try to run command-line FreeIPA-related tools none of them work: [admin@ipa ...
1
vote
1answer
75 views

Kerberos keytab permissions

Can you share some thoughts on whether a Kerberos keytab should be readable only by root - under all circumstances? Or are there exceptions to this rule? I am setting up a Squid proxy on Debian ...
0
votes
1answer
99 views

FreeIPA krb5.conf has example.com entries

I have installed and reinstalled FreeIPA ipa-server-3.0.0-37.el6.x86_64 on a fully updated OEL 6.5 server a couple (3) times now and even if I destroy the existing /etc/krb5.conf file and reinstall ...
0
votes
1answer
47 views

AWS EC2 Server can not access a fileshare over a VPC VPN using the machine name

I have a windows server on EC2 that is connected to my office via VPN. I'm having an issue connecting to file shares over the VPN. I'm able to connect if I use the IP address for example if I use ...
0
votes
0answers
105 views

Troubleshooting kerberos problems with Samba

I've run into an odd problem with Samba 3.6.23. Right now I have a Windows 2008 R2 machine that has trouble accessing shares on a domained Samba box. \\example_serv\my_share : Fails with LOGIN ...
0
votes
0answers
32 views

Mongodb + Kerberos BadValue SASL mechanism GSSAPI is not supported

I am trying to run an instance of mongodb with the authentication mechanism GSS-API. This is the command: mongod --dbpath /home/ec2-user/db/node2/data --auth --setParameter ...
0
votes
0answers
23 views

Error while integrating OpenLDAP and Kerberos

I am trying to set up Kerberos with OpenLDAP backend. I followed this doc http://web.mit.edu/Kerberos/www/krb5-1.12/doc/admin/conf_ldap.html and this ...
3
votes
3answers
3k views

SQL Server Windows Authentication fails after tonight's security updates: The login is from an untrusted domain

We have the following setup: One Domain Controller (DC, Server 2003 R2 Standard x64) One SQL Server (SQL, Server 2008 R2 Standard x64) some clients. All machines are in the same domain. All user ...
2
votes
2answers
266 views

Apache 2.2.14 / mod_auth_kerb 5.4 : Custom krb5.conf for Apache Instance

Objective: Use Apache/mod_auth_kerb using a custom krb5.conf file, not system standard /etc/krb5.conf. Issue: I've got a strongly regimented environment where we application owners are able to ...
0
votes
0answers
69 views

Samba AD DC Authentication Problems

I'm trying to setup an AD PDC using Samba4 on Ubuntu 14.04. My endgame here is to have an AD domain with users created by LDAP that can login to the domain and use roaming profiles, so that any users ...
0
votes
0answers
10 views

KCD and CIFS: strange behavior

I'm trying to use Kerberos Constrained Delegation in order to access to some CIFS folder, below the environment: DC is windows 2003 User "111" under OU "/aaa/users" User "222" under OU "/bbb/users" ...
1
vote
3answers
3k views

How to automate kinit process to obtain TGT for Kerberos?

I'm currently writing a puppet module to automate the process of joining RHEL servers to an AD domain, with support for Kerberos. Currently I have problems with automatically obtain and cache ...
0
votes
2answers
138 views

Authentication fails when using ARR to load balance Lync 2013 internal web services

I'm using Application Request Routing 3.0 on Windows Server 2012 R2 to load balance the internal web services on a Lync 2013 front-end pool; I'm not using it to reverse proxy the external web services ...
0
votes
0answers
70 views

kprop: Client not found in Kerberos database while getting initial ticket

I tried to set up two kdc with Kerberos 5: a master and a slave. I followed the instructions from the official docs: http://web.mit.edu/kerberos/krb5-latest/doc/admin/install_kdc.html But ...
0
votes
0answers
37 views

Obtain krb ticket for another user

I have a system account in my domain (DOM\sys) and it has access to service cifs/server@DOM. I want to obtain a ticket for this service using my own account (DOM\user). In other words I need sudo-like ...
1
vote
1answer
4k views

OpenLDAP Setup help: SASL/GSSAPI authentication started

I am trying to setup & configure OpenLDAP on Fedora Core 13. I've gotten as far as compiling and installing OpenLDAP v2.4.23. Whenever I try to run one of the LDAP commands (like ldapsearch), I ...
3
votes
1answer
2k views

How to enable Kerberos Authentication Service auditing on 2008 server

I have a 2008-level Windows domain running 5 x 2008 (non-R2) DCs (it's on the roadmap to migrate to R2 or possibly 2012 in the next 9-12 months, but this project needs to be working first), and I need ...