Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

0
votes
0answers
17 views

Kerberos constrained delegation using Citrix NetScaler

I'm currently evaluating Citrix NetScaler VPX (NS10.5 56.12.nc) as a potential replacement for Microsoft TMG server. Kerberos Constrained Delegation is at the top of my list of mandatory features. ...
1
vote
2answers
994 views

need help in setting up SPN for Kerberos Authentication

I am using IIS 7 for setting up a website under windows authentication. I am seeing authentication issue which i am almost sure that it is related to kerberos issue and i am wrongly setting up SPN. ...
0
votes
0answers
12 views

How to authenticate RHEL 6.6 to Windows Server 2012 Active Directory and LDAP? [duplicate]

Need help with setting up LDAP on Windows Server 2012 R2, I have AD setup already, but not sure what all I need to do to get LDAP running. Then I can't find any good resources online to authenticate ...
4
votes
2answers
2k views

March 10th Patch Tuesday appears to cause SQL Server client connection problems

Since applying the full set of patches on a Win 7.1 Pro desktop and a Windows 2012 R2 Datacenter Azure server running SQL 2014, SQL Management Studio (2008 and 2014 versions) won't connect to the SQL ...
1
vote
0answers
28 views

permission for accessing files are denied and some sessions are killed [migrated]

I ssh to a Linux server which runs kerberos. This is the first time I met Kerberos. After some time of being idle or loging out and loging in, I found some strange things, which I am not sure if are ...
0
votes
0answers
9 views

What is the authentication flow when Exchange 2013 proxies to Exchange 2010?

Issue Outlook users, who are on LAN, and have an email address that is different from the UPN get prompted for authentication. Topology 1,000 clients connect to a central DAG & CAS array on ...
0
votes
1answer
31 views

Client not found in kerberos database while getting initial

I am installing Squid3 on Ubuntu 14.10 and I want to integrate it ADDS on windows server 2012 using kerberos 5. My infrastructure are as follows: Default Gateway: 192.168.1.1 DNS & Domain ...
1
vote
1answer
1k views

DCOM Authentication Fails to use Kerberos, Falls back to NTLM

I have a webservice that is written in Classic ASP. In this web service it attempts to create a VirtualServer.Application object on another server via DCOM. This fails with Permission Denied. However ...
0
votes
0answers
22 views

Integrate Squid Kerberos auth and Squidguard ldapusersearch into AD

I'm having trouble with Squid Kerberos auth and the Squidguard ldapusersearch that I use to apply ACLs by Active Directory groups membership. The problem is : Squid and Squidguard see my user as : ...
5
votes
3answers
134 views

Check Primary Authentication Protocol for Active Directory (NTLM or Kerberos?) [duplicate]

How can I check, from a client machine (in Global Group)(also is local admin), whether the domain controller is authenticating my login request to the domain using NTLM or Kerberos? I know that ...
0
votes
1answer
145 views

[root@pcm-ipa-01 tmp]# klist klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0)freeipa kadmin admin principal not found

I have installed freeipa on centos and after restarting the service seems to have lost authentication for "kadmin" [root@pcm-ipa-01 ~]# kadmin init Authenticating as principal root/admin@MY.DOMAIN T ...
0
votes
2answers
3k views

winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm

While looking for reasons why logging in to a samba machines joined to Active Directory is slow I have the strong impression that the following error in my log file could be a hint. Apr 3 14:44:14 ...
0
votes
0answers
14 views

What are the implications of removing Negotiate as a Windows Authentication provider?

A single user of our internal website is getting the following message when using IE9 to access one of our internal websites hosted on IIS 7.5: 401 - Unauthorized: Access is denied due to invalid ...
0
votes
2answers
1k views

Windows Server 2003 -Ktpass - crypto: enum value 'rc4-hmac' is not known

I'm trying to create a keytab with Ktpass on a Windows Server 2003 with: Ktpass -princ host/prueba-mail.ejemplo.org@EJEMPLO.ORG -mapuser host -pass password -crypto rc4-hmac -out UNIXhost.keytab I ...
1
vote
1answer
1k views

Can't get postgres and kerberos (gss) working together

I am trying to get postgres and kerberos, via GSSAPI, working together. Having trouble at this point. It does not help that I am really a newbie for both technologies. I have both postgres and ...
2
votes
0answers
40 views

Kerberos KDC has no support for encryption type while getting credentials

I am configuring an apache/SSO authentication with an AD with Kerberos. My http server is a Debian Wheezy and the AD is a Windows Server 2012. I generated keytabs files on WS2012 with kpass command ...
1
vote
2answers
1k views

FreeIPA: command-line tools do not work, 'No Kerberos credentials available'

We have a working FreeIPA installation, it's in production since February. Almost everything works as expected but when we try to run command-line FreeIPA-related tools none of them work: [admin@ipa ...
1
vote
1answer
49 views

Kerberos keytab permissions

Can you share some thoughts on whether a Kerberos keytab should be readable only by root - under all circumstances? Or are there exceptions to this rule? I am setting up a Squid proxy on Debian ...
-1
votes
0answers
46 views

Kerberos Active Directory Domain Failure (uBuntu)

I try to join Active Directory and Samba 4 in Ubuntu 12.04.05. When I run host -t SRV _kerberos._udp.test.sg I get the error: Host _kerberos._udp.test.sg not found: 3(NXDOMAIN) meanwhile $# host ...
2
votes
1answer
1k views

Linux Client Active Directory Authentication stops working when failover

I have an issue with Linux clients trying to AD authentication by targeting a DNS name (corp.example.com). I have 2 Domain Controller servers DC1(10.0.0.3/24), DC2(10.1.0.3/24) both domain controllers ...
0
votes
1answer
2k views

Lookup Active Directory entry by implicit UPN

In our company exists a forest-wide UPN suffix company.com and almost all user accounts have the explicit UPN set to fistname.lastname@company.com. This value is also set in the Active Directory ...
0
votes
1answer
88 views

FreeIPA krb5.conf has example.com entries

I have installed and reinstalled FreeIPA ipa-server-3.0.0-37.el6.x86_64 on a fully updated OEL 6.5 server a couple (3) times now and even if I destroy the existing /etc/krb5.conf file and reinstall ...
0
votes
1answer
34 views

AWS EC2 Server can not access a fileshare over a VPC VPN using the machine name

I have a windows server on EC2 that is connected to my office via VPN. I'm having an issue connecting to file shares over the VPN. I'm able to connect if I use the IP address for example if I use ...
0
votes
2answers
9k views

kinit: Cannot contact any KDC for realm 'UBUNTU' while getting initial credentials

I am installing Kerberos5-1.12.1 on ubuntu machine by following the link: http://techpubs.spinlocksolutions.com/dklar/kerberos.html#krb-install Whenever i am trying to do : kinit user1 I am ...
0
votes
0answers
47 views

Troubleshooting kerberos problems with Samba

I've run into an odd problem with Samba 3.6.23. Right now I have a Windows 2008 R2 machine that has trouble accessing shares on a domained Samba box. \\example_serv\my_share : Fails with LOGIN ...
0
votes
0answers
21 views

Mongodb + Kerberos BadValue SASL mechanism GSSAPI is not supported

I am trying to run an instance of mongodb with the authentication mechanism GSS-API. This is the command: mongod --dbpath /home/ec2-user/db/node2/data --auth --setParameter ...
0
votes
0answers
17 views

Error while integrating OpenLDAP and Kerberos

I am trying to set up Kerberos with OpenLDAP backend. I followed this doc http://web.mit.edu/Kerberos/www/krb5-1.12/doc/admin/conf_ldap.html and this ...
3
votes
3answers
2k views

SQL Server Windows Authentication fails after tonight's security updates: The login is from an untrusted domain

We have the following setup: One Domain Controller (DC, Server 2003 R2 Standard x64) One SQL Server (SQL, Server 2008 R2 Standard x64) some clients. All machines are in the same domain. All user ...
2
votes
2answers
260 views

Apache 2.2.14 / mod_auth_kerb 5.4 : Custom krb5.conf for Apache Instance

Objective: Use Apache/mod_auth_kerb using a custom krb5.conf file, not system standard /etc/krb5.conf. Issue: I've got a strongly regimented environment where we application owners are able to ...
0
votes
0answers
52 views

Samba AD DC Authentication Problems

I'm trying to setup an AD PDC using Samba4 on Ubuntu 14.04. My endgame here is to have an AD domain with users created by LDAP that can login to the domain and use roaming profiles, so that any users ...
0
votes
0answers
9 views

KCD and CIFS: strange behavior

I'm trying to use Kerberos Constrained Delegation in order to access to some CIFS folder, below the environment: DC is windows 2003 User "111" under OU "/aaa/users" User "222" under OU "/bbb/users" ...
1
vote
3answers
2k views

How to automate kinit process to obtain TGT for Kerberos?

I'm currently writing a puppet module to automate the process of joining RHEL servers to an AD domain, with support for Kerberos. Currently I have problems with automatically obtain and cache ...
0
votes
2answers
102 views

Authentication fails when using ARR to load balance Lync 2013 internal web services

I'm using Application Request Routing 3.0 on Windows Server 2012 R2 to load balance the internal web services on a Lync 2013 front-end pool; I'm not using it to reverse proxy the external web services ...
0
votes
0answers
35 views

kprop: Client not found in Kerberos database while getting initial ticket

I tried to set up two kdc with Kerberos 5: a master and a slave. I followed the instructions from the official docs: http://web.mit.edu/kerberos/krb5-latest/doc/admin/install_kdc.html But ...
0
votes
0answers
32 views

Obtain krb ticket for another user

I have a system account in my domain (DOM\sys) and it has access to service cifs/server@DOM. I want to obtain a ticket for this service using my own account (DOM\user). In other words I need sudo-like ...
1
vote
1answer
4k views

OpenLDAP Setup help: SASL/GSSAPI authentication started

I am trying to setup & configure OpenLDAP on Fedora Core 13. I've gotten as far as compiling and installing OpenLDAP v2.4.23. Whenever I try to run one of the LDAP commands (like ldapsearch), I ...
3
votes
1answer
2k views

How to enable Kerberos Authentication Service auditing on 2008 server

I have a 2008-level Windows domain running 5 x 2008 (non-R2) DCs (it's on the roadmap to migrate to R2 or possibly 2012 in the next 9-12 months, but this project needs to be working first), and I need ...
1
vote
1answer
62 views

Kerberos, Active Directory, and Linux/Unix Servers

I have done some research on the topic, but I can't quite find a straight answer to my question. Please tell me if my understanding is correct. Kerberos can be used as the bridge between a ...
0
votes
1answer
30 views

Client not requesting Kerberos authentication

My client is not requesting Kerberos tickets, but does when using fiddler. I was then advised not to use fiddler and use Wireshark, using this I can see that the client is sending an NTLM ...
1
vote
1answer
72 views

Ldap+kerberos authentication through AD

Is it possible to configure ldap+kerberos authentication on a linux machine without joining it to windows domain? I have to create a pool of VMs using RHEVM with a pretty short lifetime and I do not ...
0
votes
2answers
48 views

kadmin cannot list principals “requires list privileges”

I can authenticate fine via kadmin however cannot list principals? [root@server ~]# kadmin -p admin Authenticating as principal admin with password. Password for admin@org.domain.com: kadmin: ...
0
votes
1answer
17 views

Slave Kerberos behind NAT - kprop fails: Incorrect net address while decoding database size from client

I want to synchronize MIT Kerberos database from master to slave, which is in a different geographical location. kprop synchronization fails because of a NAT. Is there any solution to have kprop ...
0
votes
2answers
213 views

F5 authentication using kerberos keytab

Our network gear use tacplus for authentication and authorization. tac itself authenticates using kerberos. For one of the projects we need automated login to a F5 device using a script. Does anyone ...
4
votes
1answer
39 views

At which point becomes a changed computer group membership active?

When adding a computer object to an AD group, at which point in time does the group membership become active? Is there some kind of kerberos refresh interval (similar to group policy refresh)? I ...
9
votes
6answers
7k views

How do I get /dev/random to work on an Ubuntu virtual machine?

Apparently, /dev/random is based on hardware interrupts or similar unpredictable aspects of physical hardware. Since virtual machines don't have physical hardware, running cat /dev/random within a ...
1
vote
1answer
65 views

Ubuntu 14.04 Active Directory auth fails after static ip config

I'm having 6 Ubuntu 14.04 servers that are joined to active directory (2003 domain functional level 2008r2 schema) All of the servers work's fine when network interface is configured to use DHCP. But ...
0
votes
1answer
72 views

Setting up Secure Hadoop Cluster - Kerberos security

I setup a HDP 2.2 cluster successfully (1 NM, 3 DNs and 1 client). User accounts to access HDP cluster are created in client and checked these users can submit jobs, by SSH to client node and run ...
0
votes
0answers
13 views

give serverprincipalname read write permissions to security group members

What are the settings for the group to make the following change? I need to create a group that can be used to grant: serviceprincipalname SELF Read serviceprincipalname SELF Write to its members. ...
10
votes
2answers
4k views

How does Kerberos work with SSH?

Suppose I have four computers, Laptop, Server1, Server2, Kerberos server: I log in using PuTTY or SSH from L to S1, giving my username / password From S1 I then SSH to S2. No password is needed as ...
0
votes
3answers
131 views

Alternatives to Kerberos for passwordless server access

I have a bunch of Linux servers and three Windows servers 2008 R2. I would need a solution which would enable passwordless SSH login from each of those servers to all others. I could do this by ...