Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

1
vote
0answers
3 views

how can I restrict kerberos service tickets by group?

I have multiple Linux servers all configured to allow kerberos authentication with active directory. All other user and group attributes reside in a separate directory server (389). I am able to log ...
6
votes
1answer
11k views

IIS7 Windows Authentication Providers

Does anyone know what the different windows authentication providers for IIS7 means. There are 3 available providers NTLM Negotiate Negotiate:Kerberos NTLM is pretty obvious I think its NTLM ...
1
vote
0answers
11 views

kadmind error - krb5_recvauth: start_seq_get is not supported in the HDBGET keytab type

I'm trying to migrate a heimdal KDC with an OpenLDAP backend from a Debian 5.x server (heimdal 1.2.dfsg.1-2.1) to a Ubuntu 14.04 server (heimdal 1.6~git20131207+dfsg-1ubuntu1.1), and am running into ...
0
votes
2answers
10k views

Windows Server Manager Kerberos error 0x80090322

I have been frustrated with this issue for two days now so I finally decided to ask this on serverfault. I'm setting up a Windows lab environment. It has a Win2012R2 domain controller (srv001) and ...
0
votes
0answers
10 views

kdc server and admin server and client in same machine [on hold]

I am learning the kerberos using the MIT version in UBUNTU 14.04. I haven't any virtual machines and other pc's and I haven]t any domain name[realm name]. Now my goal is to check the functionality of ...
0
votes
1answer
35 views

Using SSH Keys with Kerberos

So there's an issue that we've been having at our company causing me to pull my hair out for the past week: We have hundreds of server boxes (a mix of CentOS6/7, if it matters) that need to quickly ...
1
vote
2answers
795 views

Windows Authentication KRB5KRB_AP_ERR_MODIFIED

Let me preface by saying, I've been on this issue for about a week and a half now and I can't figure it out. I think I'm close, but every time I've thought that so far, I was wrong. I've looked at ...
10
votes
1answer
3k views

IPA vs just LDAP for Linux boxes - looking for a comparison

There are few (~30) Linux (RHEL) boxes and I'm looking for centralized and easy managed solution, mostly for control user accounts. I'm familiar with LDAP, and I deployed a pilot of IPA ver2 from Red ...
3
votes
2answers
2k views

Retreive the current Kerberos KVNO from Active Directory

I have a Kerberos problem with a Linux host connecting to a Windows KDC. I suspect that Kerberos key with the wrong version is to blame. One way to be shure would be to delete the SPN and create it ...
2
votes
1answer
1k views

Linux Client Active Directory Authentication stops working when failover

I have an issue with Linux clients trying to AD authentication by targeting a DNS name (corp.example.com). I have 2 Domain Controller servers DC1(10.0.0.3/24), DC2(10.1.0.3/24) both domain controllers ...
0
votes
0answers
27 views

Kinit from windows to linux KDC

I have a KDC set up on a Linux virtual host, known as ldap.local, which has a FreeIPA server running on it. I am trying to get a TGT from it, from my Windows 7 Enterprise machine. I am able to easily ...
0
votes
0answers
7 views

Php,apache ds,kerberos integration [closed]

I have installed Apache ds and enabled kerberos server(the one coming along with DS).I am successful in connecting to server using GSSAPI authentication from Apache studio.Apache ds and kerbros is ...
1
vote
1answer
2k views

Lookup Active Directory entry by implicit UPN

In our company exists a forest-wide UPN suffix company.com and almost all user accounts have the explicit UPN set to fistname.lastname@company.com. This value is also set in the Active Directory ...
2
votes
1answer
1k views

Apache mod_auth_kerb asking 2 authentication

I've configured Apache to use mod_auth_kerberos. So far everything is working nicely for client thats connected to Active Directory and have their browser to NTLM enabled. When clients are not in the ...
1
vote
1answer
19 views

Joining Linux host to Active Directory fails to update Microsoft DNS

I am joining Linux hosts (CentOS 6) to Active Directory using a special bind account. I've granted delegate permissions to this user and when I join on the default Computers OU, a computer object is ...
1
vote
2answers
1k views

need help in setting up SPN for Kerberos Authentication

I am using IIS 7 for setting up a website under windows authentication. I am seeing authentication issue which i am almost sure that it is related to kerberos issue and i am wrongly setting up SPN. ...
0
votes
0answers
15 views

'Kerberos Method' on Samba 3.0

When running sudo net ads join -U admin to add my domain to the realm, I get the error: Unknown parameter encountered: "kerberos method" I found out that kerberos method is not supported by Samba ...
2
votes
1answer
23 views

Windows 7 versus 8 Access CNAME'd Share

Here's a situation that came up yesterday: we have a share on a machine we have to access using an alias (CNAME). The machine is running Windows Server 2012 R2, and services Windows 7 and 8 clients. ...
0
votes
2answers
14 views

How can I audit Ip adresses of users logging into system?

I have a group of servers which use Kerberos for authentication. We distribute keytabs to users but want to ensure that a user never pass their keytab to someone else. Essentially we need to audit the ...
0
votes
2answers
139 views

kadmin cannot list principals “requires list privileges”

I can authenticate fine via kadmin however cannot list principals? [root@server ~]# kadmin -p admin Authenticating as principal admin with password. Password for admin@org.domain.com: kadmin: ...
1
vote
1answer
16 views

Privileges when doing sudo to another domain user

Suppose I have a corporate domain mydomain using MS Active Directory. In the domain I have the users myuser and youruser. Now, on one specific Ubuntu machine mymachine, myuser has sudo rights, and ...
2
votes
1answer
1k views

Why don't Active Directory user accounts automatically support Kerberos AES authentication?

I'm playing around with a test domain on Windows Server 2012 R2. I'm operating at the highest possible functional level and have no backwards-compatibility issues in my small test environment. ...
4
votes
2answers
2k views

March 10th Patch Tuesday appears to cause SQL Server client connection problems

Since applying the full set of patches on a Win 7.1 Pro desktop and a Windows 2012 R2 Datacenter Azure server running SQL 2014, SQL Management Studio (2008 and 2014 versions) won't connect to the SQL ...
2
votes
3answers
5k views

Wrong principal in request (SSH/ GSSAPI/Kerberos/Debian)

I've set up two VMs on an "internal" (in VirtualBox meaning) network, one being a DNS server (dns1.example.com) and the other - a KDC and Kerberos admin server (kdc.example.com). The default and the ...
0
votes
0answers
35 views

kdm and ssh detecting different fully qualified domain name when using kerberos authentication

I'm attempting to setup Kerberos login support (Windows AD domain providing the kerberos) for Kubuntu 12.04 Linux workstations at the company I'm at. It's almost completely working but I can't get ...
0
votes
2answers
2k views

Kerberos Event 4 servername showing username

We have a .Net Windows Service that uses a Httplistener and authenticates requests using Kerberos. When users are connecting via their browser, an error in the users event log shows a Kerberos Event ...
1
vote
1answer
40 views

How to avoid frequent KVNO increases, when using Apache HTTPD with mod_auth_kerb talking to AD?

I've setup Apache HTTPD 2.4 with mod_auth_kerb, created a service account on Active Directory, added a SPN for my http hostname, created a keytab file on the linux machine, and had SSO start working ...
0
votes
2answers
63 views

Apache 2.2 mod_auth_kerb SSO stopped working

I'm all out of ideas why has it just stopped working, here's what I checked: httpd-error.log: [Thu Jun 11 18:04:21 2015] [debug] src/mod_auth_kerb.c(1758): [client 10.105.5.131] ...
3
votes
0answers
62 views

Samba authentication and LDAP

I have an OpenLDAP server that I use for authentication and authorization for various services. All users are of object type inetOrgPerson and my groups are groupOfNames. Now I want to configure ...
1
vote
1answer
41 views

Ubuntu 14.04 Failing to join domain for Integration with Active Directory (winbind & samba)

I've followed the tutorial at this link https://help.ubuntu.com/community/ActiveDirectoryWinbindHowto Everything seems to be configured somewhat correctly, net rpc join worked and the realm is listed ...
1
vote
1answer
28 views

Active Directory: Permissions to get Kerberos Service Ticket

I have an Active Directory with a KDC running on Windows Server 2012. At the moment, every user can request service tickets for every service from the TGS. I'm looking for a solution where the KDC ...
3
votes
1answer
43 views

Windows client damage authorization header (Kerberos) => IIS 400 (Bad Request)

We are facing strange behavior on about 5% of Windows (7 Pro and XP Pro, both 32 and 64 bits) client computers. These computers gets randomly error from IIS server - 400 Bad request. We are using ...
1
vote
1answer
1k views

DCOM Authentication Fails to use Kerberos, Falls back to NTLM

I have a webservice that is written in Classic ASP. In this web service it attempts to create a VirtualServer.Application object on another server via DCOM. This fails with Permission Denied. However ...
0
votes
1answer
54 views

Samba4 and Kerberos configuration on a dedicated server

I try to set up Samba 4 on a dedicated server from kimsufi.com but I have difficulties configuring Kerberos and Samba4. I am very confused about IP, Realm, Domain, NetBIOS, DNS etc. in Kerberos and ...
0
votes
1answer
19 views

Does “Kerborised” NFSv4 securely protect against a malicious client spoofing the user

I have read conflicting statements about whether shares exported via NFSv4 with sec=krb5 are cryptographically protected against a malicious client mounting the share and then spoofing the user to ...
2
votes
1answer
1k views

IIS 7.5 web application failing with NT Authority\Anonymous Logon

I am finding various google results, but none seem to fix my problem. I am setting up a new WINDOWS 2008 R2 box at work that is to communicate with an existing SQL 2012 box via web tools running in ...
1
vote
2answers
4k views

winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm

While looking for reasons why logging in to a samba machines joined to Active Directory is slow I have the strong impression that the following error in my log file could be a hint. Apr 3 14:44:14 ...
5
votes
4answers
6k views

How to integrate Active Directory with FreeBSD 10.0 using security/sssd?

What are the required steps to authenticate users from an Active Directory running on Windows Server 2012 R2 in FreeBSD 10.0 using sssd with the AD backend with Kerberos TGT working?
1
vote
0answers
36 views

Changing login-formats for Linux and Active Directory

On CentOS, I run realm list and see login-formats: %U@mydomain.local I'd like to change login-formats: %U@mydomain.local to login-formats: %U How would I go about doing this? I'm assuming there is a ...
2
votes
1answer
59 views

Linux AD integration, unable to login when using Windows Server 2012 DC

I am trying to integrate my CentOS 6.6 servers into Active Directory. I've followed this guide from Red Hat using configuration 3 (SSSD/Kerberos/LDAP). When using a Windows Server 2008 R2 server as ...
2
votes
2answers
12k views

kinit: Cannot contact any KDC for realm 'UBUNTU' while getting initial credentials

I am installing Kerberos5-1.12.1 on ubuntu machine by following the link: http://techpubs.spinlocksolutions.com/dklar/kerberos.html#krb-install Whenever i am trying to do : kinit user1 I am ...
1
vote
1answer
1k views

Can't get postgres and kerberos (gss) working together

I am trying to get postgres and kerberos, via GSSAPI, working together. Having trouble at this point. It does not help that I am really a newbie for both technologies. I have both postgres and ...
3
votes
0answers
49 views

Windows Authentication to a Remote Server within an Intranet Environment

I have several servers (all on the same DC) within an Intranet environment at my company. For simplicity, I'll focus my question on the IIS and SQL Servers. I have an IIS 7.5 web server and a remote ...
3
votes
3answers
5k views

SQL Server Windows Authentication fails after tonight's security updates: The login is from an untrusted domain

We have the following setup: One Domain Controller (DC, Server 2003 R2 Standard x64) One SQL Server (SQL, Server 2008 R2 Standard x64) some clients. All machines are in the same domain. All user ...
1
vote
2answers
2k views

Windows Server 2003 -Ktpass - crypto: enum value 'rc4-hmac' is not known

I'm trying to create a keytab with Ktpass on a Windows Server 2003 with: Ktpass -princ host/prueba-mail.ejemplo.org@EJEMPLO.ORG -mapuser host -pass password -crypto rc4-hmac -out UNIXhost.keytab I ...
0
votes
0answers
19 views

Kerberos PuTTY from non-domain machine via VPN

Feels like I'm missing something fundamental here... Have a non-domain machine (personal machine off site) from which I VPN into our work network. Once connected, from 'klist', it appears my VPN ...
2
votes
1answer
934 views

Firefox not using Kerberos despite being configured to

I am deploying Linux/Firefox on a corporate Kerberos network. I followed this Kerberos-on-Firefox procedure but still Firefox does not connect via the company's Kerberos. I am using Firefox 3.0.18 ...
2
votes
2answers
124 views

OpenSSH two factor authentication combined with Kerberos / public key

I'm trying to implement two-factor authentication for OpenSSH. The environment is Centos 7 (kernel: 3.10.0-229.1.2.el7.x86_64) with OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013. We have Active ...
1
vote
2answers
80 views

LDAP syncrepl with kerberos authentication

I'm trying to set up a replication server for LDAP using syncrepl. I would like to use Kerberos to authenticate the consumer, because we have it set up, and it seems more secure. The database ...
0
votes
1answer
40 views

Kerberos SSO virtualhost different domain

I have a running centos6.6 server who authenticates against a windows 2008 AD with realm EXAMPLE.LOCAL. I have successfully configured an apache webserver for authentication through kerberos keytab ...