Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

31
votes
5answers
29k views

Why use Kerberos instead of NTLM in IIS?

This is something that I've never really been able to answer as well as I like: What is the real advantage of using Kerberos authentication in IIS instead of NTLM? I've seen a lot of people really ...
21
votes
2answers
5k views

Authenticating OpenBSD against Active Directory

Edit: Reformatted this as Q&A. If anyone can change this from Community Wiki to a typical question, that's probably more appropriate as well. How can I authenticate OpenBSD against Active ...
7
votes
4answers
25k views

How can I check if my IIS site is using NTLM or Kerberos?

How can I check if my IIS site is using NTLM or Kerberos? And how can I change authentication from Kerberos to NTLM? I'm using IIS 7.5 and I couldn't find any answer to this question, can help me a ...
1
vote
1answer
2k views

nagios - Web interface: authentication through kerberos OK, what about authorization on cgi.cfg?

I have successfully installed nagios, and it provides authentication through apache2 which contacts a kerberos authentication server to authenticate users. Now, users are authenticated, but they don'...
8
votes
7answers
51k views

How do you find out if Active Directory is using Kerberos or NTLM?

Is there a command line program you can use?
9
votes
3answers
10k views

Apache mod_auth_kerb and LDAP user groups

I've been considering deploying mod_auth_kerb on our internal web servers to enable SSO. The one obvious problem I can see is that it's an all-or-nothing approach, either all your domain users can ...
15
votes
3answers
40k views

Getting Squid to authenticate with kerberos and Windows 2008/2003/7/XP

This is something I setup recently and was quite a big pain. My environment was getting squid to authenticate a Windows 7 client against a Windows 2008 Server invisibly. NTLM is not really an option,...
7
votes
1answer
4k views

Best practice for authenticating DMZ against AD in LAN

We have few customer facing servers in DMZ that also have user accounts , all accounts are in shadow password file. I am trying to consolidate user logons and thinking about letting LAN users to ...
11
votes
4answers
8k views

Linux Central Authentication/Authorization Methods

I have a small but growing network of Linux servers. Ideally I'd like a central place to control User Access, change passwords, etc... I've read a lot about LDAP servers, but I'm still confused about ...
7
votes
4answers
48k views

Kinit Won't Connect to a Domain Server : Realm not local to KDC while getting initial credentials

I am setting up a testbed environment where Linux (Ubuntu 10.04) clients will authenticate to a Windows Server 2008 R2 Domain Server. I am following the official Ubuntu guide to set up a Kerberos ...
7
votes
1answer
7k views

How to remotely generate Windows AD Kerberos keytab from a Unix machine?

I would like to know if it’s possible to create a keytab file direct from a client machine without using the ktpass utility in the Windows Server side. The main reason I would want this, is to ...
3
votes
1answer
2k views

Single Sign On for intranet with Apache and Linux MIT Kerberos

EDIT: SOLVED! See my answer below. Greetings, I am looking for a way to do a single sign on to an intranet in the following manner: A Linux user logs on via a graphical frontend (for example, GNOME)...
1
vote
2answers
1k views

Kerberos authentication in IIS with .NET app under domain identity not working

Having a hell of a time trying to get a .NET web app to use Kerberos auth successfully, and would appreciate some assistance from the SF community. Currently there is a Win2003/IIS6 server hosting a ...
14
votes
2answers
4k views

The Story of secure user-authentication in squid

once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network: <the Internet> ...
5
votes
1answer
12k views

How to Change the Kerberos Default Ticket Lifetime

Our KDC servers are running either Ubuntu Dapper (2.6.15-28) or Hardy (2.6.24-19). The Kerberos software is the MIT implementation of Kerberos 5. By default, a Kerberos ticket lasts for 10 hours. ...
10
votes
1answer
4k views

How to tell mod_auth_kerb to do its job despite no “require valid-user”

I implemented a SSO authentication using mod_auth_kerb on Apache. My config looks like this: <Location /login/ > AuthType Kerberos AuthName "Kerberos Login" KrbMethodNegotiate on ...
3
votes
3answers
2k views

Risks involved in setting up Kerberos authentication for WSS Reporting Services

We have an established Intranet based on WSS with two front ends and a database. Currently all authentication is NTLM. We have installed Reporting Services In Integration Mode. RS works as long as ...
2
votes
1answer
1k views

Apache mod_auth_kerb asking 2 authentication

I've configured Apache to use mod_auth_kerberos. So far everything is working nicely for client thats connected to Active Directory and have their browser to NTLM enabled. When clients are not in the ...
8
votes
1answer
320 views

Kerberos: Separating AS and TGS

In Kerberos, the Authentication Server (AS) and the Ticket Granting Server (TGS) are generally implemented on the same server. This machine is called the Key Distribution Center (KDC). Surely, it ...
4
votes
3answers
495 views

Linux on Windows AD Domain

Successfully joined my Linux Box to a Windows AD Domain. Wanted to know from other admins if it us possible to specify what groups from windows ad is allowed to login? Otherwise anyone with a AD ...
3
votes
1answer
1k views

Strong Cryptography in Solaris Zone

I'm trying to setup a Kerberos KDC on a Solaris zone but ran into a bit of a problem with the Cryptographic Framework on Solaris 10 even though the packages for strong encryption (SUNWcry & ...
2
votes
1answer
9k views

Apache kerberos authentication to Active Directory not happening. (Is KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN related?)

My goal is to have Apache authenticate authenticate against AD, without prompting for a username and password, using Kerberos. It currently always shows "401 Unauthorized", and appears to be not ...
2
votes
3answers
7k views

Wrong principal in request (SSH/ GSSAPI/Kerberos/Debian)

I've set up two VMs on an "internal" (in VirtualBox meaning) network, one being a DNS server (dns1.example.com) and the other - a KDC and Kerberos admin server (kdc.example.com). The default and the ...
1
vote
0answers
43 views

Migrate logcal linux users to FreeIPA ones

We have several Linux machine (running various versions of Fedora and CentOS, but that should not be relevant) with local users. Most of those local users are the same login name but might have ...
0
votes
0answers
31 views

Migrate logcal windows users to FreeIPA ones

We have several Windows machine (running 7, 8, and 10, but that should not be relevant) with local users. Most of those local users are the same login name but might have different UID/GID based on ...
4
votes
3answers
17k views

SQL Server Windows Authentication fails after tonight's security updates: The login is from an untrusted domain

We have the following setup: One Domain Controller (DC, Server 2003 R2 Standard x64) One SQL Server (SQL, Server 2008 R2 Standard x64) some clients. All machines are in the same domain. All user ...
4
votes
4answers
6k views

Authenticating Windows 7 against MIT Kerberos 5

I've been wracking my brains trying to get Windows 7 authenticating against a MIT Kerberos 5 Realm (which is running on an Arch Linux server). I've done the following on the server (aka dc1): ...
3
votes
2answers
3k views

How do I configure an ldap server on ubuntu 11.04 ? (for use with subversion and trac)

I have an Ubuntu server 11.04 on ec2 (I'm mentioning this, as it appears things have changed in this version from previous ubuntu releases, when it regards LDAP configuration). I want to configure it ...
2
votes
1answer
2k views

Moving my website to different server changes authentication from Kerberos to NTLM

I have a webservice that is configured for Windows Authentication. The client code that invokes the WS passes along the credentials to the WS as follows: myWebService.Credentials = System.Net....
2
votes
2answers
7k views

2008 DC GPO - “Advanced Audit Policy Configuration” missing?

I'm trying to enable Kerberos Authentication auditing in a GPO for the purpose of sending auth events to an AD-integrated web filter appliance, and the instructions have me enable auditing of the ...
2
votes
1answer
2k views

How exactly does the HOST/machine SPN work?

Normally when you set up Kerberos for IIS, you would do something like setspn -A HTTP/machine some_account. When IIS 7 is installed, it registers the SPN "HOST/machine" for its kernel-mode ...
2
votes
2answers
5k views

Kerberos authentication through load balancer

I generally understand the problems that a load balancer poses for Kerberos. In fact, Microsoft's KB article outright states that it's not possible. However, this article - also on an MS site - ...
2
votes
1answer
803 views

Why is sshd engaging PAM still?

Background/Behavior is: if you ssh to box via and GSSAPI/Kerberos succeeds and you have a local user in /etc/passwd, you login fine per below PAM config. All Good there. But if you don't have a ...
2
votes
2answers
7k views

winbindd: kinit succeeded but ads_sasl_spnego_krb5_bind failed: Cannot contact any KDC for requested realm

While looking for reasons why logging in to a samba machines joined to Active Directory is slow I have the strong impression that the following error in my log file could be a hint. Apr 3 14:44:14 ...
1
vote
1answer
2k views

OpenSSH + Kerberos SSO: No key table entry found for host/localhost.localdomain

SSO not working with OpenSSH - I have not been able to get GSSAPIAuthentication to work with Kerberos. Everytime I attempted to login, I kept getting prompted for the password. During the ...
1
vote
2answers
550 views

Can anyone recommend a book on Kerberos that mentions AD 2008? [closed]

I've got a nice O'Reilly book on Kerberos from our library, but it was last updated in 2003. I'm pretty sure there have been changes and improvements since then, especially with AD 2008. Are there ...
1
vote
3answers
2k views

Disabling Windows password changes on Samba domain

When a user on one of our Windows clients hits ctrl-alt-delete to change his password, our Samba domain controller is notified and performs the password change. Unfortunately, the group policy rule ...
1
vote
1answer
374 views

Error: KDC has no support for encryption type

I have intermittent authentication issues on my ubuntu 15.04 servers. Periodically, authentication will just stop working. Eventually it will start working again on its own. Or, if I restart both smbd ...
1
vote
3answers
2k views

Using Apache / Kerberos / Keytab to Authenticate Redmine Users Against Active Directory

Please bare with me, as I am still fresh to these technologies. We have a Debian (squeeze) server to which I have root access. It is running Apache, and Redmine is deployed to the server (currently ...
1
vote
2answers
2k views

Windows Authentication KRB5KRB_AP_ERR_MODIFIED

Let me preface by saying, I've been on this issue for about a week and a half now and I can't figure it out. I think I'm close, but every time I've thought that so far, I was wrong. I've looked at ...
1
vote
2answers
3k views

Authenticating with Exchange WebDAV / Outlook Web Access

I'm having issues accessing Exchange WebDav / OWA from any machine but the IIS & Exchange server. We've got a small development domain running Windows 2003. One server (which we'll call IIS_box) ...
1
vote
0answers
379 views

Powerbroker Open : Cannot automount CIFS share, where is the kerberos ticket?

I am using Powerbroker Open (formerly Likewise Open) to join CentOS 7 machines to a Windows 2012 R2 domain. Login etc. works fine. Now I am trying to use the automatic mount of home directories via ...
0
votes
1answer
41 views

Forward service records from main DNS to IPA server

I have a production DNS server (dns1.local) in Data Center environment, I build recently IPA server (ipa.example.com) that runs DNS as well in the same environment and it forwards requests to dns1....
0
votes
1answer
805 views

LDAP + KERBEROS + NFS. Why do I need idmapd?

What I am trying to do I have a freeIPA domain, with a few clients and a Synology NAS (also enrolled in freeIPA). I created a shared folder on the NAS, with NFSv4 + krb5 support. From the client, I ...
0
votes
1answer
29 views

What changes with Kerberos authentication in IPv6 when everyone has a public IPv6 Address?

How should Kerberos authentication be set up with IPv6? What implications are there when client devices each use a public, globally routeable IPv6 IP address? What changes when setup this way ...
0
votes
1answer
2k views

Kerberos Authentication for Webservers

Before I blindly jump on "trial an error" tests, I'd like to ask some general questions on Kerberos Authentication for Webservers. I want to evaluate what's possible with Kerberos. The main benefit ...
0
votes
1answer
2k views

Kerberos pre-authentication failed on nfs mount

I have the following nfs export: /home/users 192.168.1.0/24(rw,sec=krb5p,no_subtree_check,nohide,async,anonuid=65534,anongid=65534) When trying to mount that on a client I get: client:/home # ...