Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server ...

learn more… | top users | synonyms (1)

30
votes
5answers
29k views

Why use Kerberos instead of NTLM in IIS?

This is something that I've never really been able to answer as well as I like: What is the real advantage of using Kerberos authentication in IIS instead of NTLM? I've seen a lot of people really ...
21
votes
2answers
5k views

Authenticating OpenBSD against Active Directory

Edit: Reformatted this as Q&A. If anyone can change this from Community Wiki to a typical question, that's probably more appropriate as well. How can I authenticate OpenBSD against Active ...
15
votes
2answers
11k views

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of ...
15
votes
3answers
40k views

Getting Squid to authenticate with kerberos and Windows 2008/2003/7/XP

This is something I setup recently and was quite a big pain. My environment was getting squid to authenticate a Windows 7 client against a Windows 2008 Server invisibly. NTLM is not really an option,...
14
votes
2answers
4k views

The Story of secure user-authentication in squid

once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network: <the Internet> ...
12
votes
1answer
6k views

IPA vs just LDAP for Linux boxes - looking for a comparison

There are few (~30) Linux (RHEL) boxes and I'm looking for centralized and easy managed solution, mostly for control user accounts. I'm familiar with LDAP, and I deployed a pilot of IPA ver2 from Red ...
11
votes
6answers
10k views

How do I get /dev/random to work on an Ubuntu virtual machine?

Apparently, /dev/random is based on hardware interrupts or similar unpredictable aspects of physical hardware. Since virtual machines don't have physical hardware, running cat /dev/random within a ...
11
votes
2answers
2k views

How can I log into a Domain controller that doesn't trust itself

I have a windows 2008 R2 standalone Domain Controller that I restored from backup. The original DC is offline. When I log in with valid user credentials I get the error: "The security database ...
11
votes
3answers
7k views

How does Kerberos work with SSH?

Suppose I have four computers, Laptop, Server1, Server2, Kerberos server: I log in using PuTTY or SSH from L to S1, giving my username / password From S1 I then SSH to S2. No password is needed as ...
11
votes
5answers
4k views

Which kerberos flavor?

So I'm setting up a small network with all the standard stuff (files, email, etc.) and I've decided to go with a Kerberos+LDAP solution. Any ideas or recommendations on Heimdal vs. MIT? I've used MIT ...
11
votes
4answers
8k views

Linux Central Authentication/Authorization Methods

I have a small but growing network of Linux servers. Ideally I'd like a central place to control User Access, change passwords, etc... I've read a lot about LDAP servers, but I'm still confused about ...
10
votes
1answer
4k views

How to tell mod_auth_kerb to do its job despite no “require valid-user”

I implemented a SSO authentication using mod_auth_kerb on Apache. My config looks like this: <Location /login/ > AuthType Kerberos AuthName "Kerberos Login" KrbMethodNegotiate on ...
10
votes
3answers
3k views

How to deny access to disabled AD accounts via kerberos in pam_krb5?

I have a working AD/Linux/LDAP/KRB5 directory and authentication setup, with one small problem. When an account is disabled, SSH publickey authentication still allows user login. It's clear that ...
9
votes
3answers
10k views

Apache mod_auth_kerb and LDAP user groups

I've been considering deploying mod_auth_kerb on our internal web servers to enable SSO. The one obvious problem I can see is that it's an all-or-nothing approach, either all your domain users can ...
9
votes
2answers
2k views

Demoted domain controller still authenticating users

Why is a demoted domain controller still authenticating users? Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
9
votes
1answer
714 views

Kerberos authentication, service host and access to KDC

I have a web application (hostname: service.domain.com) and I wish to use Kerberos authentication to identify users that are logged into a Windows domain. Microsoft AD (Windows Server 2008 R2) is ...
9
votes
2answers
802 views

Any options out there for kerberized ssh client on windows?

Are there any good (reliable / free) ssh clients that work easily with Active Directory authenticated accounts in a Windows environment? Ideally that wouldn't need the Kerberos for Windows package? ...
9
votes
2answers
9k views

Integrated Windows Authentication with Apache HTTP Server on Linux

What is the best way to enable Integrated Windows Authentication for a PHP web application running on Apache2/Linux? There is a Windows Domain Controller in the network which should be used for ...
8
votes
7answers
50k views

How do you find out if Active Directory is using Kerberos or NTLM?

Is there a command line program you can use?
8
votes
1answer
305 views

Kerberos: Separating AS and TGS

In Kerberos, the Authentication Server (AS) and the Ticket Granting Server (TGS) are generally implemented on the same server. This machine is called the Key Distribution Center (KDC). Surely, it ...
8
votes
1answer
2k views

NFS (with Kerberos) mount failing due to “Server not found in Kerberos database” error

When running: sudo mount -t nfs4 -o sec=krb5 sol.domain.com:/ /mnt I get this error on the client: mount.nfs4: access denied by server while mounting sol.domain.com:/ And on the server syslogs I ...
7
votes
4answers
46k views

Kinit Won't Connect to a Domain Server : Realm not local to KDC while getting initial credentials

I am setting up a testbed environment where Linux (Ubuntu 10.04) clients will authenticate to a Windows Server 2008 R2 Domain Server. I am following the official Ubuntu guide to set up a Kerberos ...
7
votes
2answers
2k views

Is there a way to get Kerberos credentials to delegate twice? Why not?

All my nerdly life, I've dealt with this limitation of Windows Domains Login - console Integrated auth to something (usually web app) My credentials can't move to another server (e.g. database or ...
7
votes
4answers
1k views

Multiple Realms and Multiple TGTs under MIT Kerberos for Windows

My local computer uses Windows 7 Pro and belongs to realm LR, managed by AD servers. I login to my computer while attached to that realm's network. I can view the TGT with MIT Kerberos for Windows ver....
7
votes
1answer
4k views

Best practice for authenticating DMZ against AD in LAN

We have few customer facing servers in DMZ that also have user accounts , all accounts are in shadow password file. I am trying to consolidate user logons and thinking about letting LAN users to ...
7
votes
2answers
1k views

Risks of Kerberos Delegation

I've been spending hours upon hours trying to learn and understand Windows Authentication, Kerberos, SPNs, and Constrained Delegation in IIS 7.5. One thing I just don't get is why it is "risky" to ...
7
votes
4answers
25k views

How can I check if my IIS site is using NTLM or Kerberos?

How can I check if my IIS site is using NTLM or Kerberos? And how can I change authentication from Kerberos to NTLM? I'm using IIS 7.5 and I couldn't find any answer to this question, can help me a ...
7
votes
3answers
5k views

Virus that tries to brute force attack Active Directory users (in alphabetical order)?

Users started complaining about slow network speed so I fired up Wireshark. Did some checking and found many PCs sending packets similar to the following: (screenshot) http://imgur.com/45VlI.png I ...
7
votes
1answer
7k views

How to remotely generate Windows AD Kerberos keytab from a Unix machine?

I would like to know if it’s possible to create a keytab file direct from a client machine without using the ktpass utility in the Windows Server side. The main reason I would want this, is to ...
7
votes
3answers
2k views

Ubuntu 12.04, Windows 2012 Active Directory Integration, Kerberos won't resolve service principals

after having checked the whole internet literally, I hope that I might get help here. I am trying to accomplish integration of ubuntu 12.04 servers into a Windows 2012 active directory with nfs and ...
7
votes
2answers
207 views

Kerberos service login only possible for 30 minutes after running ktpass.exe

I'm trying to Kerberize an Apache-server, and allow the created server principal to sign on to the Active Directory. I've followed one of the numerous tutorials available online, and it seems to work ...
7
votes
3answers
942 views

Permissions are not taking effect with Kerberised NFSv4 on FreeBSD

I'm currently trying to set up an NFSv4 server on FreeBSD. I have extensive experience with doing this on other Unices (Solaris and Linux), but I'm fairly new to FreeBSD. My goal is to achieve the ...
6
votes
3answers
7k views

Can Windows integrate with LDAP?

Given an existing LDAP server used for authentication, can Windows desktops authenticate users against LDAP or perhaps Kerberos?
6
votes
1answer
14k views

IIS7 Windows Authentication Providers

Does anyone know what the different windows authentication providers for IIS7 means. There are 3 available providers NTLM Negotiate Negotiate:Kerberos NTLM is pretty obvious I think its NTLM ...
6
votes
2answers
5k views

NetApp erroring with: STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT

Since a sitewide upgrade to Windows 7 on desktop, I've started having a problem with virus checking. Specifically - when doing a rename operation on a (filer hosted) CIFS share. The virus checker ...
6
votes
1answer
483 views

How can one enable DES-encrypted keys on an Apple KDC?

We are running a KDC on OS X 10.10 Yosemite, to which we have added a service principal for remotely accessing a (legacy) host: $ kadmin add -r host/a.b.c.d@REALM Since the host only supports des-...
6
votes
2answers
22k views

Track Down Which Process/Program is Causing Kerberos pre-authentication error (Code 0x18)

We have a domain account that is being locked out via 1 of 2 servers. The built-in auditing only tells us that much (locked out from SERVER1, SERVER2). The account gets locked out within 5 minutes, ...
6
votes
3answers
6k views

SSH Kerberos authentication fails with “Wrong principal in request/Got no client credentials” on debian squeeze

I have a debian squeeze host where I can't log in with kerberos without a password prompt. An identically configured ubuntu 12.04 host works fine and can log in without getting a password prompt. ...
6
votes
1answer
14k views

Creating keytabs and service principal names

I'm trying to set up a keytab for a Java server to support Kerberos authentication on a Windows network. I'm struggling to get it working even at the level of the command line tools, haven't even got ...
6
votes
1answer
6k views

Seamless SSO with Kerberos, IE, Firefox, LDAP Active Directory

Alias /students /var/www/students <Location /students> KrbServiceName HTTP KrbMethodNegotiate On KrbMethodK5Passwd On KrbSaveCredentials off KrbAuthRealms DOMAIN.LOCAL Krb5KeyTab /...
6
votes
1answer
286 views

Does Active Directory's Kerberos implementation support per-user ticket lifetime settings?

With MIT Kerberos, the kadmin utility supports the creation of principals that have an explicit maximum ticket lifetime and renewal lifetime (-maxlife and -maxrenewlife arguments for add_principal) ...
6
votes
1answer
129 views

Time taken for authentication to work again after changing system time

One of our domain controllers clock drifted way out of sync with the rest of the network (thanks to me forgetting to turn off VMWare's time synchronisation), which caused a whole bunch of servers to ...
6
votes
1answer
326 views

Joining AD domain with Windows 10 using smart card

My Windows "domain-centric" company has abruptly decided to make the switch from Windows 7 to Windows 10, and it has become my job to make their prepared image join our domain with our smart card/...
6
votes
1answer
160 views

Is it possible to use Kerberos over TLS through sssd?

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with Kerberos and ...
6
votes
0answers
4k views

Kerberos NFS4 permission denied [closed]

** Edit: ** I am not using Sabayon Linux anymore and this problem didn't occur on other distributions. I suggest to close this question. Update: I realized that because of bad hosts file, both ...
6
votes
0answers
690 views

What breaks in a Windows domain if a member has a high time skew? [closed]

It's taken for granted by most IT people that in a Windows domain, if a member server's clock is off by more than 5 minutes (or however many minutes you've configured it for) from that of its domain ...
5
votes
4answers
20k views

Running a Windows service under a domain user account

If I run a Windows service on some host under a domain user account, and the password for this account changes at some later point, will the service now fail to start, until you update the password? ...
5
votes
3answers
1k views

In a Windows PKI, what is a Workstation Authentication CA Template used for? What happens if it expires?

Many workstations have an expiring computer certificate that was issued using the Workstation Authentication CA template. The CA of this template expires in 2 days. I've deployed a new CA, with an ...
5
votes
2answers
7k views

debian: cannot change password

As the root user, I can change the password: hussie:/home/claudiu# passwd Enter new password: Retype new password: passwd: password updated successfully As a non-root user I cannot: claudiu@hussie:...
5
votes
4answers
12k views

How to integrate Active Directory with FreeBSD 10.0 using security/sssd?

What are the required steps to authenticate users from an Active Directory running on Windows Server 2012 R2 in FreeBSD 10.0 using sssd with the AD backend with Kerberos TGT working?