Questions tagged [kerberos]

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.

Filter by
Sorted by
Tagged with
46 votes
2 answers
75k views

Can someone please explain Windows Service Principle Names (SPNs) without oversimplifying?

I have wrestled with service principle names a few times now and the Microsoft explanation is just not sufficient. I am configuring an IIS application to work on our domain and it looks like some of ...
Chris Magnuson's user avatar
43 votes
5 answers
56k views

Why use Kerberos instead of NTLM in IIS?

This is something that I've never really been able to answer as well as I like: What is the real advantage of using Kerberos authentication in IIS instead of NTLM? I've seen a lot of people really ...
Infotekka's user avatar
  • 545
31 votes
2 answers
26k views

What is SASL/GSSAPI?

Numerous times i have met the expression SASL/GSSAPI. I have searched Google many times, but i simply do no understand what it is and how it relate to Kerberos. Anybody that have a simple explanation ...
user avatar
24 votes
2 answers
8k views

Authenticating OpenBSD against Active Directory

Edit: Reformatted this as Q&A. If anyone can change this from Community Wiki to a typical question, that's probably more appropriate as well. How can I authenticate OpenBSD against Active ...
22 votes
3 answers
36k views

How does Kerberos work with SSH?

Suppose I have four computers, Laptop, Server1, Server2, Kerberos server: I log in using PuTTY or SSH from L to S1, giving my username / password From S1 I then SSH to S2. No password is needed as ...
PhilR's user avatar
  • 483
21 votes
6 answers
21k views

How do I get /dev/random to work on an Ubuntu virtual machine?

Apparently, /dev/random is based on hardware interrupts or similar unpredictable aspects of physical hardware. Since virtual machines don't have physical hardware, running cat /dev/random within a ...
Nick's user avatar
  • 4,656
20 votes
2 answers
6k views

The Story of secure user-authentication in squid

once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network: <the Internet> ...
Isaac's user avatar
  • 581
18 votes
5 answers
38k views

Kerberos Authentication for workstations not on domain

I have a base understanding of how Kerberos works in an Active Directory environment and the methods it uses to authenticate users and workstations onto the network, but my question is.. since ...
Eric's user avatar
  • 185
18 votes
1 answer
19k views

IPA vs just LDAP for Linux boxes - looking for a comparison

There are few (~30) Linux (RHEL) boxes and I'm looking for centralized and easy managed solution, mostly for control user accounts. I'm familiar with LDAP, and I deployed a pilot of IPA ver2 from Red ...
Vitaly Karasik DevOps's user avatar
18 votes
9 answers
191k views

Kinit Won't Connect to a Domain Server : Realm not local to KDC while getting initial credentials

I am setting up a testbed environment where Linux (Ubuntu 10.04) clients will authenticate to a Windows Server 2008 R2 Domain Server. I am following the official Ubuntu guide to set up a Kerberos ...
Phanto's user avatar
  • 911
18 votes
8 answers
129k views

How do you find out if Active Directory is using Kerberos or NTLM?

Is there a command line program you can use?
LeWoody's user avatar
  • 309
16 votes
4 answers
17k views

Linux Central Authentication/Authorization Methods

I have a small but growing network of Linux servers. Ideally I'd like a central place to control User Access, change passwords, etc... I've read a lot about LDAP servers, but I'm still confused about ...
Chris McBride's user avatar
15 votes
2 answers
39k views

Why don't Active Directory user accounts automatically support Kerberos AES authentication?

I'm playing around with a test domain on Windows Server 2012 R2. I'm operating at the highest possible functional level and have no backwards-compatibility issues in my small test environment. However,...
Reid Rankin's user avatar
15 votes
3 answers
48k views

Getting Squid to authenticate with kerberos and Windows 2008/2003/7/XP

This is something I setup recently and was quite a big pain. My environment was getting squid to authenticate a Windows 7 client against a Windows 2008 Server invisibly. NTLM is not really an option,...
Harley's user avatar
  • 2,227
14 votes
1 answer
41k views

Why is MS SQL Server Using NTLM Authentication?

Windows Server 2008 R2. SQL Server 2008 R2 installed. MSSQL Service runs as Local System. Server FQDN is SQL01.domain.com. SQL01 is joined to an Active Directory domain named domain.com. The ...
Ryan Ries's user avatar
  • 55.9k
14 votes
2 answers
40k views

Kerberos ktutil, what kinds of encryption are available?

I am attempting to make a keytab using ktutil. I get to choose the encryption type, but the ktutil man page does not offer a list of possible choices. I also don't know which encryption method is the ...
Dylan Klomparens's user avatar
14 votes
5 answers
9k views

Which kerberos flavor?

So I'm setting up a small network with all the standard stuff (files, email, etc.) and I've decided to go with a Kerberos+LDAP solution. Any ideas or recommendations on Heimdal vs. MIT? I've used MIT ...
Michael Lowman's user avatar
13 votes
3 answers
50k views

How to automate kinit process to obtain TGT for Kerberos?

I'm currently writing a puppet module to automate the process of joining RHEL servers to an AD domain, with support for Kerberos. Currently, I have problems with automatically obtain and cache ...
tore-'s user avatar
  • 1,396
13 votes
2 answers
28k views

Automatic Kerberos Ticket Renewal (Indefinitely)

I am currently switching our environment from NIS over to Kerberos + LDAP. During this migration I've now run into the following situation. We mount our homes via NFS which obviously should also be ...
Blackclaws's user avatar
13 votes
5 answers
108k views

Track Down Which Process/Program is Causing Kerberos pre-authentication error (Code 0x18)

We have a domain account that is being locked out via 1 of 2 servers. The built-in auditing only tells us that much (locked out from SERVER1, SERVER2). The account gets locked out within 5 minutes, ...
Jaigene Kang's user avatar
13 votes
2 answers
68k views

Kerberos KDC has no support for encryption type while getting credentials

I am configuring an apache/SSO authentication with an AD with Kerberos. My http server is a Debian Wheezy and the AD is a Windows Server 2012. I generated keytabs files on WS2012 with kpass command ...
lazzio's user avatar
  • 326
12 votes
7 answers
47k views

Retreive the current Kerberos KVNO from Active Directory

I have a Kerberos problem with a Linux host connecting to a Windows KDC. I suspect that Kerberos key with the wrong version is to blame. One way to be shure would be to delete the SPN and create it ...
ixe013's user avatar
  • 1,066
12 votes
3 answers
18k views

Apache mod_auth_kerb and LDAP user groups

I've been considering deploying mod_auth_kerb on our internal web servers to enable SSO. The one obvious problem I can see is that it's an all-or-nothing approach, either all your domain users can ...
Kamil Kisiel's user avatar
  • 12.3k
12 votes
6 answers
83k views

How can I check if my IIS site is using NTLM or Kerberos?

How can I check if my IIS site is using NTLM or Kerberos? And how can I change authentication from Kerberos to NTLM? I'm using IIS 7.5.
KlimczakM's user avatar
  • 223
12 votes
3 answers
47k views

Putty Kerberos/GSSAPI authentication

I configured a few Linux servers to authenticate with Active Directory Kerberos using sssd on RHEL6. I also enabled GSSAPI authentication in hopes of passwordless logins. But I can't seem to get ...
xdfil's user avatar
  • 511
12 votes
2 answers
9k views

Adding local users / passwords on Kerberized Linux box

Right now if I try to add a non-system user not in the university's Kerberos realm I am prompted for a Kerberos password anyway. Obviously there is no password to be entered, so I just press enter and ...
Brian's user avatar
  • 333
12 votes
3 answers
19k views

Integrated Windows Authentication with Apache HTTP Server on Linux

What is the best way to enable Integrated Windows Authentication for a PHP web application running on Apache2/Linux? There is a Windows Domain Controller in the network which should be used for ...
Florian Fankhauser's user avatar
11 votes
4 answers
7k views

Multiple Realms and Multiple TGTs under MIT Kerberos for Windows

My local computer uses Windows 7 Pro and belongs to realm LR, managed by AD servers. I login to my computer while attached to that realm's network. I can view the TGT with MIT Kerberos for Windows ver....
Toddius Zho's user avatar
11 votes
1 answer
6k views

How to tell mod_auth_kerb to do its job despite no "require valid-user"

I implemented a SSO authentication using mod_auth_kerb on Apache. My config looks like this: <Location /login/ > AuthType Kerberos AuthName "Kerberos Login" KrbMethodNegotiate on ...
Benjamin Wohlwend's user avatar
11 votes
2 answers
42k views

Permissions to create an spn

According to some of the documentation I've read the service account for SQL server will create an SPN when the database engine starts up, allowing for kerberos authentication. I haven't been able to ...
Thirster42's user avatar
11 votes
2 answers
56k views

keytab auth against samba 4 DC: Client not found in Kerberos database while getting initial credentials

I set up a samba 4 active directory on ubuntu 14.04 following Samba AD DC HOWTO. In principle everything works well but I'm stuck in getting kerberos authentication running using SPNs for web ...
Heiko Robert's user avatar
10 votes
2 answers
5k views

How can I log into a Domain controller that doesn't trust itself

I have a windows 2008 R2 standalone Domain Controller that I restored from backup. The original DC is offline. When I log in with valid user credentials I get the error: "The security database on ...
makerofthings7's user avatar
10 votes
5 answers
30k views

How to integrate Active Directory with FreeBSD 10.0 using security/sssd?

What are the required steps to authenticate users from an Active Directory running on Windows Server 2012 R2 in FreeBSD 10.0 using sssd with the AD backend with Kerberos TGT working?
Vinícius Ferrão's user avatar
10 votes
2 answers
4k views

Demoted domain controller still authenticating users

Why is a demoted domain controller still authenticating users? Whenever users log onto workstations with domain accounts, this demoted DC authenticates them. Its security log shows their logons, ...
Eric Eskildsen's user avatar
10 votes
1 answer
2k views

Kerberos authentication, service host and access to KDC

I have a web application (hostname: service.domain.com) and I wish to use Kerberos authentication to identify users that are logged into a Windows domain. Microsoft AD (Windows Server 2008 R2) is ...
StrangeLoop's user avatar
10 votes
3 answers
5k views

How to deny access to disabled AD accounts via kerberos in pam_krb5?

I have a working AD/Linux/LDAP/KRB5 directory and authentication setup, with one small problem. When an account is disabled, SSH publickey authentication still allows user login. It's clear that ...
PhilR's user avatar
  • 483
10 votes
2 answers
673 views

Is this Kerberos/AD setup possible?

We have a slightly complicated IDAM setup: I.e. the end user's machine and browser sit in one network with the parent AD, and our Jetty-based application and the AD that it can talk to (local AD) sit ...
Rob Grant's user avatar
  • 103
9 votes
5 answers
18k views

Change local password as root after configuring for MS-AD Kerberos+LDAP

I have followed this excellent post to configure Kerberos + LDAP: http://koo.fi/blog/2013/01/06/ubuntu-12-04-active-directory-authentication/ However, there are some local users used for services. ...
Daniel C. Lopez's user avatar
9 votes
4 answers
49k views

0x19 KDC_ERR_PREAUTH_REQUIRED in my event log

So I have a server, and every time a user or service account logs on to the machine, an error event is generated in the System log: A Kerberos Error Message was received: on logon session DOMAIN\...
Ryan Ries's user avatar
  • 55.9k
9 votes
7 answers
96k views

Add new server to Server Manager, get Kerberos error 0x80090322

I'm setting up a Windows lab environment. It has a Win2012R2 domain controller (srv001) and I'd like to add another Win2012R2 server to the domain (srv003). Actually, all goes well. I gave the new ...
rwwilden's user avatar
  • 369
9 votes
1 answer
46k views

How to Change the Kerberos Default Ticket Lifetime

Our KDC servers are running either Ubuntu Dapper (2.6.15-28) or Hardy (2.6.24-19). The Kerberos software is the MIT implementation of Kerberos 5. By default, a Kerberos ticket lasts for 10 hours. ...
user40497's user avatar
  • 221
9 votes
2 answers
28k views

Possible to authenticate Samba via Kerberos but without domain-join?

With a Kerberos config file... [realms] DOMAIN.COM = { kdc = dc1.domain.com admin_server = dc1.domain.com } ...it is possible for Linux to talk to Active Directory for password ...
DarkSideGeek's user avatar
9 votes
1 answer
20k views

How to remotely generate Windows AD Kerberos keytab from a Unix machine?

I would like to know if it’s possible to create a keytab file direct from a client machine without using the ktpass utility in the Windows Server side. The main reason I would want this, is to ...
Allan Alvaro's user avatar
9 votes
2 answers
3k views

Kerberos: Separating AS and TGS

In Kerberos, the Authentication Server (AS) and the Ticket Granting Server (TGS) are generally implemented on the same server. This machine is called the Key Distribution Center (KDC). Surely, it ...
Misch's user avatar
  • 193
9 votes
2 answers
2k views

Any options out there for kerberized ssh client on windows?

Are there any good (reliable / free) ssh clients that work easily with Active Directory authenticated accounts in a Windows environment? Ideally that wouldn't need the Kerberos for Windows package? ...
chris's user avatar
  • 12k
8 votes
4 answers
43k views

Running a Windows service under a domain user account

If I run a Windows service on some host under a domain user account, and the password for this account changes at some later point, will the service now fail to start, until you update the password? ...
BeeOnRope's user avatar
  • 592
8 votes
2 answers
37k views

Unable to setup Kerberos on Ubuntu 14.04 - krb5kdc: No such file or directory - while initializing database for realm myrealm

I'm attempting to follow the guide on the Ubuntu wiki for installing and setting up Kerberos. I am running Ubuntu 14.04 (LTS) 64-bit. I have setup avahi-daemon in order to provide .local DNS names. I ...
victorhooi's user avatar
8 votes
1 answer
23k views

"setspn -s" vs. "setspn -a"

According to the Setspn Overview, it's discouraged to use Setspn -A to add an SPN record and it's suggested to use Setspn -S instead. It's said that Setspn -S checks if SPN already exists before ...
bahrep's user avatar
  • 687
8 votes
3 answers
31k views

Can Windows integrate with LDAP?

Given an existing LDAP server used for authentication, can Windows desktops authenticate users against LDAP or perhaps Kerberos?
jldugger's user avatar
  • 14.5k
8 votes
2 answers
20k views

Changing login-formats for Linux and Active Directory

On CentOS, I run realm list and see login-formats: %[email protected] I'd like to change login-formats: %[email protected] to login-formats: %U How would I go about doing this? I'm assuming there is a ...
dcfcolo's user avatar
  • 81

1
2 3 4 5
24