Hot answers tagged kerberos
On linux you can use kvno command to retreive it from KDC [root@XXXX XXX]# kvno host/XXXX host/XXXX@TEST.COM: kvno = 13
This happens when there's a mismatch between the SPNs listed in the keytab and the Principal Name provided by the client (the browser). It could depend by the browser used (some browsers take the name from the URL, some other do a reverse lookup of the ip address they're connecting to). The common solution to this is setting KrbServiceName to Any: ...
Active Directory increments KVNO pursuant to RFC 4120. Microsoft documented their implementation of it in the document MS-KILE section 22.214.171.124. Active Directory essentially ignores KVNO. (Except on Read-Only DCs - if an RODC is compromised, the keys it holds can not be reused against another DC.) So my point is AD generally doesn't care what your KVNO is - ...
First off, a clarification. Kerberos and SSH Keys are two mutually exclusive authentication methods for SSH. You don't use Kerberos with SSH Keys. You use Kerberos instead of SSH Keys. Both allow for "passwordless" SSH logon. A bit of reading on the Kerberos protocol may be in order. With Kerberos, you need to obtain a TGT that proves you are who you say ...
Only top voted, non community-wiki answers of a minimum length are eligible