Tag Info

New answers tagged

0

I am not clear on what you are asking, do you just want a list of all SPNs in an Active Directory domain/forest from a Linux box? You can use ldapsearch for SPNs via the servicePrincipalName attribute.


0

Ran in to the same issue... Needed to add an entry into /etc/hosts. So the first entry needs to be the IP, the 2nd must be the fully qualified domain name for the domain you are joining, and the rest can be in any order.


0

In their document: MongoDB Enterprise supports authentication using a Kerberos service. Apparently their normal version doesn't support GSSAPI authentication mechanism, so downloading the enterprise version should solve the problem. http://docs.mongodb.org/manual/tutorial/control-access-to-mongodb-windows-with-kerberos-authentication/


1

On Windows machines that are part of an Active Directory domain, users receive their Kerberos ticket-granting ticket when they log into Windows, and PuTTY is able to use that for authentication if GSSAPI authentication is enabled in PuTTY Configuration Connection|SSH|Auth|GSSAPI (and other authentication methods that it tries before GSSAPI, such as ...


1

Kerberos is meant for authentication, i.e. proving who someone is. It is not intended for authorization, i.e. figuring out what someone should be allowed to do. You'll need to use something else. To paraphrase, the application should say "Yes, I believe you are who you say you are, but you can't access what you're trying to access." For sshd AllowGroups is ...


0

It is preferable to have your database in the form of a multimaster OpenLDAP backend. This has the effect of making you KDCs multimaster.


0

Looks like various code changes between 1.2 and 1.6 led to the problem that I was seeing. To fix the problem, I did the following: Added the kadmin/admin principal to /etc/krb5.keytab Appended --keytab=/etc/krb5.keytab to the kadmind arguments in /etc/inetd.conf This tells kadmind to explicitly look in /etc/krb5.keytab (instead of "HDBGET:") for the ...


1

First off, a clarification. Kerberos and SSH Keys are two mutually exclusive authentication methods for SSH. You don't use Kerberos with SSH Keys. You use Kerberos instead of SSH Keys. Both allow for "passwordless" SSH logon. A bit of reading on the Kerberos protocol may be in order. With Kerberos, you need to obtain a TGT that proves you are who you say ...


1

I recently had the same issue. It turned out to be SPN related. The SPN had been mapped to the machine account of the SQL Server instead of mapped to the service account that was running SQL Server. We deleted and recreated the SPN - mapped to the service account running SQL Server 2012R2 on the host and everything was gravy. #ShoutOutToGabe


2

On linux you can use kvno command to retreive it from KDC [root@XXXX XXX]# kvno host/XXXX host/XXXX@TEST.COM: kvno = 13



Top 50 recent answers are included