Tag Info

New answers tagged

2

Surely Apple haven't compiled Kerberos without any support for DES? Well, actually, it looks like they did in 10.10/Yosemite. And after the mess they made of Kerberos in 10.07/Lion... you have my sincere condolences. The functionality that krb5-weak.conf tries to achieve won't be needed on OS X from Yosemite (10.10) on forwards, since Yosemite's ...


2

It's quite old question, but someone might find it help full. First of all: change sshd_config and use default option: UsePAM yes. Logging on Centos/RedHat is through PAM to SSSD, and than Kerberos itself. The same is with SSH, it first looks on PAM config, and contact SSSD, than Kerberos. Because of Kerberos verifing domain, I would recommend using ...


0

Basically, setspn in a proper functioning AD shows no duplicates. I think you should remove 'em at least for the troubled machine. Start with the troubled machine SPN's which miss the realm part.


2

RFC 4120 has your answer deep on page 74 and 75. It reads: kdc-options This field appears in the KRB_AS_REQ and KRB_TGS_REQ requests to the KDC and indicates the flags that the client wants set on the tickets as well as other information that is to modify the behavior of the KDC. Where appropriate, the name of an option ...


0

If you want to set up a Linux service/application to authenticate to an IIS service endpoint, you can get the Linux box to authenticate to an IIS hosted windows site like this: Ensure your IIS Site windows authentication providers are set in this order for Windows Auth: NTLM Negotiate Create a Principal for the account you want to authenticate as: Login ...


0

The error you get in the output is because you are not mapping the SPN to a principal. You should use a ptype switch of -ptype KRB5_NT_PRINCIPAL so as to avoid the error. KRB5_NT_PRINCIPAL is the general principal type (recommended) as documented by Microsoft.


0

Response from MSFT: Case 114120112106756 Any application which looks for client authentication will require client authentication certificate( A certificate issued to Computer via Computer or workstation template). It is an application configuration whether to check for client certificate or not. For example SCCM could be configured to check for client ...


3

What are the Workstation Certificates used for? Kerberos? they can be used for client authentication during secure channel negotiation (for example, in IPsec or in L2TP VPN). They are not used for initial client authentication, when machine starts up. Will users/machines be able to login Monday morning (post expiration date)? yes, why not? ...


9

• What are the Workstation Certificates used for? Kerberos? No. Kerberos doesn't use SSL/TLS certificates.** An administrator may choose to use a given certificate template for any number of different things, so I'd say it's impossible for us to know right now what exactly those certificates were being used for in your environment. The Workstation ...


0

Check whether the non-working IIS server has "trust computer for delegation" set: http://blogs.technet.com/b/taraj/archive/2009/01/29/checklist-for-double-hop-issues-iis-and-sql-server.aspx


2

WAP must be domain joined when publishing applications that use Windows Integrated Authentication. This link describes the requirements, http://technet.microsoft.com/en-us/library/8dfd483f-faf5-4a99-a590-0081623cad08#BKMK_AD. To use claims based applications you are not required to domain join the WAP server.


1

A bit expanded from the discussion in the comments: Your question is: if you divert the SSH traffic from the client to a rogue SSH server, can that be used in a replay attack by capturing and forwarding the clients Kerberos ticket by the rogue SSH server to the real Server1? This relies on the SSH security mechanisms preventing MiTM attacks failing, i.e. ...


1

The problem was in the Windows Kerberos setup. I think our Active Directory is set up funky, I don't really know I'm not a Windows admin. But I fixed the problem by manually configuring Kerberos using ksetup in the Windows 7 CLI. After a reboot to my remote workstation I couldn't log in to my PC. That is because in the original configuration the TLD ...


1

First double check that your klist output on the Windows box running PuTTY shows a valid TGT. Then in the config for your PuTTY session, make sure Attempt GSSAPI authentication is enabled in Connection - SSH - Auth - GSSAPI. Finally, make sure it's configured to login with your username automatically in Connection - Data. You can either explicitly specify ...


0

Found the solution here: http://blogs.technet.com/b/dcaro/archive/2013/07/04/fixing-the-security-kerberos-4-error.aspx I ran: setspn -A HTTP/$servername$.$domain$.com.au $username$ and that fixed the problem


1

At first glance, in the manual, Kerberos with SPNEGO is supported out of the box: Similarly to Hadoop RPC, Hadoop HTTP web-consoles can be configured to require Kerberos authentication using HTTP SPNEGO protocol (supported by browsers like Firefox and Internet Explorer).


1

KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN means the KDC has no idea who holds the SPN, at your case the requested SPN is HTTP/self-test.example.com The two common reasons for this are: the SPN doesn't exists on any account in the Active Directory Forest (doesn't seems to be your case) there are more then one account that is holding the same SPN (duplicate SPN) ...



Top 50 recent answers are included