New answers tagged kerberos
This worked for me Running krb5_newrealm inside a VM can take a long time to complete (after showing "Loading random data" message). You can use the following hack to quicken things a bit. $ sudo aptitude install rng-tools -y $ sudo rngd -r /dev/urandom -o /dev/random # don't do this in production! posted at ...
Add proper forward and reverse entries to Windows domain DNS for all the servers, as Kerberos requires them. It's likely that until now domain DHCP server used to do it automatically, now it doesn't happen due to no DHCP. Also make sure /etc/resolv.conf only lists Windows domain DNS servers.
When and only when a new access token is created. This does not occur when a TGT is refreshed at 10 hours. It also does not occur automatically when the ticket expires after 7 days. You have to actually get a brand new one. This is why you must either reboot or do the klist trick.
In short: Yes, when running Hadoop with Kerberos, the authenticated user must exist in the passwd file (or equivalent user directory such as LDAP) on every node where the TaskTracker (MRv1) or YARN nodemanager runs. For MRv1, the TaskTracker launches a program called the task-controller prior to each task starting. The task-controller is a setuid root ...
If you do go down the active directory route it may be worth taking a look at Centrify, particularly the express version which is free and makes it very simple to implement passwordless SSH login. It uses Kerberos underneath but there's no need to get your hands dirty configuring it.
Unless your kdc.conf has an acl_file entry pointing to a different location, you should create/edit /var/lib/krb5kdc/kadm5.acl, kadm5.acl(5). However, this is for plain MIT-krb5. FreeIPA probably has its own methods for this.
Kerberos is the best option, but you probably don't want to set it up by hand. It has a lot of moving parts and is easy to get something wrong. Instead, you should set up a domain and join all of the computers to the domain. You have three options for setting up a domain for this environment: FreeIPA. This is well supported in Linux, especially Red ...
Kerberos is the best option for this. Is supported in nearly every distro of Linux, Windows since 2000, and Mac since 10.2. It's relatively simple to setup if you already have an existing Windows domain infrastructure. If you do, just Google the name and version of your distro and "kerberize".
I had the exact same issue and in the end found out it was because I had set sasl-host in slapd.conf to be the kerberos server hostname. When I changed sasl-host to be ldap hostname (e.g. sasl-host ldap.example.com) it worked correctly.
GSSAPI authentication is not handled by PAM. The PAM module for kerberos is used for password authentication of a user, using the kerberos protocol to obtain a valid ticket. There are 3 outcomes of the GSSAPI authentication. Authentication failed because credentials were sent but the credentials were invalid. Authentication succeeded using the credentials ...
As it turns out Microsoft has deprecated the IMU Server role on Server 2012! I Ended up going with Pass-Through Authentication on a Linux based OpenLDAP server to pass the user credentials back to AD. The Posix attributes are then maintained in OpenLDAP, negating any dependency on AD.
what exactly do you need? You should use IPA CLI instead of kadmin. http://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/Kerberos_Errors.html
I found that irrespective of the web server SPN configuration, I needed to create an SPN for the SQL Server using an HOST record for the SQL Server name, rather than a CNAME alias. That is, to cover all bases, I have added SPN's as follows; setspn -A MSSQLSvc/sqlserverhostname.example.org SQLServerServiceAccountName setspn -A ...
Top 50 recent answers are included