New answers tagged

1

Try to add the following line to your smb.conf: client ldap sasl wrapping = plain It seems as this has caused some trouble lately.


2

You're probably hitting this bug https://bugzilla.samba.org/show_bug.cgi?id=6750 There are a couple of samba config changes that will solve it. I set kerberos method = secrets and keytab


0

Red Hat has an extremely accurate documentation of their products. On your case at hand, please refer to https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/prerequisites.html#dns-reqs If you are still experiencing troubles, pleas specify exactly what you have tried and what the ...


1

The Kerberos client built-into Windows is capable of handing this on its own. You just need to give it a little guidance on how to find the KDCs for the given realm first. It's sort of like the Windows equivalent of a krb5.conf file. From an elevated cmd prompt, run this for each KDC you want to utilize: ksetup /addkdc REALM.EXAMPLE.COM ...


0

So, the answer here is to use a package like MIT's Kerberos for Windows (if on a Windows box) to obtain a ticket. PuTTY will then attempt to use this key -- and you can explicitly ensure that the MIT stack is confirmed via the GSSAPI auth options in PuTTY's config. On Unix, you can use the regular kinit tools from the CLI to obtain a ticket.


1

I ended up using authconfig afterall, which means that I had to prepare a full kerberized environment. authconfig --enablewinbindkrb5 --update Note for anyone else who is planning to use this, this command updates the PAM stack, I believe it invalidates the config in /etc/security/pam_winbind.conf and also modifies /etc/samba/smb.conf. In order to use it ...


1

Set krb5_auth = yes in /etc/security/pam_winbind.conf. This file should be safe from any updates by authconfig. You could use auth sufficient pam_winbind.so use_first_pass krb5_auth in pam, but that might be overridden by authconfig.


1

as always, 'it depends'. I assume you are using some kind of linux. For one-off authentication, provided your ldap client supports GSSAPI, you can use the GSSAPI mechanism. So once you kinit successfuly and you have a tgt ticket, then you can use something like this (using the publicly available freeipa demo (http://www.freeipa.org/page/Demo): $ kinit ...


0

When you use the setspn tool, all you're doing is modifying the servicePrincipalName attribute of the specified computer/user in AD. To do the same from a Linux machine, you just need to use an LDAP tool to connect to a domain controller and modify the attribute like you would any other. Keep in mind that it's a multi-valued attribute though. So don't ...


1

Python library for Windows Remote Management (WinRM) will let you run remote command on a Windows machine from a Linux machine pywinrm is a Python client for Windows Remote Management (WinRM). This allows you to invoke commands on target Windows machines from any machine that can run Python. ...


1

The problem is, first, most tutorials talk about generating a keytab and a principal for the host. I do not understand this, because I am not authenticating the host but only the users. I know this answer is a few years after the question was asked, but, from Centrify's centrifydc.conf file: By default, a user's TGT will be verified by retrieving and ...


0

Out of nowhere it suddenly worked: do NOT specify -S rootdomainname.com in net ads


2

The same way as with IPv4, but with AAAA records instead of A records. Use IP6.ARPA instead of in-addr.arpa if rDNS is part of your setup. If you were port forwarding before, you don't have to do that. If you were relying on a lack of port forwarding to shield your services from the internet, setup a firewall ( iptables / router ACLs ) instead.


1

you don't have to. You can use your existing dns and ntp server infrastructure but you will need to manage the ipa records on your on your own instead of having ipa take care of it. In fact it does not really matter what servers run the dns service as long as the clients get their answers from you the infrastructure in place. You can, for instance, delegate ...


1

DNS and NTP being synced between your IPA server and clients is critical for kerberos tickets to be issued and considered valid. That is why it is recommended by RedHat to set up your IPA server as an NTP server. DNS is more optional; the critical part of DNS is that forward and reverse lookups succeed and match. The RedHat published guide on IdM (built on ...


2

The term Service Principal Name (SPN), as capitalized, is currently specific to Microsoft Windows, but the general concept of service or server principal names and conventions defined as part of the Kerberos Protocol.


5

They're a Kerberos thing. MIT Kerberos has them. I'd have to google other implementations to see if they have them, too.


1

We had the same issue and resolved it by re-issuing the domain controller certificates with the required KDC EKU. Our domain controller certificates now have four EKU's: Client, Server, KDC, and Smart Card. We also had to tweak the SAN's for our domain controller certificates. If you don't want to do that, you may want to experiment with disabling the ...


0

After creating various keytabs with ktpass.exe you can combine them with ktutil(1)



Top 50 recent answers are included