Tag Info

New answers tagged

0

Initially I got below error under Redhat Linux environment. kinit: Client not found in Kerberos database while getting initial credentials While I tried with the below service account registerdd with the F_KEY $ kinit HOST/domainname.no@HOSTNAME.NET And it prompted me to provide the password and it worked ! I am able to generate 'krb5cc_0' ...


0

I realize this is really old and this may or may not be part of your problem, but I have noticed in the past that if you don't capitalize the following in krb5.conf, you may run into issues: [realms] MYDOMAIN.COM = { kdc = mydomain.com admin_server = mydomain.com } [realms] MYDOMAIN.COM = { kdc = MYDOMAIN.COM admin_server = MYDOMAIN.COM }


0

I also learned Kerberos beginning with Achim Grolms' mod_auth_kerb tutorial, really a good piece of documentation. The keytab file only replaces the password authentication. Password is encoded in the file and these bytes are used in authentication challenge with KDC. Any password change on the service account will invalidate keytab authentication, and also ...


1

Active Directory doesn't emulate an LDAP server, it is an LDAP server, with some Microsoft extensions. Yes, some services simply use the provided credentials to do an LDAP bind, and authenticates the user if it succeeds. There are half a dozen ways you can authenticate SAMBA access against AD - a quick google search should bring up step by step ...


0

This is tricky, especially since the 4771 event from Windows doesn't contain a logon ID. It's surprising how difficult it can be to track this down, considering how many events Windows logs. Have you looked at scheduled tasks? What I'd recommend is process monitoring, but only enable the network activity monitoring. I think you can also reduce the impact ...


0

I had to do add_entry -password -p username@CORP.COMPANY.COM -k 1 -e arcfour-hmac write_kt keytab when using kinit that comes with VAS. Notice arcfour-hmac Then kinit -kt keytab username@CORP.COMPANY.COM works like a charm.


0

After a session with Synology support, I finally understood that this cannot work at the moment, due to a limitation on DSM 5.2. The problem is that DSM assumes the LDAP server to use the UMich schema, which is NFS-specific, therefore looking for attribute GSSAuthName when a GSS request comes in. Instead, FreeIpa stores Kerberos principals in LDAP, and for ...


0

You are meant to distribute the keytab for the service to everyone who needs it. If you regenerate the keytab, the KVNO (version number) will be incremented, invalidating any other keytabs for that service with a lower KVNO.


3

Two-parter: Yes. First step is identity of the receiving process, so you'll need to use a common identity for the service on both (which functionally means a domain user account, or better, a GMSA.) That'll let you interchangeably connect to either server by name (assuming an SPN is registered for each) but you did mention agnosticism towards which server ...


0

The encryption types supported by an Active Directory domain controller are listed in the msDS-SupportedEncryptionTypes attribute of the domain controller's computer object. In a default installation, they are typically something like: RC4_HMAC_MD5 AES128_CTS_HMAC_SHA1_96 AES256_CTS_HMAC_SHA1_96 This is a bitmask which works out to decimal 28, so it'd be ...


1

This was kind of confusing to figure out for me because there was no reference to the term login-formats anywhere in any documentation. In /etc/sssd/sssd.conf add a line in the domain section to include this: [domain/contoso.com] ... use_fully_qualified_names = False ... then restart sssd.


1

Check selinux. This looks like it might interfere. (This is in fact the problem, as discussed in the deleted comments).


1

In the windows environment , you have to run the command as the user specified in the ktpass command. runas /user:domain\username cmd.exe The user also has to have administrative privileges.


1

The short of it is that NFSv4 protocol relies a username being shared between the server and client, and not the UID/GID numbers (which were used in the earlier versions) and the UID <==> username mapping can actually be different on the client and the server. As part of the NFSv4 protocol both the server need to map the common security ...


0

This is not possible outside using auth_provider=krb5 or auth_provider=ad. The internal kinit process is wired into the sssd krb5 provider, which is also used by the ad provider.



Top 50 recent answers are included