Tag Info

New answers tagged

0

First off, a clarification. Kerberos and SSH Keys are two mutually exclusive authentication methods for SSH. You don't use Kerberos with SSH Keys. You use Kerberos instead of SSH Keys. Both allow for "passwordless" SSH logon. A bit of reading on the Kerberos protocol may be in order. With Kerberos, you need to obtain a TGT that proves you are who you say ...


0

I recently had the same issue. It turned out to be SPN related. The SPN had been mapped to the machine account of the SQL Server instead of mapped to the service account that was running SQL Server. We deleted and recreated the SPN - mapped to the service account running SQL Server 2012R2 on the host and everything was gravy. #ShoutOutToGabe


1

On linux you can use kvno command to retreive it from KDC [root@XXXX XXX]# kvno host/XXXX host/XXXX@TEST.COM: kvno = 13


0

I figured out why this was happening. In my environment, I have a secondary Linux DNS server that does not allow dynamic DNS updates except from the Windows master DNS server which is also the domain controller. When the net ads join command is used, it does a DNS lookup for the name server of the domain and sometimes it returns the Linux DNS server as the ...


0

Not exactly sure, but did you happen to set the DisableStrictNameChecking registry setting? http://www.md3v.com/enable-windows-server-smb-2-0-alias-cname The IP vs CName along with the SPN is obviously indicating that Kerberos is involved. Perhaps it's the SMB 3.0 encryption that's showing itself. This would only be on a Server2012 to Win8 connection, ...


0

auditd to the rescue: ausearch -m USER_AUTH yields (among others): type=USER_AUTH msg=audit(1435161396.088:342): pid=17550 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.0.0.x terminal=ssh res=success


0

You can use the command "last" which will show users who logged into the server, ip address, and date. http://linux.die.net/man/1/last


0

There's not nearly enough clear documentation on this stuff IMO. You are right - if a service is protected by kerberos then su/sudo is not sufficient to bypass the necessary authorisation (UNLESS the target user has a cached ticket because they are currently logged on, or a keytab). Most resources (eg local filesystem) rely on uidnumber and gidnumber to ...


-3

Try this below. edit /etc/ssh/sshd_config find PermitRootLogin no change PermitRootLogin => yes command> /etc/init.d/sshd restart


2

Active Directory increments KVNO pursuant to RFC 4120. Microsoft documented their implementation of it in the document MS-KILE section 3.1.5.8. Active Directory essentially ignores KVNO. (Except on Read-Only DCs - if an RODC is compromised, the keys it holds can not be reused against another DC.) So my point is AD generally doesn't care what your KVNO is - ...


2

This happens when there's a mismatch between the SPNs listed in the keytab and the Principal Name provided by the client (the browser). It could depend by the browser used (some browsers take the name from the URL, some other do a reverse lookup of the ip address they're connecting to). The common solution to this is setting KrbServiceName to Any: ...


0

You can try use sssd instead winbind: https://help.ubuntu.com/lts/serverguide/sssd-ad.html. Winbind as samba-technicall newsgroup suggests is now under heavy development so there will be radical changes in the future, main reason of that is to allow interdomain trusts. Please read this carefully: http://rhelblog.redhat.com/2015/04/02/sssd-vs-winbind/


0

yes, either remove the "allow to authenticate" (and add the specific group) permission or deny that permission as appropriate. By default all users in the same domain have allow to authenticate. Without “Allowed to Authenticate” permission to a target computer (or service account, depending on the service), the KDC will not issue a service ticket to that ...


0

Solved. Eset NOD32 Antivirus version 4 was modifying HTML authorization headers on some computers. After disabling Web access protection everything works like a charm.


0

In case you're using Debian, have you recently updated from wheezy to jessie?. I had a similar problem and was that some ldap directives (AuthzLDAPAuthoritative) for apache 2.2 (wheezy) module were removed in apache 2.4 (jessie) module (Upgrading to 2.4 from 2.2). Maybe the same is happening for kerberos.


0

Regarding Kerberos configuration Samba as an AD/DC ships and runs its own Kerberos server (KDC). So there should not be a need to separately install and configure the kerberos server. Also, Samba's provisioning tool (samba-tool domain provision) produces an example krb5.conf file at the end. You should be able to simply copy that to /etc/krb5.conf. ...


0

sec=sys authorisation relies entirely on the uidnumber of a user on the client matching that of the file on the server. It is trivial for someone with root access to masquerade as another user. sec=krb5 requires the user to authenticate to the kdc (not just to the client), making it harder for a local admin to impersonate a user. HOWEVER, it is not ...


0

Recompiling samba4 from ports is possible to use the winbind autentication like linux even without sssd. Simply recompile samba4 from ports after enable sasl ldap pkg remove samba41 pkg install cyrus-sasl-gssapi samba36-libsmbclient pam_mkhomedir ldb pkg remove -f openldap-client pkg install openldap-sasl-client cd ...


2

I'm not I can give a more qualified answer without seeing the sssd debug logs, but the bug report you're referring to only had performance implications, not functional. The reason you're able to su to the account from root is that the PAM stack normally includes pam_rootok.so module that bypasses authentication with pam_sss. Given the auth from root works, ...



Top 50 recent answers are included