Tag Info

New answers tagged

0

In my personal experience this is usually caused by problems with SPN (server principal name) registration on the SQL Server. Microsoft has a free tool called "Kerberos Configuration Manager" (available for download here) If the tool fails to fix an issue, you may need to register SPN manually. But in some AD configurations the problems could not be fixed ...


0

This seems to work: net ads join -k -U ${USER}%${PASS}


0

Glad you solved your own problem, but it doesn't sound like you understand why what you ran solved the problem. Bottom line, the SPN needs to be set on the appropriate object. It sounds like you had the SPN set on the computer's object in AD that was running the service. That's why things started working if you changed the service to run as SYSTEM. But if ...


0

I ran into the same issue. The realm needed to be appened to the SPN. Your example has the following: "nskrb kgetcred --delegation-credential-cache=/tmp/imper_cache --out-cache=/tmp/kcd_cache http/myserver.domain.com" So long as "DOMAIN.COM" is your realm, try the following: "nskrb kgetcred --delegation-credential-cache=/tmp/imper_cache ...


-4

You can stop this error by checking the box "Do not require Kerberos preauthentication" in the user account properties on the Account Tab for the service account in Active Directory Users & Computers.


1

I got this to work in my environment by querying LDAP for the userPrincipalName instead of sAMAccountName as my squid also returns user@domain.local from Kerberos/NTLM auth. Also be sure to use %20 instead of spaces and when I was specifying the bind DN in my conf file, I used quotes as it had an & in the DN and squidguard was not binding because of ...


0

From other thread: The environment variables are set within the context of your program. When your program exits, you're back in the context from where your program was started. see this thread ->. This thread covers other situations as well, e.g. different process in same program.


1

A user with an existing, valid Kerberos ticket must be asked only for the second factor. This can't be achieved through PAM. Successful key-based authentication performed against sshd bypasses the auth stack of PAM. This includes GSSAPI, which is a requirement for ticket based Kerberos authentication. It has no choice but to do this as PAM was ...


1

I don't know of any way to do what you want with PAM without writing a new pam module. PAM is relatively complex and the way that sshd interacts with PAM and kerberos has been in my experience such that there is always an edge case that just doesn't work. What you want may be possible, I just don't know how to do it. If you only need to secure ssh what I ...


0

check if you have duplicate SPN (setspn -X) check if you have wrong DNS entry (where one name can bring client to two different machines unintentionally - I mentioned "unintentionally" because there are circumstances such setup is legit, such as you want to leverage DNS round-robin for load balancing/fault tolerance etc.).



Top 50 recent answers are included