Tag Info

Hot answers tagged

32

From a Windows perspective only: NTLM works with external (non-domain) clients or internal clients works with both domain accounts and local user accounts on the IIS box using domain accounts, only the server requires direct connectivity to a domain controller (DC) Aside: it's not that uncommon for a DC to be overwhelmed by a busy NTLM server (IIS, ...


8

Kerberos has the reputation of being a faster and more secure authentication mechanism than NTLM. It also has historically been easier to connect to through proxy servers than NTLM, due to the connection-based nature of NTLM. That said, as you note, Kerberos is more difficult to get up and running, and requires a connection to the AD that isn't always ...


7

I assume you are using an Active Directory server. We have done something similar and the easiest way was to use the ntlm_auth helper like this (part of my squid.conf): auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp auth_param ntlm children 10 auth_param ntlm keep_alive on You will have to install Samba and join your ...


6

A better alternative is to install CNTLM, which is an NTLM proxy that presents itself as an ordinary web proxy. It's quite easy to install from .deb (trivial dependencies adduser and libc6 which should be on every system ever) and configure. Once you have it installed, you just tell apt-get to use proxy localhost:3128. This solution has two advantages: ...


5

NTLM was replaced by NTLMv2 in NT4.0 SP4. That's over a decade ago. NTLM is harder than LM to crack for passwords, and NTLMv2 is much harder. There is a reason Vista defaults to NTLMv2 only. Rainbow tables have been compiled for the complete LM password space, and last I heard work was well in progress to do the same for the NTLM space. NTLMv2 hasn't been ...


5

I think question should be twisted on its head. Active Directory supports both Kerberos and NTLM. Windows will first try Kerberos and if all requirements are not met it will fallback to NTLM. I will give you example, accessing file share by name like \server1\share would invoke Kerberos and should succeed given proper permision. But accessing same file ...


5

From the client side you need the following option to prompt the user for username/password auth-user-pass On the server side you need the following option to verify the username/password auth-user-pass-verify scriptname method scriptname is a script or program that openvpn will execute in order to verify the user/pass. If the script's return code is ...


5

From the Microsoft Application Verifier, which detects common developer mistakes. One of those mistakes is the use of NTLM: NTLM is an outdated authentication protocol with flaws that potentially compromise the security of applications and the operating system. The most important shortcoming is the lack of server authentication, which could allow ...


4

It's a really bad practice, kinda like enabling WEP to protect your WiFi because you have a Windows 98 computer that won't work with WPA2. It's 2009, Kerberos works if you really, really need SSO. I also consider integrated authentication for websites to be a bad practice in general as it often leads to oddball issues when users have multiple accounts (we ...


4

We had issues with account lockouts in a large org I worked for in the past. What I did (as a member of the IT org) was to build a script which sat on the PDC (now PDC emulator). Whenever an account is locked out, this domain controller registers an Event ID # 644 (4740 on Windows Server 2008) in the Security log. The event also includes the name of the ...


4

This is indeed a case of constrained delegation (ie .'double hop'). There is no setting you can change which would make this work. If one would exist, it would be by definition a bug, as it would break the domain policy on constraining delegation only to trusted accounts. So unless you make the AD change to mark the SQL Server 'in the middle' as trusted for ...


4

in /etc/apt/apt.conf, add the line: Acquire::http::Proxy "http://MYDOMAIN\MYNAME:MYPASS@MY.PROXY.COM:MYPORT"; the semicolon is required at the end of the line to add


4

You do not say which sort of client you use, but once I experienced the same behavior, and it turned out to be related to the new default NTLM client settings in Windows 7. Older versions of Windows use NTLMv1. Since NTLMv1 can be cracked in minutes, Microsoft has switched to NTLMv2 in Vista. Unfortunately, AuthenNTLM is quite old and unmaintained and it ...


4

Windows will log you on with cached credentials as long as you have successfully logged on to the domain once. The user name and password are not cached on the local machine, a password verifier is cached on the local machine in the registry. As far as I know it's not possible to directly access or edit the registry hive where the password verifier is ...


4

Sounds like you are running into an "feature" introduced in Server 2003 SP1 and still present in at least Server 2008 R2. By default, Domain Controllers now allow the most recent previous password to be used for NTLM authentication for one hour. This behavior can be modified by creating a DWORD value of OldPasswordAllowedPeriod at ...


4

NTLM is connection orientated and since there's no direct connection between you and the webserver when you use the proxy, so NTLM fails. (There's a connection between you and the proxy and a second connection between the proxy and the website.) If you can't upgrade to for example Kerberos auth your best bet is to add the webserver to the proxy exclude ...


4

The question you posed, "Is it better to disable "anonymous logon" (via GPO security settings) or to block "NTLM V1", is not a very good question, because those two things are not mutually exclusive. You can do both, neither, or just one, and to various degrees. There are lots of shades of grey here and you can't condense it to black & white. Disabling ...


4

I would modify your antivirus policies to not scan files shared over the network. You could potentially have a dozen clients trying to AV scan the same file across the network simultaneously. So in Windows 2000, 2003, Windows XP, Vista, and 2008, the default behavior is this: Network security: Allow Local System to use computer identity for NTLM ...


4

Find the required registry setting, and push it out with Group Policy Preferences. Or search for a Firefox GPO administrative template that has the setting defined.


3

You can view the list of active Kerberos tickets to see if there is one for the service of interest, e.g. by running klist.exe. There's also a way to log Kerberos events if you hack the registry.


3

The only port you need is 1433 as TCP. This is the port used by defaul, nonnamed SQL Server instances for TCP connections. FreeTDS will initiate a connection on this port and will then negotiate a NTLMv2 authentication on this connection, as a series of challenge/response packet exchanges. Afaik there is no need for any other port. See Domain Logins. All ...


3

NTLM was not designed to work through Proxies (or in your case: reverse-proxies). As with a single proxy, inserting a reverse proxy will cause NTLM authentication between the client browser and the Web server to cease functioning (see http://support.microsoft.com/kb/198116/en-us) However, there are workarounds: In your case (where SSL is ...


3

If you modify the log level line in /etc/samba/smb.conf to read: log level: log level = 1 winbind:5 You do get the information I'm after (by default logged to /var/log/samba/log.DOMAIN), but it's very noisy and the log messages are split over two lines. Not exactly what I'm looking for but it might have to do.


3

Try adding the new site URL to the trusted sites list in IE and give it another shot.


3

This is probably more a support question for the Jespa folks. The output is reliant on the behavior of their API. In general, though, best practice for Windows is to always use DOMAIN\username format or username@domain format. If you're worried about the format changing then I would suggest you write a class / method / utility that knows how to parse the ...


3

From: Determine if HTTP authentication is NTLM or Kerberos http://support.microsoft.com/kb/891032 [...] "Since we are looking over this trace to see if the client is sending authentication information, we can use the TCP segments to track the HTTP GET requests and the response from the server. Here is a snippet from the frame that sends authentication ...


3

This appears to be a duplicate of http://stackoverflow.com/questions/434272/iis7-overrides-customerrors-when-setting-response-statuscode , but I'm too new on Server Fault to flag this. My take: I had a similar problem when using Mediawiki on an IIS server box. When you browse to a non-existing page in Mediawiki. It sends back a special wiki page that says ...


3

Why are you specifying the --username and --password arguments to ntlm_auth? Those arguments aren't necessary and are likely causing thentlm_auth processes to terminate (which is, likely, the root cause of your failure).


2

We typically do retroactive SharePoint NTLM to Kerberos authentication changes as you're proposing. When we establish our SharePoint sites, it takes a couple of days for DNS changes to propagate, and getting our SPNs set on service accounts typically takes some time also. So after our SPN's are set, we first create a small test site on the server running ...


2

You should really be auditing logon events, whether the computer is a server or workstation. It's helpful to figure out which users are accessing your system, and to troubleshoot security related issues. You can modify your Audit Policy with Group Policy: Start...Run...gpedit.msc...Computer Configuration, Windows Settings, Security Settings, Local Policies, ...



Only top voted, non community-wiki answers of a minimum length are eligible