Questions tagged [kerberos]

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.

Filter by
Sorted by
Tagged with
0
votes
0answers
30 views

incorporating xfs_quota limits, expired passwords and having local Unix users with Kerberos/FreeIPA users with Dovecot in Fedora

As I continue to test freeipa-server-4.9.3-1, on Fedora 33 with dovecot-2.3.14-1 I've run into the following issues with web mail and Dovecot integration. First we'd like to make sure local Unix ...
-1
votes
0answers
16 views

-kvno 1 option being ignored when adding principal to kerberos from script

I have a docker container with an entrypoint script that generates some principals in an MIT kerberos 5 server, in addition to creating a kerberos database, and some configuration options. There are ...
-2
votes
0answers
17 views

binary data mangled during transfer even when MD5 sum match

I'm exporting a TGS from a Windows 10 requested for an IIS SPN. I want to transfer it to Kali Linux to perform Kerberoasting on it (as part of my cert prep). When I try to perform the attack it fails ...
-1
votes
0answers
8 views

SAP Netweaver Kerberos SSO not working when Users UPN changes

Having problems with SAP Netweaver SSO after changing Active Directory Users UPN for AzureAD Connect. What we did: ActiveDirectory Testusers UPN changed from 'test1234@de.xx.yy' to 'test.user@...
-1
votes
0answers
20 views

Create keytab without letting admin know password if user does not have access to AD?

We have an Active Directory configured with Kerberos. The admin gives each user a password which the user has to reset once they login. We have applications which use keytabs based on the user. Each ...
2
votes
0answers
36 views

sssd credential chaching does not work

I set up an Centos7 using sssd as authentication system. The user identies are provided by files (passwd/group, managed by ansible), auth is done via krb5 (provided by active directory). The sssd.conf ...
0
votes
0answers
19 views

Kerberos status says masked for the kdc server

Failed to restart krb5-admin-server.service: Unit krb5-admin-server.service is masked.``` ```sudo systemctl status krb5-kdc.service ● krb5-kdc.service Loaded: masked (Reason: Unit krb5-kdc....
0
votes
0answers
31 views

Why isn't Kerberos used for SSO to cloud apps?

When comparing Kerberos to SAML, a common argument on StackOverflow sites and the rest of Internet is that SAML is for Internet / cloud applications while Kerberos is for enterprise LAN. There are ...
1
vote
0answers
25 views

AIX Samba user access getpwuid failed

I have installed Samba 4.12.10 via yum in AIX 7.2. I have also installed kerberos package to authenticate samba with kerberos. My objective is to allow users access of folders/files in AIX from their ...
0
votes
1answer
16 views

Subversion repository throws HTTP 403 Bad Request when accessed via https & Kerberos (Windwos Integrated) authentication

We encountered this problem with different versions of OS & Subversion on the server side, the following details being the same: We used https protocol to access the SVN repositories. We used ...
1
vote
0answers
47 views

Python Flask App on IIS - Updating Active Directory Attributes on Behalf of User

I've posted this on stackoverflow, but posting it here as I want some help from folks that are familiar with kerberos delegation and IIS. I am currently trying to figure out how to get my flask app to ...
0
votes
0answers
24 views

IIS: Kerberos authentication only works from local machine

I'm setting up an IIS application on a server within my domain. I configured SPN's and settings to allow windows authentication to work with kerberos and Single Sign On, and everything works fine on ...
0
votes
1answer
428 views

What will happen if a kerberos timestamp will be futuristic?

In kerberos authentication, the encrypted messages are added a timestamp, in order to prevent replay attacks. Basically once someone decrypts a message that was sent for him, it compares the timestamp ...
1
vote
3answers
469 views

Server Not Found in Kerberos database - where is the database located?

Testing setup: Weblogic 12.2.1.4 running on a Windows 10 machine joined to an active directory JVM 1.8.0_281 The java web application is using Java GSSAPI to access the fileshare over Samba ...
0
votes
0answers
13 views

In Kerberos HTTP Auth Why Does the AD Service Account Need HTTP/Domain in the Logon?

In many tutorials that go through how to set up HTTP Kerberos Auth, there is a step where you must create a Service Account in Active Directory that has details such as: First name: s_myservice User ...
0
votes
0answers
35 views

How decode kerberos traffic in wireshark on AD 2019

I am trying to decode krb5 traffic (AS, TGS messages) in Wireshark on AD 2019 (KDC is running here). I have created a user Bender in AD. Then I asked for a TGT ticket with the help of kinit (kinit ...
3
votes
0answers
86 views

SSH login not working with Kerberos

I am trying to perform SSH login using Kerberos authentication. Instead of Kerberos, password is prompted for login. There are three computers : client, kdcserver and service (SSHD server). Client is ...
0
votes
1answer
33 views

Implementing LDAP with Public IP

I'd like to implement an LDAP using FreeIPA for centralized authentication and for security sake (Kerberos). The problem is my servers (Ubuntu) running as public cloud with no private interface ...
0
votes
1answer
124 views

Getting javax.naming.CommunicationException: Connection reset and AD “event ID 1216” while trying to perform LDAP search using JNDI and GSSAPI

I am trying to analyze the reason for exceptions/ failures during the Ldap search. I am performing operations using JNDI on Active directory domain controller. Here is the background for the things ...
0
votes
0answers
22 views

Authentication using two separate Kerberos realms

Scenario I run a FreeIPA server (v4.8.7) for identity and access management (IAM) to manage enrolled hosts on domain aaa.example.com (e.g. host1.aaa.example.com). IPA server is at ipa.aaa.example.com. ...
0
votes
0answers
51 views

Cygwin and Kerberos for GSSAPI

I'm trying to setup a Cygwin instance running in Windows Server 2019, joined to a domain. OpenSSH Server is successfully installed in Cygwin and working with password method for AD Users. The goal is ...
1
vote
0answers
25 views

winbind works but Squid acts wrong

I am trying to get a Squid Proxy running with Kerberos+Samba+Winbind, which is connected to my AD. Everything works great so far! krb auth working wbinfo -u, -a, -g working I made some new testing-...
1
vote
0answers
44 views

Kerberos issues with Samba4 AD DC when resolv.conf not set to use localhost

I recently did a "classis conversion" of our small NT4 Samba domain to an AD one on my Debian 10 "Buster" system. I got everything working as far as I can tell, but I don't ...
0
votes
0answers
17 views

Web page that is authenticated against multiple kerberos authentication servers

Basically I have configured kerberos authentication for a web page hosted on apache server. How can I get users from another kerberos authentication server on another machine to authenticate with the ...
0
votes
1answer
30 views

Kerberos using JAAS and SMB protocol

We are using JAAS for Kerberos authentication. As a requirement from the customer, we want to make sure that SMB V2 or higher must be used during communication with KDC/AD. I've few basic questions ...
0
votes
1answer
276 views

Kerberos rdns=false Breaking Connections From Linux Clients to Windows IIS Server

Recently I changed the krb5.conf file on Linux clients to use: [libdefaults] rdns = false These clients can still successfully use kerberos auth to connect to other Linux webservers. However, now ...
2
votes
0answers
1k views

id: user: no such user

I'm using Centos 7 to authenticate locally Active directory users using kerberos. I joined the realm with the Administrator and i can login/ssh through it/with it, nslookup working fine, and adcli ...
0
votes
0answers
30 views

Kerberos Authentication requested cipher removal

Kerberos Authentication help required. Please find below: I am doing domain join from my Client machine(Freebsd 10.1) to KDC(Win2012) Client machine: uname -a FreeBSD 10.1-RELEASE FreeBSD 10.1-...
0
votes
1answer
223 views

ubuntu ignores default_ccache_name

I'm having trouble with Kerberos and Ubuntu 20.04. Im running a FreeIPA Server, but since it works on my Centos machines, I guess it's a client issue. The big goal is to have a SSO System, for ...
0
votes
1answer
137 views

Windows gMSA How To Secure Use of CredentialSpec Used By Docker Container Engine

The gMSA strategy Microsoft recommends for Containers here and here works very well. The general idea is the Container host retrieves the gMSA password from an Active Directory domain controller and ...
0
votes
2answers
174 views

Errors with new version of Kerberos | CentOS 8

Yesterday all kerberos packages on in my container builds got updated to 1.18.2-5.el8 and 1.17-18.el8 is no longer available. This is causing some big problems on servers. Our connections all show Pre-...
0
votes
0answers
113 views

Extra SPN for Keytab breaks Kerberos authentication

I'm trying use Ansible against a set of Windows servers (through WinRM), and I've encountered some issues with some of them, namely the ones that have applications that support Kerberos authentication,...
1
vote
1answer
318 views

Kerberos pre-authentication failed for unused Administrator account on domain controllers

Our three Active Directory domain controllers are collectively reporting thousands of 'Kerberos pre-authentication failed' events a week, where the IpAddress field is of a domain controller (but ...
0
votes
1answer
158 views

Why am I getting the kerberos error “Failed to decrypt AP-REQ ticket”?

I'm trying to get SASL + OpenLDAP working over saslauthd to AD via kerberos. I've fired up saslauthd in debug mode and getting the error below in the trace log when I try to su to the LDAP account ...
0
votes
0answers
175 views

Join a Linux (ubuntu 18.04) Instance to AWS Directory Service (Directory type: Microsoft AD)

I followed the document https://docs.aws.amazon.com/directoryservice/latest/admin-guide/join_linux_instance.html Everything was working fine, but suddenly started to fails. I decided clean all and ...
1
vote
0answers
176 views

IIS SSO not working, asking for login via login-prompt every new session

We are facing an issue where we don't get SSO to work on an IIS web app. We have set Windows-Authentication as enabled and Negotiate and NTLM as providers (IIS Windows Authentication and Providers). ...
0
votes
0answers
3k views

Why do I get “Server not found in Kerberos database” using testsaslauthd?

I'm trying to setup Kerberos auth over SASL using OpenLDAP. As I understand it, I need a host keytab in /etc/krb5.keytab from the KDC I'm using and then {SASL}user@realm in the given user's LDAP ...
3
votes
1answer
315 views

NFS/krb5 authentication server lookup fails due to wrong principal name

When mounting an NFSv4 with Kerberos, authentication fails and krb5kdc.log shows the wrong principal name for the NFS server. LOOKING_UP_SERVER: ... host/nfsclient.internal.domain.tld@IPA.DOMAIN.TLD ...
0
votes
0answers
45 views

How To Kerberize Services on macOS 10.13 Server

I'm moving from an all-OD setup on macOS 10.13 (clients and Server.app) to using Active Directory for user accounts/authentication - but still serving files from my macOS 10.13 Server system. I've ...
0
votes
0answers
228 views

How to replace NIS authentication with Kerberos: Client not found in Kerberos database

I followed the Oracle tutorial for configuring NIS and using Kerberos as the authentication mechanism. I believe I got the Realm and KDC configured and running correctly on a server that is running ...
0
votes
1answer
94 views

How does IIS know which AD server/domain to use for kerberos?

I am currently setting up an IIS Web Application. For Authentication I use integrated Windows Authentication with Kerberos. But i am kinda new to all that AD, Windows Authentication and Kerberos stuff....
0
votes
0answers
14 views

Access Kerberized Hbase server from remote cluster

I'm trying to connect the Hbase server from the remote Kerberized cluster(A) to another unsecured cluster(B). Executed kinit command and successfully getting tickets. But when trying to execute the ...
1
vote
0answers
2k views

kinit to get TGT returns “KrbException: Identifier doesn't match expected value (906)” under Windows Server 2016 Active Directory + Kerberos + JDK8

Trying to make Windows Server 2016 Active Directory + Kerberos and Java OpenJDK 8 kinit to obtain a ticket-granting ticket returns KrbException: Identifier doesn't match expected value (906) I have ...
0
votes
0answers
67 views
+50

Configure CentOS 7 sftp and a separate samba server

I am a Windows admin and my boss requested that I build a sftp and samba server. The sftp and samba server both use Windows AD to authenticate. The external customers need to only sftp and must be ...
0
votes
0answers
38 views

Openldap with kerberos password over SASL

I have an OpenLDAP server doing (working) SASL passthrough auth to an AD server via LDAPS. I need to change the SASL method to use Kerberos (on a different server) but not intimately familiar with the ...
0
votes
0answers
215 views

Kerberos Errors in One-Way Trust

We are trying to get single sign-on working for our web application and not having much luck. The setup is two separate domain forests, clientdomain.com and serverdomain.com. The web application is ...
1
vote
2answers
475 views

OpenSSH + Active Directory: allow sftp for a group while disallowing everyone else

My objective is to allow a given Active Directory group members to use OpenSSH SFTP in chroot, and deny access to SSH for them and all others that aren't members of that group, while still allowing ...
0
votes
1answer
246 views

Centos joined to domain successfully, can't create keytab?

Hello I'm trying to create keytab. This client system is already joined to domain. Below I have a flurry of errors. Looks like 2 main errors though, most notably: ...
2
votes
1answer
959 views

How to use Windows Kerberos ticket in WSL and/or Docker

I don't know much about Kerberos authentication, I just have some basic experience with configuration and usage. Recently I noticed that Windows has a built-in Kerberos implementation that is ...
0
votes
0answers
52 views

Why Kerberos protocol defines two servers?

If someone can implement the all the functionalities that Authorization server and Ticket Granting Server in one server, why not do it?

1
2 3 4 5
22