Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [kerberos]

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.

1
vote
0answers
13 views

Kerberos shared secret key creation

There are 3 things that I don't fully understand about kerberos. Let's say that we are adding new server to an AD Domain. KDC creates a shared secret for this server and how is this key send securly ...
0
votes
1answer
19 views

Kerberos KDC server in a docker container

I'm running a MIT Kerberos KDC and Kadmin server instances on a docker container for convenience. Am able to build it and run it without a problem, with only extracting important configs do a docker ...
0
votes
2answers
52 views

Machine Account Password Resets on server and invalid Kerberos tickets on client

According to this TechNet article https://blogs.technet.microsoft.com/askds/2009/02/15/machine-account-password-process-2/ Machine Accounts (Computer Objects) reset internal passwords every 30 days. ...
1
vote
0answers
21 views
+50

Kerberos authentication to root domain in Active Directory

I have an environment in Active Directory that is composed of a root and a child domain, let's call them my.root.domain.com and root.domain.com I have a RHEL7 server I've spun up which has no problem ...
0
votes
0answers
24 views

Prevent LDAP requests

I have a work laptop that I connect to my local lan as well. On it I have a pi-hole. On it I can see that the laptop makes an awful lot of requests to the office domain which of course is not ...
2
votes
1answer
39 views

PAM with pam_krb5 to authenticate nginx requests

I am aware of the gazzilion pam / nginx questions here and on "Unix/Linux" but they are either unanswered or not related to my setup - so i try again :) TL;dr While the setup works perfectly with an ...
1
vote
0answers
41 views

Authenticate AD user after joining CentOS 7 to Active Directory Domain

I am trying to join a CentOS 7.5 to a Windows Active Directory Domain for authenticating AD users. Although, the joining process has been successful, I'm unable to authenticate any users though. ...
3
votes
2answers
90 views

Exchange 2016 and Sever 2016 DCs: Unknown KDC Encryption type

Team, Exchange environment is all 2016, no mix. Parent and child domains exist, but the functional level of each domain and forest is 2012R2. All domain controllers have been 2012R2 until recently. ...
0
votes
1answer
22 views

How does NFS figure out which Kerberos creds / principals to give access to?

I'm setting up NFS with Kerberos and following various guides, like NFSv4 with Kerberos on Ubuntu Wiki and How To Use Kerberos to Control Access to NFS Network Shares, amongst others. All guides ...
0
votes
0answers
25 views

Diagnosing NFSv4 Authentication Issues

I've got a couple of NFSv4 shares (with Kerberos authentication). Most of the time they work quite well, but when there's an issue they can be a pain to fix. I put this down to them being quite ...
0
votes
0answers
10 views

How to configure Kerberos authentication on the browsers which are on CITRIX page?

We are connecting to our secure client network via CITRIX. We are using chrome to open all quick links. like ambari etc. They open and we are good there, but other useful links like RM and HISTORY ...
0
votes
0answers
15 views

How does ssh logins with Kerberos authentication exactly work from every client while Kerberos uses mutual authentication model?

I have my system authentication managed with SSSD which uses Kerberos. As kerberos support mutual authentication model i.e., both client and server should support Kerberos, how exactly does SSH to ...
1
vote
0answers
40 views

How do you setup an NFS4 server that utilises Kerberos authentication from an Active Directory KDC using CentOS Linux release 7.6.1810 (Core)

How do you setup an NFS4 server with Kerberos from Active Directory? I can install and configure an NFS4 server and connect to it, but I can not get Kerberos to work under any circumstances where the ...
0
votes
0answers
17 views

Configuration NFS v3 Kerberos on Centos 5.x

Platform: CentOS release 5.5 Installed the kb5-libs , krb5-server krb5-workstation in the NFS Server. The NFS Server IP and Machine IP are different. Machine IP : 172.xx.xx.xx NFS Server IP: 169....
2
votes
1answer
33 views

Joining workstations to the domain as a member of Protected Users group (Delegation vs User Rights)

Implementing "Protected Users" and coming across this problem that I couldn't find a solution to anywhere. Cannot join computers to the domain with delegation permissions. Instead "Add workstation to ...
1
vote
1answer
24 views

How mimikatz kerberous returns plain text credentials?

I have the following environment:- DC:- Windows server 2008 Victim: Windows 7 Attacker: windows 10 Now I compromised the windows 7 some way, then I load mimikatz in meterpreter. Then, when I type ...
0
votes
0answers
23 views

BDR in secured cluster - Cant get kerberos realm

I've Enterprise Cloudera Manager 5.13 managed 2 clusters (Prod and DR). I had tested the Backup and Disaster Recovery (BDR) and it was working fine. Now I've kerberized both servers and installed the ...
-2
votes
2answers
23 views

How to identify that the protocol is using by AD DC is Kerberous?

I have created a local environment as follows:- DC:- Windows server 2008<br> Client:- Windows 7<br> Domain:- januapp.local Now I read on somewhere that, the DC uses two types of Protocol ...
0
votes
0answers
40 views

Pass through authentication with LDAP and Kerberos

I have a SLES 12 server and installed and configured MIT KDC and openLDAP. I want to use pass through authentication in openLDAP so that the password is only stored in the KDC and I don't have to ...
0
votes
2answers
89 views

FreeRADIUS with LDAP vs Kerberos

The following site discusses how to setup FreeRADIUS to authenticate against an LDAP backend (it goes through a tutorial showing how to expose NT hashed passwords in FreeIPA so that FreeRADIUS can ...
0
votes
0answers
18 views

How Kerberous works when using an AD with three domains, one is root and others are Child?

Assuming an AD has one root domain 'ROOT' and two Child domains 'CHILD1, CHILD2' then How a user in the CHILD1 domain can access the resource in the CHILD2 domain? ROOT is the root domain with the ...
-1
votes
0answers
101 views

Curl --negotiate: Force Kerberos?

We're in the process of testing out SPNEGO support for an Apigee API proxy. I'm using the API sample found here as the basis for my proxy. Everything is configured, and now it's time to test. I'm ...
3
votes
0answers
143 views

How does the Linux NFS server implementation of setclientid work?

Does anyone understand the NFS protocol (Version 4) or the Linux NFS server implementation of it well enough to explain how setclientid negotiates authentication? Background: I have a CentOS 7 ...
0
votes
0answers
75 views

kerberos preauth (encrypted_timestamp) verify failure: Decrypt integrity check failed

I am trying to add pam_krb5 + kerberos setting on Ubuntu 12.04. and as a practice trying to run KDC and SSH in 1 server host-a. After install krb5-{kdc,admin-server} libpam-krb5 on host-a sudo apt-...
1
vote
0answers
17 views

Is there a way to have password-less SQL server login for another user without kerberos enabled?

I am connecting to SQL server with JDBC. I am able to use Integrated authentication with JDBC to connect to a SQL Server 2016 instance as the current logged in user, and I did not have to supply a ...
0
votes
0answers
79 views

How to grant/renew kerberos ticket automatically

This might be discussed before but I am not getting the right anwser. What I am looking for is to fix a script below that grants/renews kerberos ticket. The design purpose is whenever a user logs in ...
0
votes
0answers
53 views

Gnome Kerberos Settings

For my Kerberos Authentication on a server, I setup the settings in /etc/krb5.conf. With kinit user everything works fine. But I want to use the Gnome Account Manager with Kerberos (Settings -> ...
3
votes
0answers
66 views

Is there any way to get an AD bound linux system to mount home directories from a Windows server?

We've been experimenting with integrating linux systems into what is largely a Windows domain, with a Windows-based Active Directory server. After considerable trial and error, we have successfully ...
0
votes
1answer
64 views

AD/Kerberos authentication

Need some help on authentication. Noticed in the our logs that user1 has a ton of Kerberos pre-auth failures. User1 has a bad password. However when I look at the logs more closely, I'm a little ...
0
votes
0answers
38 views

Restricting access to users/groups of NFS mount through FreeIPA

I setup a NFS mount through the following guide with FreeIPA. Short instructions on first post: Unable to mount kerberized nfs? Long instructions: https://access.redhat.com/documentation/en-us/...
0
votes
0answers
51 views

(permission denied) how to get regular user + system to access Kerberos NFS MOUNT

I have an shared storage which I want to integrate into my Debian 9 (Stretch) maschine. My setup is: apt-get install -y nfs-common krb5-user nano /etc/default/nfs-common --> to set NEED_GSSD=...
-4
votes
1answer
168 views

Implementing Kerberos Authentication on Linux servers using script [closed]

My client wants to implement Kerberos Authentication on multiple Oracle Linux Boxes. Do they need to be done manually or can I implement on all of them using any script? Is there any way to script ...
0
votes
1answer
30 views

Linux daemon accounts and kerberos

there is something I can't grasp about security in Linux. I have a piece of software, it's running as a service on user X, it needs RW for directory Y owned by user Z and group C (both which is in ...
1
vote
0answers
18 views

FSP influence over kerberos token size

We have a 2 way trust between our 2 forest. There are some users from forest A that are in group in forest B - they are listed by sid in foreign security principals OU. I checked membership of one of ...
0
votes
1answer
26 views

gssd: What is <anyname>?

rpc.gssd's man says: rpc.gssd searches in the following order for a principal to use. The first matching credential is used. For the search, <hostname> and <REALM> are replaced with the ...
1
vote
1answer
165 views

Cross-Realm-Trust between Active Directory and MIT Kerberos

I am currently in the process of extending my development environment, which used to only run Linux servers so far, by adding machines running Windows Server 2016. The authentication process is ...
0
votes
0answers
30 views

Mount CIFS/SMB file share with S4U2Proxy?

Is there any way to mount a CIFS/SMB file share by authenticating with S4U2Proxy? I need a middleware service to mount a file share and it has a Kerberos ticket from the user who logged into it. I've ...
0
votes
1answer
192 views

SSSD AD Integration - Clarification on Computer to join AD

Objective Clarify Computer, Not User, when integrating a Linux box with a Windows Domain. Background Having confusion because most SSSD AD information focuses on User Authentication, however ...
3
votes
3answers
491 views

What is the minimum action required in order to have access to a newly authorized server folder

I hope I'm at the right place (right stack exchange website). If not please tell me the right one. I got new rights on a folder on a Windows server by being added to Active Directory Group for which ...
0
votes
0answers
51 views

Enroll OS X 10.13 in FreeIPA

I'm trying to enroll a Macbook in FreeIPA on my home network. I went to System Preferences > Users & Groups > Join Network Account Server and entered freeipa.example.com. It succeeded in ...
0
votes
0answers
115 views

Kerberos keytab for NFS doesn't work if not created in server

I'm trying to mount a directory into a client server using kerberos authentication. If I create a keytab file using using kadmin in the server, I cannot get authenticated when I mount the directory. ...
0
votes
2answers
54 views

What does it mean to “add” a principal to a keytab file in Kerberos?

In this documentatation they mention that you can use the ktadd command that "add a principal to an existing keytab". Does adding a principal mean that the principal now has access to that host (in ...
0
votes
1answer
50 views

NFS w/Kerberos - Network change broke auth?

So, I've recently changed my network setup a bit, and for reasons I'm still trying to suss out replacing the old router with a new PFSense box appears to have broken the authentication within the ...
0
votes
0answers
85 views

Apache Single Sign On Working on 1 of 2 Portals

I use a helpdesk system in our intranet that I've configured for Single-Sign-On via LDAP/Active Directory. The helpdesk server itself lives on an Ubuntu 16.04 Server box running on Apache, Server ...
0
votes
0answers
23 views

Kerberos between non trusted AD domains

I am a bit confused here. I have two different domains (domain1.local and domain2.local) in different forests. There's no AD trust in place between them. I use a machine in domain1 to logon to the ...
0
votes
0answers
38 views

Foreman proxy realm_ad failing to set computer password

Realm_ad is intermittently failing to set the computer password when creating a host account in active directory. If the kerberos requests that are made during the process are handled by our first ...
0
votes
1answer
216 views

Oracle Linux won't mount CentOS NFS share, but Arch will

I'm trying to get kerberized NFSv4 running on our network. Server is CentOS 7. I'm able to mount the share on my Arch Linux workstation, but not our Oracle Linux 7 database servers. I'm trying to ...
0
votes
0answers
207 views

Kerberos Double Hop Delegation from IIS to SQL server (using django)

I need to pass the credentials (Integrated Windows Authentication) from a django website on IIS onto a backend SQL server so that it runs under the proper user context. This is how my setup looks so ...
0
votes
0answers
125 views

NFSv4 with Kerberos on Debian Stretch: only works if I run rpc.gssd -fvvv

After many (!!) evenings of trial and error, I've finally succeeded in getting NFSv4 to work with my existing krb5 setup. It however only works if I run rpc.gssd on the client manually (a few howto's ...
0
votes
1answer
18 views

Is “/var/kerberos/krb5kdc/kadm5.acl” the only way to specify administrators in kerberos?

The documentation for RHEL explains how to make users administrators through the /var/kerberos/krb5kdc/kadm5.acl file, but does not specify if this is the only way to do this. Are there any other ways ...