2022 Developer Survey is open! Take survey.

Questions tagged [kerberos]

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.

Filter by
Sorted by
Tagged with
0 votes
0 answers
40 views

Validating credentials in PowerShell wont use Kerberos

In reality I'm debugging a C# app but since the same command is possible in PowerShell I'm trying there. I am trying to validate user accounts using the following in PowerShell: > Add-Type -...
user avatar
0 votes
1 answer
48 views

ksetup - Failed /GetEncTypeAttr : 0xc0000034

On the DC of a single-AD forest, I am logged in as the default domain administrator Administrator (in this case also the enterprise administrator). In an elevated PowerShell, I try to get the Kerberos ...
user avatar
0 votes
1 answer
89 views

How can I set the 'The other domain supports Kerberos AES Encryption' setting programmatically?

In the GUI (Active Directory Domains and Trusts MMC Snap-in (domain.msc)), you can set the "The other domain supports Kerberos AES Encryption" setting for a trust relationship: I am looking ...
user avatar
0 votes
0 answers
25 views

When is mapUser required -

I'm not sure I understand when & why mapUser is needed. When you generate a keytab with ktpass you can map the Service Principal to a user wit mapUser. You can then kinit to the Service from an ...
user avatar
1 vote
0 answers
34 views

Kerberized NFS4 takes 5 seconds to open a file

I set up a NFSv4 server and a client both running Debian 11.3 on Linux 5.10.0-13. It basically works i.e., I see all files with correct permissions and can open, modify, etc. However, opening a file ...
user avatar
0 votes
1 answer
61 views

GSSAPI Error: KDC has no support for encryption type on RHEL 8 joined to multi-domain AD forest

I have a simple MS ADDS multi-domain forest setup with a parent domain and one sub-domain. I joined a RHEL 8 server successfully to the sub-domain by using this official documentation. All OSs have ...
user avatar
0 votes
0 answers
29 views

Which Cipher Is Being Used To Encrypt NFSv4 With "sec=krb5p"?

I am using NFSv4 with sec=krb5p encryption enabled on a CentOS 7 client & server. My NFS shares mount flawlessly at boot-time, and when I query my keytab file I am able to view the list of ...
user avatar
  • 11
0 votes
0 answers
17 views

Difference between krb5-user and Pam method for LInux to authentificate on Active Directories

I'm trying to understand what the difference between both this guides is: http://ricktbaker.com/2017/11/08/ubuntu-16-with-active-directory-connectivity/ https://computingforgeeks.com/join-ubuntu-...
user avatar
0 votes
1 answer
40 views

NFSv4 and kerberos: access denied 50% of the time

We are trying to mount NFSv4 shares on RHEL 8 clients, with kerberos. We have a very similar setup on another environment, and it worked fine. But on this setup, it happens that we get access denied ...
user avatar
0 votes
0 answers
25 views

Error code 0x90090331 - Explicit EAP Failure

Can anyone direct me to a reason for an Explicit EAP Failure with Error Code 0x90090331? Evidently, the error code is not on the internet. I have been troubleshooting some enterprise wireless issues ...
user avatar
0 votes
0 answers
11 views

Squid doesn't cache with Kerberos auth

I am using a squid proxy with kerberos auth. Everything works great for months now, but my only problem is, that squid isn't caching anything! As soon as I switch to NTLM auth, squid is caching, so I ...
user avatar
  • 11
1 vote
1 answer
41 views

When trying to nfs4 mount a share with sec=krb5 I get "not exported" error message on nfs server

I run two nfs servers with user home directories and other shares on them. The servers offer kerberized nfsv4 mounts as well as old v3 ones. Until recently I was able to nfs4-mount a krb5-exported ...
user avatar
0 votes
0 answers
48 views

asp classic application inside an ASP.NET application - Windows Auth not working Kerberos and Edge browser

I have an asp classic application inside an ASP.NET application. The default.aspx page reads the Windows login of the user and looks them up in a database table. Then it puts the credentials in a ...
user avatar
  • 1
0 votes
0 answers
23 views

Proxy authentication in cyrus with SASL and kerberos

I am trying to enable proxy authentication in cyrus + SASL, i.e authenticating as the admin user cyrus but with the access rights of any other user, e.g. peter (as described here). I am trying with ...
user avatar
  • 101
1 vote
1 answer
55 views

How to export shares so that users don't create file as root

I am trying to export home directories from my NAS to ubuntu clients - the server is a TrueNAS Scale, which is Debian based. Kerberos works, so users get the proper tickets to authenticate to the ...
user avatar
0 votes
1 answer
108 views

Cannot obtain credentials for computer account - client not found in kerberos database

I have successfully joined an ubuntu machine (Ubuntu 20.04 LTS) to an Active Directory. Therefore, I can log in with AD-Accounts, obtain and renew the ticket grantin ticket for the user, and access ...
user avatar
  • 3
0 votes
1 answer
46 views

How to have Kerberos tickets for services to access NFS share?

I want to externalize my servers storage and to import it via NFS from the storage server. I want to use NFSv4 with Kerberos for security and for not having to match UID/GID between servers. So I ...
user avatar
  • 1
0 votes
1 answer
80 views

Kerberos credentials not renewed on ipa ubuntu client

When I use ssh to login to my freeipa client, I get Kerberos credentials (klist). However, after they expire, I no longer get the credentials (klist empty). This results with no home directory as the ...
user avatar
  • 153
3 votes
0 answers
86 views

Extremely slow NFS openat performance

I've installed an NFS server on Ubuntu 20.04 and a FreeIPA Ubuntu 20.04 client with the users home directories served by the NFS server. Performance is extremely slow when accessing files. When I ...
user avatar
  • 153
0 votes
1 answer
84 views

KDC has no support for encryption type while authentication to OpenLDAP

I'm running a Kerberos / LDAP authentication server for many years. Kerberos data is stored inside LDAP. Now, I have a second site and want to mirror the server to the new site. This basically works, ...
user avatar
0 votes
0 answers
27 views

Kerberos is broken domain wide when an SPN is set on the server

I'm trying to investigate a problem we've had for the last 2 years. I am a developer and have familiarity with Windows Server /Active Directory /GPO... but I am not in charge of the network setup of ...
user avatar
  • 101
0 votes
1 answer
40 views

basic understandig about kerberos sso in apache

I'm trying to configure kerberos sso in apache at the moment. On the test server the website sub.internal.local workes quite well in reference to the kerb sso. When I try to adopt the config to ...
user avatar
  • 1
0 votes
1 answer
200 views

Kerberos with Apache not working

I'm currently trying to configure Kerberos on our Apache and unfortunately I can't get any further. The website (Typo3) on the apache is accessed internally and externally with sub.domain.com The ...
user avatar
  • 1
0 votes
1 answer
67 views

Can kerberos admin-server be on different machine than KDC?

I'm currently learning about Kerberos, and there's something I don't quite understand: Seemingly, the admin-server: kadmind - doesn't HAVE to run on the same machine as of the KDC. But that sounds ...
user avatar
  • 111
0 votes
1 answer
38 views

OpenCms: Kerberos SSO authentication with httpd+Tomcat

I have a standalone httpd+Tomcat 8.5.65 installation on OpenJDK 11 with OpenCms 11.0.2 for my client's internal website. They have a LDAP network and they're requesting the automated logon using ...
user avatar
1 vote
0 answers
256 views

Apache reverse proxy with Kerberos authenticate and LDAP authorization

Server version: Apache/2.4.37 (Red Hat Enterprise Linux) Apache is launched as a container in the Openshift cluster. I am using Apache as a forward and reverse proxy for Kibana. Mandatory requirement ...
user avatar
  • 11
0 votes
2 answers
26 views

Putting .k5login credentials in ldap with freeipa

On the systems I administer, in addition to human user accounts, we have a number of accounts associated with roles, software and specific data. By using a .k5login file in home directories, it is ...
user avatar
  • 140
0 votes
0 answers
94 views

Kerberos Works If Previously Not Pre-Authorized

I'm moving an application from WebLogic to JBoss EAP 6.4 and I almost have it working. The issue is that I can only get Kerberos authentication to work if I play with the isInitiator property in my ...
user avatar
0 votes
0 answers
8 views

Rekerberize fails with: Could not retrieve auth record

We use Apple Open Directory (which is openLDAP actually), and we are experiencing a problem that for some users, user authentication fails with ldap_bind: Insufficient access (50). Attempting to ...
user avatar
  • 163
1 vote
0 answers
118 views

NFS stale file handle for regular user but not root

I've installed freeipa container on a Ubuntu server and an NFS server on the server itself. When I mount the NFS directory on a client machine or even the server itself, I can view the mounted ...
user avatar
  • 153
0 votes
1 answer
153 views

Access Denied when mounting Kerberised NFS v4 Share

I want to mount an NFS4 share, but with Kerberos security enabled. This is my setup: Debian Server (dns fqdn: nfsv4test.subnet.example.org) Debian Client (dns fqdn: nfsv4client.subnet.example.org) ...
user avatar
0 votes
0 answers
54 views

NFS4 + Kerberos and ownership of mounted share

I have the following setup: NFS4 server on Debian Buster, Kerberos server on the same machine, no LDAP or AD. The hostname is bohr.digital. List of principals: kadmin/admin@DIGITAL kadmin/bohr.digital@...
user avatar
  • 456
0 votes
0 answers
22 views

Squid does not write into access.log with kerberos authentication

I finally managed to get squid with kerberos authentication and LDAP group checking to work. I am using squid 4.1, kerberos v5 and Linux Mint Cinnamon 20.1. Everything works fine, but I got a little ...
user avatar
  • 11
0 votes
1 answer
51 views

Does Windows SSO work with ADFS 2016 for OIDC Web Application?

Our web application uses OpenID-Connect (OIDC) Implicit Flow for user login with ADFS 2016. Login generally works, however users get login screen for user name and password. Does Windows-Login / SSO (...
user avatar
1 vote
1 answer
388 views

Windows Admin Center Resource Based delegation stopped working with KRB_AP_ERR_MODIFIED error

Our WAC installation SSO (via resource based delegation) stopped working last week for unknown reasons and it's driving me mad. The following event is logged on the WAC server when attempting to ...
user avatar
  • 62
1 vote
0 answers
76 views

Does NT SERVICE\MSSQLSERVER require Kerberos authentication if the sql instance is on the local machine?

I had a bizarre issue today where NT SERVICE\MSSQLSERVER was being denied login as a service on a domain joined computer. I also noticed group policy was not being applied via gpupdate /force. I ...
user avatar
0 votes
0 answers
46 views

Microsoft AD/Kerberos and non-Windows clients (RHEL and Cisco)

I currently manage a small network with mostly Win Server 2016 hosts in a standard Active Directory domain, plus a couple RHEL 7 boxes. We will be going to Win Server 2019 and RHEL 8 in the medium ...
user avatar
  • 1
1 vote
0 answers
229 views

Can't mount NFSv4 with Kerberos from a Linux client to a FreeBSD server

I'm trying to set up NFSv4 with Kerberos. The server is FreeBSD 13.0-RELEASE and the client is Ubuntu 20. I have the Kerberos part running and I can automaatically get a ticket on login for my user, ...
user avatar
  • 181
0 votes
0 answers
70 views

Ubuntu Kerberos Parent Domain Auth Fails

We have an Ubuntu 18.4 server joined to the child domain. I'm able to ssh to the server with child domain account but not with parent domain account. Here is my krb5.conf [libdefaults] ...
user avatar
  • 3
2 votes
1 answer
294 views

Linux workstations only authenticate on one domain controller

I have 3 domain controllers 192.168.1.6 Server 2016 [PDC equivalent] Site 1 192.168.1.7 Server 2016 Site 1 192.168.31.10 Server 2016 Site 2 and a mix ...
user avatar
  • 151
1 vote
0 answers
26 views

Tell saslauthd to reject authentication attempts for all domains other than ours

We are running Postfix and require authentication for the sending of mail through SMTP. The authentication uses Cyrus' saslauthd which does a Kerberos authentication against our Kerberos domain. Is ...
user avatar
  • 2,571
0 votes
1 answer
403 views

Ubuntu SSSD Auth Error with child/sub AD Domain

Need help authenticating linux (Ubuntu) server that is joined to child domain. I can see the server name on the Domain Controller and able to run authentication test successfully however I am not ...
user avatar
  • 3
0 votes
0 answers
17 views

how to get the auth statistics of kerberos server (MIT kerberos krb5kdc)

I am looking for a way to show Kerberos authentication statistics like how many auth success/failed/duration on krb5kdc. for success/failure I can get it from the syslog, but for the duration (the ...
user avatar
  • 2,039
0 votes
0 answers
98 views

Linux server joined to child AD domain unable to authenticate users from parent domain

I have an Ubuntu 20.04 server that I have successfully joined to my domain using realm, US.EXAMPLE.COM. The way our AD is structured is that all machines are joined to the child domain for their ...
user avatar
  • 1
0 votes
0 answers
140 views

Ubuntu 18.04 multi-AD-User mount share in /home

I have an Ubuntu 18.04 server which is joined to our windows domain. I have set up so users can log in to the server using their AD creds which is working great. I also set up script that mounts a ...
user avatar
0 votes
0 answers
111 views

Apache HTTPD Kerberos, silently redirect if no auth offered

I've configured Apache HTTPD as a reverse proxy (for SSL) for my Artifactory instance, and I'm now trying to get HTTP SSO working on it. Using the below configuration, I am successfully automatically ...
user avatar
  • 79
0 votes
0 answers
171 views

Cannot live migrate VM from certain user on certain host

Layout Forest A Forest B Forest ForestA ForestB Domain DomainA DomainB Computers ComputerA1, ComputerA2 (none) User UserA UserB Administration ForestA trusts ForestB ForestB trusts ForestA ...
user avatar
2 votes
2 answers
510 views

NFS4 + Kerberos does not work since 5.10 kernel

Since I updated to Debian Bullseye, nfs clients stopped working: # mount -vvt nfs4 -o sec=krb5 nfs11:/srv /mnt mount.nfs4: timeout set for Wed Sep 15 20:25:49 2021 mount.nfs4: trying text-based ...
user avatar
  • 298
0 votes
0 answers
59 views

Kerberos - configure constrained delegation using SQL Server's virtual accounts

I'm trying to setup Kerberos constrained delegation to solve my double hop problem. I'm using standard SQL Server configuration with Virtual Account (NT SERVICE\MSSQLSERVER) as a service account for ...
user avatar
  • 141
0 votes
0 answers
148 views

"logon session does not exist" when cmdlet wrapped in do-nothing Invoke-Command

While logged into HOST1, my user can successfully run this powershell command to move a running VM from HOST1 to HOST2: Move-VM -Name DC02 -DestinationHost HOST2 -IncludeStorage -...
user avatar

1
2 3 4 5
23