Questions tagged [kerberos]
Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.
1,197
questions
1
vote
0
answers
204
views
winbind works but Squid acts wrong
I am trying to get a Squid Proxy running with Kerberos+Samba+Winbind, which is connected to my AD.
Everything works great so far!
krb auth working
wbinfo -u, -a, -g working
I made some new testing-...
1
vote
0
answers
487
views
Kerberos issues with Samba4 AD DC when resolv.conf not set to use localhost
I recently did a "classis conversion" of our small NT4 Samba domain to an AD one on my Debian 10 "Buster" system. I got everything working as far as I can tell, but I don't ...
0
votes
1
answer
186
views
Kerberos using JAAS and SMB protocol
We are using JAAS for Kerberos authentication. As a requirement from the customer, we want to make sure that SMB V2 or higher must be used during communication with KDC/AD.
I've few basic questions ...
0
votes
1
answer
3k
views
Kerberos rdns=false Breaking Connections From Linux Clients to Windows IIS Server
Recently I changed the krb5.conf file on Linux clients to use:
[libdefaults]
rdns = false
These clients can still successfully use kerberos auth to connect to other Linux webservers. However, now ...
3
votes
1
answer
9k
views
id: user: no such user
I'm using Centos 7 to authenticate locally Active directory users using kerberos. I joined the realm with the Administrator and i can login/ssh through it/with it, nslookup working fine, and adcli ...
0
votes
1
answer
3k
views
ubuntu ignores default_ccache_name
I'm having trouble with Kerberos and Ubuntu 20.04.
Im running a FreeIPA Server, but since it works on my Centos machines, I guess it's a client issue.
The big goal is to have a SSO System, for ...
0
votes
1
answer
699
views
Windows gMSA How To Secure Use of CredentialSpec Used By Docker Container Engine
The gMSA strategy Microsoft recommends for Containers here and here works very well. The general idea is the Container host retrieves the gMSA password from an Active Directory domain controller and ...
0
votes
2
answers
2k
views
Errors with new version of Kerberos | CentOS 8
Yesterday all kerberos packages on in my container builds got updated to 1.18.2-5.el8 and 1.17-18.el8 is no longer available.
This is causing some big problems on servers.
Our connections all show
Pre-...
1
vote
1
answer
2k
views
Kerberos pre-authentication failed for unused Administrator account on domain controllers [duplicate]
Our three Active Directory domain controllers are collectively reporting thousands of 'Kerberos pre-authentication failed' events a week, where the IpAddress field is of a domain controller (but ...
0
votes
1
answer
3k
views
Why am I getting the kerberos error "Failed to decrypt AP-REQ ticket"?
I'm trying to get SASL + OpenLDAP working over saslauthd to AD via kerberos. I've fired up saslauthd in debug mode and getting the error below in the trace log when I try to su to the LDAP account ...
1
vote
0
answers
1k
views
IIS SSO not working, asking for login via login-prompt every new session
We are facing an issue where we don't get SSO to work on an IIS web app. We have set Windows-Authentication as enabled and Negotiate and NTLM as providers (IIS Windows Authentication and Providers). ...
2
votes
1
answer
16k
views
Why do I get "Server not found in Kerberos database" using testsaslauthd?
I'm trying to setup Kerberos auth over SASL using OpenLDAP. As I understand it, I need a host keytab in /etc/krb5.keytab from the KDC I'm using and then {SASL}user@realm in the given user's LDAP ...
3
votes
1
answer
1k
views
NFS/krb5 authentication server lookup fails due to wrong principal name
When mounting an NFSv4 with Kerberos, authentication fails and krb5kdc.log shows the wrong principal name for the NFS server.
LOOKING_UP_SERVER: ... host/[email protected] ...
0
votes
0
answers
683
views
How to replace NIS authentication with Kerberos: Client not found in Kerberos database
I followed the Oracle tutorial for configuring NIS and using Kerberos as the authentication mechanism. I believe I got the Realm and KDC configured and running correctly on a server that is running ...
0
votes
1
answer
2k
views
How does IIS know which AD server/domain to use for kerberos?
I am currently setting up an IIS Web Application.
For Authentication I use integrated Windows Authentication with Kerberos. But i am kinda new to all that AD, Windows Authentication and Kerberos stuff....
4
votes
0
answers
8k
views
kinit to get TGT returns “KrbException: Identifier doesn't match expected value (906)” under Windows Server 2016 Active Directory + Kerberos + JDK8
Trying to make Windows Server 2016 Active Directory + Kerberos and Java OpenJDK 8 kinit to obtain a ticket-granting ticket returns KrbException: Identifier doesn't match expected value (906)
I have ...
0
votes
1
answer
270
views
Configure CentOS 7 sftp and a separate samba server
I am a Windows admin and my boss requested that I build a sftp and samba server. The sftp and samba server both use Windows AD to authenticate. The external customers need to only sftp and must be ...
1
vote
2
answers
4k
views
OpenSSH + Active Directory: allow sftp for a group while disallowing everyone else
My objective is to allow a given Active Directory group members to use OpenSSH SFTP in chroot, and deny access to SSH for them and all others that aren't members of that group, while still allowing ...
0
votes
1
answer
2k
views
Centos joined to domain successfully, can't create keytab?
Hello I'm trying to create keytab. This client system is already joined to domain.
Below I have a flurry of errors. Looks like 2 main errors though, most notably:
...
3
votes
1
answer
7k
views
How to use Windows Kerberos ticket in WSL and/or Docker
I don't know much about Kerberos authentication, I just have some basic experience with configuration and usage.
Recently I noticed that Windows has a built-in Kerberos implementation that is ...
0
votes
0
answers
1k
views
kerberos - cannot contact any kdc
i don't understand kerberos. from a you tube video,i configure kerberos. and got error. i create principal for client from kdc server..
but,from client side for root user is shows :
[root@client ~]# ...
1
vote
2
answers
697
views
On linux, is there a way to record the ports a program tries to communicate over?
Problem: I am trying to determine which ports to open for specific programs
I have a number of programs that need to access services on remote hosts, but I don't know which ports they are trying to ...
3
votes
0
answers
2k
views
How to run kinit as root before automounting mutiuser cifs mounts?
Goal
I'm setting up multi-user CIFS mounts in an Active Directory environment under CentOS 8.2. The storage server supports SMB3.1.1 protocol.
Prerequisites
I could easily integrate the system to the ...
0
votes
1
answer
89
views
Single Sign On in Solarwinds Security events manager (SEM)
I am having an issue where I am getting a prompt from SEM web gui to provide my credentials. I provide credentials (we use both tokens and passwords). It does not fail unless I close the prompt. LDAP ...
0
votes
0
answers
1k
views
Single sign on with Samba AD DC, Linux servers, GSSAPI/Kerberos and Windows clients that are not joined to the domain
Setup
We have:
a machine running Samba 4 on Debian Buster as AD DC.
another Debian Buster machine running Samba 4 as file server, joined to the domain with net join and using winbind for ...
3
votes
1
answer
1k
views
cifs automounts suddenly stopped working
Had been working for several years but has suddenly stopped. Obviously, something in the environment must have changed but I need some ideas for where to look
Linux workstation automounting SMB ...
0
votes
2
answers
583
views
Can't determine the principal used to LDAP syncrepl GSSAPI
I've configured two openldap fully functional in HA (syncrepl mode provider - slave).
After testing that simple bind syncrepl works flawlessly, I'm trying to deploy from scratch using only GSSAPI to ...
0
votes
1
answer
249
views
Specify Keytab Location for Slapd
I need help. How can I set up the ldap keytab location path in order that slapd uses it instead of the system /etc/krb5.keytab?
I can't find the configuration in documentation.
Thank you so much.
1
vote
0
answers
80
views
Limit access on network share to a specific computer, Device claim under DAC not working
There are certain confidential data and we want to make sure that is does not get copied by user and eventually leaked out of organisation.
For achieving the same, we have defined a restricted windows ...
1
vote
1
answer
2k
views
How to disable basic authentication when using kerberos on nginx?
My task is to configure Kerberos authentication on nginx. The backend is django. The idea is that when a request is made to api, nginx should perform kerberos authentication. But in case the user is ...
0
votes
1
answer
3k
views
ADFS 4.0 IDPinitiatedSignOn Page Error: HTTP 400 - Bad Request (Request header too long)
We are facing an issue with our WHFB enrollment process.
The ADFS server Windows Intergrated login process is throwing error:
HTTP 400 - Bad Request (Request header too long).
The issue is limited to ...
0
votes
1
answer
514
views
Windows domain joined Linux server tries to authenticate to multiple AD controllers
i have set up a Debian Server and let i join our domain.
Our company has multiple domain controllers around europe.
I have installed Winbind, Samba, Kerberos5, PAM and Open SSL on this machine.
...
1
vote
1
answer
171
views
Is there a way to force active directory group assignation without logoff/login?
as stated here and there, it looks like there is no way to avoid a user logoff/login in order to activate a new group assignation for this user (my use case was : activate an access to a shared folder ...
3
votes
0
answers
155
views
What is the practical difference between krb5-self and krb5-subdomain in BIND9 update-policy statement?
What is the practical difference between krb5-self and krb5-subdomain policies in BIND9 on update-policy statement while dealing with dynamic DNS updates on zones?
From the BIND9 documentation it ...
0
votes
1
answer
211
views
FreeIPA on RPi3 Kerberos5 timeout
I pulled a magic trick from a hat.
I put Kerberos 5 using FreeIPA on a Raspberry Pi 3 B.
It's an inexpensive box that does one thing only, issuing tickets. I modified the 60 second timeout to 2000 ...
0
votes
3
answers
1k
views
Kerberos second-hops using PowerShell Sessions
I often use PowerShell remote sessions to manage windows servers remotely, generally using the following command, though the following is true for any remote powershell commands such as Invoke-Command:...
2
votes
0
answers
2k
views
Join AD domain failed SPNEGO login failed: {Access Denied} A process has requested access to an object but has not been granted those access rights
I meet a problem when trying to join Active Directory domain with Samba.
The error message is
cli_session_creds_prepare_krb5: Doing kinit for [email protected] to access domaincontroller.hostname
...
0
votes
1
answer
917
views
Can a kerberos principal use a hostname/instance not matching the realm?
Let say our realm is CARS.LOCAL and I can't change it.
Would a principal like HTTP/[email protected] works?
In other words, our internet domain name doesn't match our realm and I would ...
0
votes
2
answers
1k
views
Best Practices: Unix User Management with LDAP + Kerberos?
I'm running a small LAN for 5 users with some basic services, e.g., NFSv4 mounts and SOGo groupware. Because it seemed to be a good and easy to implement idea, authentication is a combination of ...
3
votes
0
answers
2k
views
SSSD procedure for staying joined when renaming AD computer object
Shooting for the moon with this question here. In Windows if you join a client to an AD domain and later if you want to rename the computer object you can do so "seamlessly" without it breaking the AD ...
1
vote
1
answer
3k
views
Microsoft Active Directory kerberos returns unknown principal
I m trying to authenticate the host for kbr5p nfs mount where Microsoft active directory is acting as the Kerberos server.
sudo kinit -k -t /etc/krb5.keytab host/[email protected]
kinit: ...
1
vote
1
answer
390
views
Active Directory as uid/gid provider within a cluster
I have a CentOS 8 HPC cluster setup with a login node that is connected to an active directory via sssd/kerberos. Only the login node is accessible from the user network. Users use their normal domain ...
0
votes
1
answer
891
views
Permission denied errors after logging back into a ssh-ed tmux/screen session
I'm running some very long jobs on a machine that I'm SSH'd in. However, sometimes after a few hours in the session, I no longer have permissions to run simple commands that I previously could. That ...
1
vote
1
answer
37
views
Get history of remote connections for a user
One of our disabled admin account credentials is still used to perform (failed) login attempts on some Windows servers from a bunch of other servers.
The login attempts were made using Kerberos ...
0
votes
1
answer
295
views
Active Directory vs Active Directory Trust
We have 2 forests/domains : ad.local (not managed by us) and ad2.local (managed by us)
We setup a two way trust between them.
Now let's say I have an app on a server joined to ad2.local : app.ad2....
0
votes
1
answer
1k
views
MIT Kerberos renew lifetime does not work
I am trying to figure out why my tickets only get a renewable life of 0 instead of 7 days as I specified.
I tried setting both the max_renewable_life (as indicated in another question) as well as ...
1
vote
1
answer
2k
views
autofs with samba, sssd, openldap, kerberos
I want to mount a samba share with autofs.
srv.xxxxxxx.net is the samba server (proxmox container, Debian 10)
ldap2.xxxxxxx.net is the openldap (proxmox container, Debian 10)
gui.xxxxxxx.net is the ...
2
votes
1
answer
4k
views
sssd active directory password integration not working
We are in the process of setting up sssd to be used with active directory using the config below.
We do not use attribute mapping as we want to use attributes defined in the AD ldap objects such as ...
0
votes
0
answers
271
views
Is it possible to force re-authenticate kerberos users?
Is there a way to force reauthenticate users with a valid kerberos session key?
In my case there are several users who dont authenticate against the KDC but take over existing sessions from other ...
2
votes
1
answer
5k
views
Kerberos service started with Error: Cannot open DB2 database on Ubuntu 18
I installed kerberos on Ubuntu 18 with sudo apt install krb5-kdc krb5-admin-server
But, When I ran systemctl status krb5-kdc.service, it turns out:
Feb 17 21:25:23 device2 krb5kdc[8675]: Cannot open ...