Questions tagged [kerberos]

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.

Filter by
Sorted by
Tagged with
1 vote
0 answers
204 views

winbind works but Squid acts wrong

I am trying to get a Squid Proxy running with Kerberos+Samba+Winbind, which is connected to my AD. Everything works great so far! krb auth working wbinfo -u, -a, -g working I made some new testing-...
Shouma's user avatar
  • 21
1 vote
0 answers
487 views

Kerberos issues with Samba4 AD DC when resolv.conf not set to use localhost

I recently did a "classis conversion" of our small NT4 Samba domain to an AD one on my Debian 10 "Buster" system. I got everything working as far as I can tell, but I don't ...
Tim T's user avatar
  • 111
0 votes
1 answer
186 views

Kerberos using JAAS and SMB protocol

We are using JAAS for Kerberos authentication. As a requirement from the customer, we want to make sure that SMB V2 or higher must be used during communication with KDC/AD. I've few basic questions ...
Bhushan Karmarkar's user avatar
0 votes
1 answer
3k views

Kerberos rdns=false Breaking Connections From Linux Clients to Windows IIS Server

Recently I changed the krb5.conf file on Linux clients to use: [libdefaults] rdns = false These clients can still successfully use kerberos auth to connect to other Linux webservers. However, now ...
Howard_Roark's user avatar
3 votes
1 answer
9k views

id: user: no such user

I'm using Centos 7 to authenticate locally Active directory users using kerberos. I joined the realm with the Administrator and i can login/ssh through it/with it, nslookup working fine, and adcli ...
Gopal's user avatar
  • 31
0 votes
1 answer
3k views

ubuntu ignores default_ccache_name

I'm having trouble with Kerberos and Ubuntu 20.04. Im running a FreeIPA Server, but since it works on my Centos machines, I guess it's a client issue. The big goal is to have a SSO System, for ...
Poehli's user avatar
  • 103
0 votes
1 answer
699 views

Windows gMSA How To Secure Use of CredentialSpec Used By Docker Container Engine

The gMSA strategy Microsoft recommends for Containers here and here works very well. The general idea is the Container host retrieves the gMSA password from an Active Directory domain controller and ...
Howard_Roark's user avatar
0 votes
2 answers
2k views

Errors with new version of Kerberos | CentOS 8

Yesterday all kerberos packages on in my container builds got updated to 1.18.2-5.el8 and 1.17-18.el8 is no longer available. This is causing some big problems on servers. Our connections all show Pre-...
David West's user avatar
1 vote
1 answer
2k views

Kerberos pre-authentication failed for unused Administrator account on domain controllers [duplicate]

Our three Active Directory domain controllers are collectively reporting thousands of 'Kerberos pre-authentication failed' events a week, where the IpAddress field is of a domain controller (but ...
Daniel's user avatar
  • 7,049
0 votes
1 answer
3k views

Why am I getting the kerberos error "Failed to decrypt AP-REQ ticket"?

I'm trying to get SASL + OpenLDAP working over saslauthd to AD via kerberos. I've fired up saslauthd in debug mode and getting the error below in the trace log when I try to su to the LDAP account ...
Server Fault's user avatar
  • 3,774
1 vote
0 answers
1k views

IIS SSO not working, asking for login via login-prompt every new session

We are facing an issue where we don't get SSO to work on an IIS web app. We have set Windows-Authentication as enabled and Negotiate and NTLM as providers (IIS Windows Authentication and Providers). ...
Niclas's user avatar
  • 11
2 votes
1 answer
16k views

Why do I get "Server not found in Kerberos database" using testsaslauthd?

I'm trying to setup Kerberos auth over SASL using OpenLDAP. As I understand it, I need a host keytab in /etc/krb5.keytab from the KDC I'm using and then {SASL}user@realm in the given user's LDAP ...
Server Fault's user avatar
  • 3,774
3 votes
1 answer
1k views

NFS/krb5 authentication server lookup fails due to wrong principal name

When mounting an NFSv4 with Kerberos, authentication fails and krb5kdc.log shows the wrong principal name for the NFS server. LOOKING_UP_SERVER: ... host/[email protected] ...
ifndef's user avatar
  • 31
0 votes
0 answers
683 views

How to replace NIS authentication with Kerberos: Client not found in Kerberos database

I followed the Oracle tutorial for configuring NIS and using Kerberos as the authentication mechanism. I believe I got the Realm and KDC configured and running correctly on a server that is running ...
RobbieTheK's user avatar
0 votes
1 answer
2k views

How does IIS know which AD server/domain to use for kerberos?

I am currently setting up an IIS Web Application. For Authentication I use integrated Windows Authentication with Kerberos. But i am kinda new to all that AD, Windows Authentication and Kerberos stuff....
TostMaster's user avatar
4 votes
0 answers
8k views

kinit to get TGT returns “KrbException: Identifier doesn't match expected value (906)” under Windows Server 2016 Active Directory + Kerberos + JDK8

Trying to make Windows Server 2016 Active Directory + Kerberos and Java OpenJDK 8 kinit to obtain a ticket-granting ticket returns KrbException: Identifier doesn't match expected value (906) I have ...
Victor Polo De Gyves Montero's user avatar
0 votes
1 answer
270 views

Configure CentOS 7 sftp and a separate samba server

I am a Windows admin and my boss requested that I build a sftp and samba server. The sftp and samba server both use Windows AD to authenticate. The external customers need to only sftp and must be ...
Sage's user avatar
  • 63
1 vote
2 answers
4k views

OpenSSH + Active Directory: allow sftp for a group while disallowing everyone else

My objective is to allow a given Active Directory group members to use OpenSSH SFTP in chroot, and deny access to SSH for them and all others that aren't members of that group, while still allowing ...
Daichi42's user avatar
0 votes
1 answer
2k views

Centos joined to domain successfully, can't create keytab?

Hello I'm trying to create keytab. This client system is already joined to domain. Below I have a flurry of errors. Looks like 2 main errors though, most notably: ...
bluesquare's user avatar
3 votes
1 answer
7k views

How to use Windows Kerberos ticket in WSL and/or Docker

I don't know much about Kerberos authentication, I just have some basic experience with configuration and usage. Recently I noticed that Windows has a built-in Kerberos implementation that is ...
SchLx's user avatar
  • 139
0 votes
0 answers
1k views

kerberos - cannot contact any kdc

i don't understand kerberos. from a you tube video,i configure kerberos. and got error. i create principal for client from kdc server.. but,from client side for root user is shows : [root@client ~]# ...
tamjidul islam's user avatar
1 vote
2 answers
697 views

On linux, is there a way to record the ports a program tries to communicate over?

Problem: I am trying to determine which ports to open for specific programs I have a number of programs that need to access services on remote hosts, but I don't know which ports they are trying to ...
Steen's user avatar
  • 127
3 votes
0 answers
2k views

How to run kinit as root before automounting mutiuser cifs mounts?

Goal I'm setting up multi-user CIFS mounts in an Active Directory environment under CentOS 8.2. The storage server supports SMB3.1.1 protocol. Prerequisites I could easily integrate the system to the ...
MauvaisJoueur's user avatar
0 votes
1 answer
89 views

Single Sign On in Solarwinds Security events manager (SEM)

I am having an issue where I am getting a prompt from SEM web gui to provide my credentials. I provide credentials (we use both tokens and passwords).  It does not fail unless I close the prompt. LDAP ...
Nicholas Buckingham's user avatar
0 votes
0 answers
1k views

Single sign on with Samba AD DC, Linux servers, GSSAPI/Kerberos and Windows clients that are not joined to the domain

Setup We have: a machine running Samba 4 on Debian Buster as AD DC. another Debian Buster machine running Samba 4 as file server, joined to the domain with net join and using winbind for ...
Magnus Holmgren's user avatar
3 votes
1 answer
1k views

cifs automounts suddenly stopped working

Had been working for several years but has suddenly stopped. Obviously, something in the environment must have changed but I need some ideas for where to look Linux workstation automounting SMB ...
Michael Keane's user avatar
0 votes
2 answers
583 views

Can't determine the principal used to LDAP syncrepl GSSAPI

I've configured two openldap fully functional in HA (syncrepl mode provider - slave). After testing that simple bind syncrepl works flawlessly, I'm trying to deploy from scratch using only GSSAPI to ...
DG DM's user avatar
  • 35
0 votes
1 answer
249 views

Specify Keytab Location for Slapd

I need help. How can I set up the ldap keytab location path in order that slapd uses it instead of the system /etc/krb5.keytab? I can't find the configuration in documentation. Thank you so much.
DG DM's user avatar
  • 35
1 vote
0 answers
80 views

Limit access on network share to a specific computer, Device claim under DAC not working

There are certain confidential data and we want to make sure that is does not get copied by user and eventually leaked out of organisation. For achieving the same, we have defined a restricted windows ...
Amit's user avatar
  • 111
1 vote
1 answer
2k views

How to disable basic authentication when using kerberos on nginx?

My task is to configure Kerberos authentication on nginx. The backend is django. The idea is that when a request is made to api, nginx should perform kerberos authentication. But in case the user is ...
user12844285's user avatar
0 votes
1 answer
3k views

ADFS 4.0 IDPinitiatedSignOn Page Error: HTTP 400 - Bad Request (Request header too long)

We are facing an issue with our WHFB enrollment process. The ADFS server Windows Intergrated login process is throwing error: HTTP 400 - Bad Request (Request header too long). The issue is limited to ...
IshRaj's user avatar
  • 81
0 votes
1 answer
514 views

Windows domain joined Linux server tries to authenticate to multiple AD controllers

i have set up a Debian Server and let i join our domain. Our company has multiple domain controllers around europe. I have installed Winbind, Samba, Kerberos5, PAM and Open SSL on this machine. ...
phL's user avatar
  • 1
1 vote
1 answer
171 views

Is there a way to force active directory group assignation without logoff/login?

as stated here and there, it looks like there is no way to avoid a user logoff/login in order to activate a new group assignation for this user (my use case was : activate an access to a shared folder ...
Alex T.'s user avatar
  • 185
3 votes
0 answers
155 views

What is the practical difference between krb5-self and krb5-subdomain in BIND9 update-policy statement?

What is the practical difference between krb5-self and krb5-subdomain policies in BIND9 on update-policy statement while dealing with dynamic DNS updates on zones? From the BIND9 documentation it ...
Vinícius Ferrão's user avatar
0 votes
1 answer
211 views

FreeIPA on RPi3 Kerberos5 timeout

I pulled a magic trick from a hat. I put Kerberos 5 using FreeIPA on a Raspberry Pi 3 B. It's an inexpensive box that does one thing only, issuing tickets. I modified the 60 second timeout to 2000 ...
JohnnyShivers's user avatar
0 votes
3 answers
1k views

Kerberos second-hops using PowerShell Sessions

I often use PowerShell remote sessions to manage windows servers remotely, generally using the following command, though the following is true for any remote powershell commands such as Invoke-Command:...
Cpt.Whale's user avatar
  • 412
2 votes
0 answers
2k views

Join AD domain failed SPNEGO login failed: {Access Denied} A process has requested access to an object but has not been granted those access rights

I meet a problem when trying to join Active Directory domain with Samba. The error message is cli_session_creds_prepare_krb5: Doing kinit for [email protected] to access domaincontroller.hostname ...
zhaorong's user avatar
  • 146
0 votes
1 answer
917 views

Can a kerberos principal use a hostname/instance not matching the realm?

Let say our realm is CARS.LOCAL and I can't change it. Would a principal like HTTP/[email protected] works? In other words, our internet domain name doesn't match our realm and I would ...
bbigras's user avatar
  • 276
0 votes
2 answers
1k views

Best Practices: Unix User Management with LDAP + Kerberos?

I'm running a small LAN for 5 users with some basic services, e.g., NFSv4 mounts and SOGo groupware. Because it seemed to be a good and easy to implement idea, authentication is a combination of ...
Technaton's user avatar
  • 141
3 votes
0 answers
2k views

SSSD procedure for staying joined when renaming AD computer object

Shooting for the moon with this question here. In Windows if you join a client to an AD domain and later if you want to rename the computer object you can do so "seamlessly" without it breaking the AD ...
SeligkeitIstInGott's user avatar
1 vote
1 answer
3k views

Microsoft Active Directory kerberos returns unknown principal

I m trying to authenticate the host for kbr5p nfs mount where Microsoft active directory is acting as the Kerberos server. sudo kinit -k -t /etc/krb5.keytab host/[email protected] kinit: ...
suresh's user avatar
  • 241
1 vote
1 answer
390 views

Active Directory as uid/gid provider within a cluster

I have a CentOS 8 HPC cluster setup with a login node that is connected to an active directory via sssd/kerberos. Only the login node is accessible from the user network. Users use their normal domain ...
DayAndNight's user avatar
0 votes
1 answer
891 views

Permission denied errors after logging back into a ssh-ed tmux/screen session

I'm running some very long jobs on a machine that I'm SSH'd in. However, sometimes after a few hours in the session, I no longer have permissions to run simple commands that I previously could. That ...
chang_trenton's user avatar
1 vote
1 answer
37 views

Get history of remote connections for a user

One of our disabled admin account credentials is still used to perform (failed) login attempts on some Windows servers from a bunch of other servers. The login attempts were made using Kerberos ...
MedAl's user avatar
  • 131
0 votes
1 answer
295 views

Active Directory vs Active Directory Trust

We have 2 forests/domains : ad.local (not managed by us) and ad2.local (managed by us) We setup a two way trust between them. Now let's say I have an app on a server joined to ad2.local : app.ad2....
preguenga's user avatar
0 votes
1 answer
1k views

MIT Kerberos renew lifetime does not work

I am trying to figure out why my tickets only get a renewable life of 0 instead of 7 days as I specified. I tried setting both the max_renewable_life (as indicated in another question) as well as ...
comfix's user avatar
  • 11
1 vote
1 answer
2k views

autofs with samba, sssd, openldap, kerberos

I want to mount a samba share with autofs. srv.xxxxxxx.net is the samba server (proxmox container, Debian 10) ldap2.xxxxxxx.net is the openldap (proxmox container, Debian 10) gui.xxxxxxx.net is the ...
user12682985's user avatar
2 votes
1 answer
4k views

sssd active directory password integration not working

We are in the process of setting up sssd to be used with active directory using the config below. We do not use attribute mapping as we want to use attributes defined in the AD ldap objects such as ...
ZZ9's user avatar
  • 918
0 votes
0 answers
271 views

Is it possible to force re-authenticate kerberos users?

Is there a way to force reauthenticate users with a valid kerberos session key? In my case there are several users who dont authenticate against the KDC but take over existing sessions from other ...
G4schberle's user avatar
2 votes
1 answer
5k views

Kerberos service started with Error: Cannot open DB2 database on Ubuntu 18

I installed kerberos on Ubuntu 18 with sudo apt install krb5-kdc krb5-admin-server But, When I ran systemctl status krb5-kdc.service, it turns out: Feb 17 21:25:23 device2 krb5kdc[8675]: Cannot open ...
DennisLi's user avatar
  • 125

1 2 3
4
5
24