Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [mitkerberos]

MIT implementation of Kerberos (https://web.mit.edu/kerberos/)

1
vote
1answer
36 views

Can not start sshd service: relocation error

After updating openssh version from 5.3 to 7.9 I am having problems when I try to start sshd service, The script that I executed is: rpm -Uvh openssh-latest-7.9p1-1.el6.cgsl7741.x86_64.rpm --...
0
votes
0answers
8 views

How to compare MIT Kerberos databases between masters and slave replicas?

What methods are there to compare MIT Kerberos KDC databases or to ensure that the KDC replicas are completely synced with the Master KDC? Also interested in any further KDC monitoring ...
1
vote
1answer
292 views

Kerberos KDC server in a docker container

I'm running a MIT Kerberos KDC and Kadmin server instances on a docker container for convenience. Am able to build it and run it without a problem, with only extracting important configs do a docker ...
1
vote
0answers
222 views

Windows kinit kerberos connection fails with ICMP Port Unreachable

I'm trying to connect to a kerberos server with a keytab: kinit -k -t securitytest.keytab securitytest@RRRR.COM Exception: ICMP Port Unreachable java.net.PortUnreachableException: ICMP Port ...
1
vote
1answer
434 views

Cross-Realm-Trust between Active Directory and MIT Kerberos

I am currently in the process of extending my development environment, which used to only run Linux servers so far, by adding machines running Windows Server 2016. The authentication process is ...
0
votes
0answers
271 views

Kerberos keytab for NFS doesn't work if not created in server

I'm trying to mount a directory into a client server using kerberos authentication. If I create a keytab file using using kadmin in the server, I cannot get authenticated when I mount the directory. ...
0
votes
2answers
97 views

What does it mean to “add” a principal to a keytab file in Kerberos?

In this documentatation they mention that you can use the ktadd command that "add a principal to an existing keytab". Does adding a principal mean that the principal now has access to that host (in ...
0
votes
1answer
517 views

Kerberos ticket cache location on windows for multiple users

I am using multiple odbc drivers connecting to hive and impala, and most of the documentation states that the kerberos ticket location should be defined by a environment variable KRB5CCNAME, such as C:...
0
votes
1answer
68 views

Using same password for kerberos and openldap

We have a working structure for our hadop where openldap was used for authentication with below structure,along with ranger and knox. openldap root:- dn: dc=abchadoop,dc=com,dc=za Subtree inside ...
0
votes
1answer
191 views

Why both userPassword and krbPrincipalKey

When configuring MIT Kerberos to use an LDAP database instead of DB2, I was surprised to see that user password hashes are stored in two different fields: userPassword and krbPrincipalKey. Seems the ...
0
votes
1answer
191 views

Kerberos Authentication in a Mixed (Windows and LINUX) Environment

I need to map the Service principal name for the user in an Active Directory from Linux environment, where my KDC is located, to Windows. Is there a way to map the AD user from Linux rather than ...
0
votes
1answer
82 views

What is the purpose of the 'keyblock' part of the Kerberos credential cache

The documentation of MIT Kerberos explains here how the credential cache file is formatted. It basically consists of: a header information about the REALM and the user a keyblock information about ...
3
votes
2answers
333 views

Use cases for kerberos credential cache type MEMORY?

One of the credential cache types offered by MIT Kerberos is MEMORY. According to the documentation it is used by kadmin. MEMORY caches are for storage of credentials that don’t need to be made ...
4
votes
1answer
3k views

How to force kerberos to use in memory credential cache?

MIT Kerberos supports multiple types of credential cache to store tickets . For example, if I want to use a persistent keyring per-user in kernel memory I can add the following to krb5.conf. [...
2
votes
3answers
3k views

MIT Kerberos keeps asking for password when authenticating to OpenSSH

I am trying to setup a simple Kerberos environment which consists of a Kerberos server (KDC), a client machine and a server machine running an OpenSSH daemon. The client is supposed to be ...
2
votes
1answer
669 views

How to change ccache type of MIT Kerberos

The MIT Kerberos Documentation lists seven different ways to store Kerberos credentials: API DIR FILE KCM KEYRING MEMORY MSLSA At the moment my Kerberos setup is storing credentials in a file in the ...
1
vote
1answer
424 views

Which servers to copy keytab file to

I am trying to setup a simple Kerberos environment in which a client server authenticates to a webservice (in my case OpenSSH) via a Kerberos server. I generated a keytab file on the KDC but am not ...
1
vote
0answers
263 views

How can I test network connectivity to a Keberos KDC (UDP/88)

How can I test network connectivity to a Keberos KDC (UDP/88)? Does Kerberos have a standard way to communicate that gives any output? HTTP for example, nc -v google.com 80 GET will dump the ...
2
votes
1answer
2k views

Apache Kerberos Authentication : KDC has no support for encryption type

I post a new thread on this problem because all the solution I found here didn't work for me. I'm trying to configure an apache2 to authenticate with Kerberos on a AD2012 server via a keytab. ...
3
votes
0answers
464 views

Is section logging in krb5.conf works on the kerberos client?

Client /etc/krb5.conf: ... [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log ... Kerberos client worked, but log files are ...
1
vote
0answers
22 views

Is it possible to make the Kerberos Server use LDAP for just the crendential validation, and use a local Keberos Principal DB for everything else?

We are working with a LDAP setup that we can not change or extend. We need to add a Kerberos Server to the environment. Is it possible to make the Kerberos Server use LDAP for just the crendential ...
1
vote
0answers
771 views

Kerberos kdc is unable to bind to ldap

I am following this guide to setup Kerberos with LDAP. I have followed all the steps. But when I am running kadmin.local it exits with following error: Authenticating as principal root/admin@...
1
vote
1answer
158 views

Is it possible to change an MIT Kerberos password programmatically?

First of all, I'm not an infrastructure guy, I'm a developer, so please excuse me if I'm leaving important information out. I just need to determine if the following is possible, and if so, how to ...
2
votes
1answer
7k views

Kerberos error while initializing kadmin interface from admin server

I updated my master key for my Kerberos 5 server following the MIT Kerberos 5 instructions. I restarted the kdc and kadmind services and used krb5-prop to push the changes to the other servers. Now I ...
1
vote
0answers
59 views

Kerberos cross realm authentication for kadmin

We have set up cross realm authentication using MIT Kerberos, it's quite straightforward if you adhere to the docs. But we are missing one feature: We'd like to be able to authenticate to the kadmind ...
0
votes
1answer
647 views

nslcd and kerberos without Reverse DNS

I am trying to get nslcd to connect with an ldap instance using GSSAPI and kerberos authentication. Problem i'm having is that nslcd keeps using the wrong principal to try and connected with the ...
0
votes
1answer
84 views

Kerberos Bootstrap error with ldap

Up until recently I have had no issues deploying Kerberos with an LDAP backend for the database. Recently however I have started to get this error when trying to generate the password stash file ...
1
vote
0answers
262 views

kinit unable to connect

I'm trying to connect to a Kerberos running on ApacheDS. Here is the initial LDIF I've loaded on LDAP: dn: ou=Users,dc=example,dc=com ou: Users description: Example.Com Users objectClass: ...
0
votes
0answers
14 views

What changes with Kerberos Authentication in IPv6 when using NAT? [duplicate]

How should Kerberos Authentication be setup with IPv6? Of you're using NAT for IPv6 where there is a single public IPv6 address and it translates to the machines inside in the ULA range?
0
votes
1answer
381 views

What changes with Kerberos authentication in IPv6 when everyone has a public IPv6 Address?

How should Kerberos authentication be set up with IPv6? What implications are there when client devices each use a public, globally routeable IPv6 IP address? What changes when setup this way ...
2
votes
0answers
1k views

Windows - Kerberos SSO from outside the domain

I've tried to figure it out myself, but to no avail. Google offers many tutorials but I couldn't find any for the below case. We have an external cooperating employee with VPN access to our LAN and ...
1
vote
2answers
6k views

Automatic Kerberos Ticket Renewal (Indefinitely)

I am currently switching our environment from NIS over to Kerberos + LDAP. During this migration I've now run into the following situation. We mount our homes via NFS which obviously should also be ...
0
votes
1answer
537 views

psql: duplicate GSS authentication request

What does it mean by saying 'duplicate' ? How to troubleshoot this? guest@www:~$ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: user/admin@SOHONET Valid starting Expires ...
1
vote
1answer
653 views

GSSAPI on Linux when reverse DNS lookup doesn't match AD DNS suffix

I have CentOS 6 server that has been joined to Active Directory using Samba and net ads join -k. It thus has a keytab like this: Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- ---------------...
2
votes
2answers
914 views

apache kerberos authentication tickets are not visible under klist

when i configured the apache authentication using the kerberos. it is working fine. It is asking the password and logging into the website. and it is creating a log information like this. /var/log/...
0
votes
1answer
288 views

Slave Kerberos behind NAT - kprop fails: Incorrect net address while decoding database size from client

I want to synchronize MIT Kerberos database from master to slave, which is in a different geographical location. kprop synchronization fails because of a NAT. Is there any solution to have kprop ...
0
votes
0answers
307 views

Establish FAST encrypted channel between linux client and windows server

I am trying to setup windows server for FAST encrypted channel support to test OTP pre authentication in kerberos. I have already tested on linux machine by deploying KDC using krb5-1.12.1 source ...
5
votes
1answer
4k views

Cross-Realm trust verify failed with 'netdom' command

Question 1: Am having my ActiveDirectory in Windowsserver 2012 machine - its domain name is AD-DEMO.LOCAL Kerberos admin-server is in another Ubuntu machine - its realm KERBEROS.COM Added trust in '...
1
vote
0answers
374 views

FreeRadius-GoogleAuthenticator-Kerberos Password Change Weirdness

We are using FreeRadius, Kerberos and Google Authenticator to implement two-factor authentication. The two factor auth works fine, both from radtest and from a Watchguard firewall. To log in, a user ...
1
vote
0answers
489 views

Why does MIT Kerberos kinit warn “Your passwod will expire” when your principal is what is about to expire?

While doing some experimenting I noticed that the MIT Kerberos version 5 "kinit" program will warn you when either your password is about to expire (within 7 days) or when your principal is about to ...
1
vote
1answer
826 views

Alfresco with only MIT Kerberos: What authentication.chain?

I want Alfresco to authenticate users using SSO with MIT Kerberos. What authentication.chain should I use? I tried authentication.chain=kerberos1:kerberos without success. Based on this answer I ...
1
vote
0answers
594 views

Alfresco with Kerberos: Error creating bean with name globalAuthenticationFilter

I configured Alfresco 4.2.c to work with MIT Kerberos, following the documentation. Because the documentation is only for Active Directory, I adapted some part to Kerberos by reading the forum. Upon ...
0
votes
1answer
216 views

Alfresco authentication chain for (MIT) Kerberos only? (no LDAP, no AD)

The Alfresco documentation seems to consider only LDAP or Active Directory cases. In my case, all users are in MIT Kerberos, but I don't use LDAP nor Active Directory. What authentication chain ...
2
votes
1answer
448 views

How does one remove an encryption type from a kerberos principal?

I would like to remove all of the des keys from the principal below, but have no idea how to do so without someone inputting the password. kadmin: getprinc user Principal: user@EXAMPLE.COM ...
2
votes
1answer
1k views

Windows 7 system won't talk to MIT Kerberos server

I've installed MIT Kerberos 1.10 on a Debian server and happily have my Debian clients authenticating with it. I'm having some trouble getting my Windows 7 machine to do the same, however. I've used ...
2
votes
3answers
10k views

Wrong principal in request (SSH/ GSSAPI/Kerberos/Debian)

I've set up two VMs on an "internal" (in VirtualBox meaning) network, one being a DNS server (dns1.example.com) and the other - a KDC and Kerberos admin server (kdc.example.com). The default and the ...
0
votes
1answer
2k views

OpenSSH + Kerberos SSO problem: Wrong principal in request

Thanks to your help , I am getting closer. Now at this point, I am getting the following message with logging in via ssh: debug1: Unspecified GSS failure. Minor code may provide more information ...
1
vote
1answer
13k views

Unable to Login to kadmin from Kerberos Client

I have a small problem of getting my client to authenticate to a kerberos server that I just setup. Whenever I run: [root@localhost log]# kadmin -r KERBEROS.MONZELL.COM -p host/kerberos.monzell.com ...
3
votes
2answers
334 views

Known services that don't use Kerberos authentication?

I'm looking to set up a Kerberos trust between MIT Kerberos5 and Active Directory. However, it's noted in my old Kerberos book from 2003 that "there are several applications, notably Microsoft ...
11
votes
5answers
6k views

Which kerberos flavor?

So I'm setting up a small network with all the standard stuff (files, email, etc.) and I've decided to go with a Kerberos+LDAP solution. Any ideas or recommendations on Heimdal vs. MIT? I've used MIT ...