Questions tagged [mitkerberos]
MIT implementation of Kerberos (https://web.mit.edu/kerberos/)
69
questions
0
votes
0
answers
43
views
Wrong ouput with kinit, kadmin, klist
I am unable to use the kadmin command after entering the password. list_principals, and klist returns the output "true" without information about the ticket.
Where is the information about ...
- 9
1
vote
1
answer
360
views
sudo with Kerberos credentials
We are on Oracle Linux 7.9, which is part of a Kerberos realm.
I would like account foo to be able to execute (without any password) one command as account bar with Kerberos credentials of bar ...
- 183
0
votes
0
answers
185
views
NFSv4 with Kerberos takes a long time to mount
I have an NFS server with Kerberos authentication (Debian 11). If I want to mount a share on a client for the first time after a restart, this takes 10-12 seconds. If I then mount another share from ...
- 1
0
votes
1
answer
253
views
Ubuntu 21.10 with Samba AD unable to create domain trust account
I am trying to add domain trust account for additional kerberos5 (MIT) domain
in Samba AD DC with command:
net rpc trustdom add <domain_name>
-UAdministrator%<administrator_password>
What ...
0
votes
2
answers
130
views
Putting .k5login credentials in ldap with freeipa
On the systems I administer, in addition to human user accounts, we have a number of accounts associated with roles, software and specific data.
By using a .k5login file in home directories, it is ...
- 152
0
votes
1
answer
745
views
Apple client unable to login with LDAP backend and GSSAPI or PLAIN
I have a OpenLDAP server with Kerberos5 for authentication and on Linux/Unix/Windows environments I am able to login without a problem.
The LDAP server is configured to use GSSAPI or PLAIN that passes ...
0
votes
2
answers
612
views
Set network.auth.use-sspi in Firefox with Group Policy
I have downloaded the Group Policy templates and copied them to the appropriate location.
In gpedit.msc I have set:
Computer Configuration > Administrative Templates > Mozilla > Firefox > ...
- 1
3
votes
3
answers
40k
views
Server Not Found in Kerberos database - where is the database located?
Testing setup:
Weblogic 12.2.1.4 running on a Windows 10 machine joined to an active directory
JVM 1.8.0_281
The java web application is using Java GSSAPI to access the fileshare over Samba ...
- 306
0
votes
1
answer
3k
views
Kerberos rdns=false Breaking Connections From Linux Clients to Windows IIS Server
Recently I changed the krb5.conf file on Linux clients to use:
[libdefaults]
rdns = false
These clients can still successfully use kerberos auth to connect to other Linux webservers. However, now ...
- 55
0
votes
1
answer
3k
views
ubuntu ignores default_ccache_name
I'm having trouble with Kerberos and Ubuntu 20.04.
Im running a FreeIPA Server, but since it works on my Centos machines, I guess it's a client issue.
The big goal is to have a SSO System, for ...
- 103
0
votes
1
answer
1k
views
MIT Kerberos renew lifetime does not work
I am trying to figure out why my tickets only get a renewable life of 0 instead of 7 days as I specified.
I tried setting both the max_renewable_life (as indicated in another question) as well as ...
- 11
1
vote
1
answer
3k
views
Single sign on using SSSD against OpenLDAP server with Kerberos SASL/GSSAPI
Authentication against Kerberos and authorization against an LDAP directory is working for me. Now I'm looking for the client setup on Debian Buster using sssd.
I started with LDAP authentication ...
- 475
1
vote
1
answer
588
views
Migrating from Heimdal to MIT Kerberos
Does anyone know of any existing documentation, HOWTO, SE question, or even a blog post that shows an example Kerberos database migration from Heimdal to MIT KDCs? Has anyone done this operation ...
- 240
2
votes
1
answer
2k
views
Globally disable reverse DNS lookup for Kerberos on Windows?
I know one can disable the reverse DNS lookup made by individual client applications when calculating SPN of the called server during Kerberos authentication. There are various ways, e. g.:
In Java: ...
- 159
3
votes
2
answers
5k
views
Why the reverse DNS lookup of SPN during initial phase of Kerberos authentication?
At its base, Kerberos isn't an overly complicated protocol. I have also already successfully configured a server to accept Kerberos authentications via SPNEGO HTTP headers. I'm new in this area though,...
- 159
5
votes
1
answer
7k
views
How to set Openssh and Mit kerberos (from windows to linux server)?
I need to connect through openssh from windows to a linux server using a kerberos ticket.
I got the bin file from:
https://github.com/NoMoreFood/openssh-portable/releases/tag/v7.9-sspi
Through my ...
- 101
0
votes
1
answer
265
views
SSSD Based on KDC and OpenLDAP?
I've installed a MIT KDC instance backed by an OpenLDAP instance, all running on RHEL 7. I'm wanting to configure SSSD to pull users and groups from this combination, but I'm running into a lot of ...
- 153
1
vote
1
answer
890
views
Can not start sshd service: relocation error
After updating openssh version from 5.3 to 7.9 I am having problems when I try to start sshd service,
The script that I executed is:
rpm -Uvh openssh-latest-7.9p1-1.el6.cgsl7741.x86_64.rpm --...
- 39
2
votes
2
answers
5k
views
Kerberos KDC server in a docker container
I'm running a MIT Kerberos KDC and Kadmin server instances on a docker container for convenience. Am able to build it and run it without a problem, with only extracting important configs do a docker ...
- 133
1
vote
1
answer
3k
views
Windows kinit kerberos connection fails with ICMP Port Unreachable
I'm trying to connect to a kerberos server with a keytab:
kinit -k -t securitytest.keytab [email protected]
Exception: ICMP Port Unreachable
java.net.PortUnreachableException: ICMP Port ...
- 183
1
vote
1
answer
2k
views
Cross-Realm-Trust between Active Directory and MIT Kerberos
I am currently in the process of extending my development environment, which used to only run Linux servers so far, by adding machines running Windows Server 2016. The authentication process is ...
1
vote
0
answers
2k
views
Kerberos keytab for NFS doesn't work if not created in server
I'm trying to mount a directory into a client server using kerberos authentication.
If I create a keytab file using using kadmin in the server, I cannot get authenticated when I mount the directory.
...
- 123
0
votes
2
answers
1k
views
What does it mean to "add" a principal to a keytab file in Kerberos?
In this documentatation they mention that you can use the ktadd command that "add a principal to an existing keytab". Does adding a principal mean that the principal now has access to that host (in ...
- 123
2
votes
1
answer
4k
views
Kerberos ticket cache location on windows for multiple users
I am using multiple odbc drivers connecting to hive and impala, and most of the documentation states that the kerberos ticket location should be defined by a environment variable KRB5CCNAME, such as C:...
- 23
0
votes
1
answer
413
views
Using same password for kerberos and openldap
We have a working structure for our hadop where openldap was used for authentication with below structure,along with ranger and knox.
openldap root:-
dn: dc=abchadoop,dc=com,dc=za
Subtree inside ...
- 101
0
votes
1
answer
866
views
Why both userPassword and krbPrincipalKey
When configuring MIT Kerberos to use an LDAP database instead of DB2, I was surprised to see that user password hashes are stored in two different fields: userPassword and krbPrincipalKey. Seems the ...
- 430
0
votes
1
answer
1k
views
Kerberos Authentication in a Mixed (Windows and LINUX) Environment
I need to map the Service principal name for the user in an Active Directory from Linux environment, where my KDC is located, to Windows.
Is there a way to map the AD user from Linux rather than ...
- 101
0
votes
1
answer
209
views
What is the purpose of the 'keyblock' part of the Kerberos credential cache
The documentation of MIT Kerberos explains here how the credential cache file is formatted. It basically consists of:
a header
information about the REALM and the user
a keyblock
information about ...
- 357
4
votes
2
answers
1k
views
Use cases for kerberos credential cache type MEMORY?
One of the credential cache types offered by MIT Kerberos is MEMORY. According to the documentation it is used by kadmin.
MEMORY caches are for storage of credentials that don’t need to be made ...
- 365
6
votes
1
answer
9k
views
How to force kerberos to use in memory credential cache?
MIT Kerberos supports multiple types of credential cache to store tickets
.
For example, if I want to use a persistent keyring per-user in kernel memory I can add the following to krb5.conf.
[...
- 365
6
votes
3
answers
12k
views
MIT Kerberos keeps asking for password when authenticating to OpenSSH
I am trying to setup a simple Kerberos environment which consists of a Kerberos server (KDC), a client machine and a server machine running an OpenSSH daemon. The client is supposed to be ...
- 357
3
votes
1
answer
4k
views
How to change ccache type of MIT Kerberos
The MIT Kerberos Documentation lists seven different ways to store Kerberos credentials:
API
DIR
FILE
KCM
KEYRING
MEMORY
MSLSA
At the moment my Kerberos setup is storing credentials in a file in the ...
- 357
2
votes
1
answer
2k
views
Which servers to copy keytab file to
I am trying to setup a simple Kerberos environment in which a client server authenticates to a webservice (in my case OpenSSH) via a Kerberos server.
I generated a keytab file on the KDC but am not ...
- 357
3
votes
0
answers
2k
views
How can I test network connectivity to a Keberos KDC (UDP/88)
How can I test network connectivity to a Keberos KDC (UDP/88)? Does Kerberos have a standard way to communicate that gives any output?
HTTP for example,
nc -v google.com 80
GET
will dump the ...
- 8,006
2
votes
1
answer
7k
views
Apache Kerberos Authentication : KDC has no support for encryption type
I post a new thread on this problem because all the solution I found here didn't work for me.
I'm trying to configure an apache2 to authenticate with Kerberos on a AD2012 server via a keytab.
First I ...
- 161
3
votes
0
answers
1k
views
Is section logging in krb5.conf works on the kerberos client?
Client /etc/krb5.conf:
...
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
...
Kerberos client worked, but log files are ...
- 31
1
vote
0
answers
54
views
Is it possible to make the Kerberos Server use LDAP for just the crendential validation, and use a local Keberos Principal DB for everything else?
We are working with a LDAP setup that we can not change or extend. We need to add a Kerberos Server to the environment.
Is it possible to make the Kerberos Server use LDAP for just the crendential ...
- 438
1
vote
0
answers
2k
views
Kerberos kdc is unable to bind to ldap
I am following this guide to setup Kerberos with LDAP. I have followed all the steps. But when I am running kadmin.local it exits with following error:
Authenticating as principal root/admin@EXAMPLE....
- 11
1
vote
1
answer
359
views
Is it possible to change an MIT Kerberos password programmatically?
First of all, I'm not an infrastructure guy, I'm a developer, so please excuse me if I'm leaving important information out. I just need to determine if the following is possible, and if so, how to ...
- 111
3
votes
3
answers
16k
views
Kerberos error while initializing kadmin interface from admin server
I updated my master key for my Kerberos 5 server following the MIT Kerberos 5 instructions. I restarted the kdc and kadmind services and used krb5-prop to push the changes to the other servers.
Now I ...
- 163
1
vote
0
answers
73
views
Kerberos cross realm authentication for kadmin
We have set up cross realm authentication using MIT Kerberos, it's quite straightforward if you adhere to the docs. But we are missing one feature: We'd like to be able to authenticate to the kadmind ...
- 31
0
votes
1
answer
1k
views
nslcd and kerberos without Reverse DNS
I am trying to get nslcd to connect with an ldap instance using GSSAPI and kerberos authentication. Problem i'm having is that nslcd keeps using the wrong principal to try and connected with the ...
0
votes
1
answer
138
views
Kerberos Bootstrap error with ldap
Up until recently I have had no issues deploying Kerberos with an LDAP backend for the database. Recently however I have started to get this error when trying to generate the password stash file ...
1
vote
0
answers
672
views
kinit unable to connect
I'm trying to connect to a Kerberos running on ApacheDS. Here is the initial LDIF I've loaded on LDAP:
dn: ou=Users,dc=example,dc=com
ou: Users
description: Example.Com Users
objectClass: ...
0
votes
0
answers
19
views
What changes with Kerberos Authentication in IPv6 when using NAT? [duplicate]
How should Kerberos Authentication be setup with IPv6?
Of you're using NAT for IPv6 where there is a single public IPv6 address and it translates to the machines inside in the ULA range?
- 4,919
0
votes
1
answer
793
views
What changes with Kerberos authentication in IPv6 when everyone has a public IPv6 Address?
How should Kerberos authentication be set up with IPv6?
What implications are there when client devices each use a public, globally routeable IPv6 IP address?
What changes when setup this way ...
- 4,919
5
votes
1
answer
4k
views
Windows - Kerberos SSO from outside the domain
I've tried to figure it out myself, but to no avail. Google offers many tutorials but I couldn't find any for the below case.
We have an external cooperating employee with VPN access to our LAN and ...
- 2,183
13
votes
2
answers
29k
views
Automatic Kerberos Ticket Renewal (Indefinitely)
I am currently switching our environment from NIS over to Kerberos + LDAP.
During this migration I've now run into the following situation.
We mount our homes via NFS which obviously should also be ...
- 326
0
votes
1
answer
946
views
psql: duplicate GSS authentication request
What does it mean by saying 'duplicate' ? How to troubleshoot this?
guest@www:~$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: user/admin@SOHONET
Valid starting Expires ...
1
vote
1
answer
2k
views
GSSAPI on Linux when reverse DNS lookup doesn't match AD DNS suffix
I have CentOS 6 server that has been joined to Active Directory using Samba and net ads join -k.
It thus has a keytab like this:
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- ---------------...
