Questions tagged [mitkerberos]
MIT implementation of Kerberos (https://web.mit.edu/kerberos/)
26
questions with no upvoted or accepted answers
5
votes
1
answer
8k
views
Cross-Realm trust verify failed with 'netdom' command
Question 1:
Am having my ActiveDirectory in Windowsserver 2012 machine - its domain name is AD-DEMO.LOCAL
Kerberos admin-server is in another Ubuntu machine - its realm KERBEROS.COM
Added trust in '...
- 163
3
votes
0
answers
2k
views
How can I test network connectivity to a Keberos KDC (UDP/88)
How can I test network connectivity to a Keberos KDC (UDP/88)? Does Kerberos have a standard way to communicate that gives any output?
HTTP for example,
nc -v google.com 80
GET
will dump the ...
- 8,006
3
votes
0
answers
1k
views
Is section logging in krb5.conf works on the kerberos client?
Client /etc/krb5.conf:
...
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
...
Kerberos client worked, but log files are ...
- 31
1
vote
0
answers
2k
views
Kerberos keytab for NFS doesn't work if not created in server
I'm trying to mount a directory into a client server using kerberos authentication.
If I create a keytab file using using kadmin in the server, I cannot get authenticated when I mount the directory.
...
- 123
1
vote
0
answers
54
views
Is it possible to make the Kerberos Server use LDAP for just the crendential validation, and use a local Keberos Principal DB for everything else?
We are working with a LDAP setup that we can not change or extend. We need to add a Kerberos Server to the environment.
Is it possible to make the Kerberos Server use LDAP for just the crendential ...
- 438
1
vote
0
answers
2k
views
Kerberos kdc is unable to bind to ldap
I am following this guide to setup Kerberos with LDAP. I have followed all the steps. But when I am running kadmin.local it exits with following error:
Authenticating as principal root/admin@EXAMPLE....
- 11
1
vote
0
answers
74
views
Kerberos cross realm authentication for kadmin
We have set up cross realm authentication using MIT Kerberos, it's quite straightforward if you adhere to the docs. But we are missing one feature: We'd like to be able to authenticate to the kadmind ...
- 31
1
vote
0
answers
674
views
kinit unable to connect
I'm trying to connect to a Kerberos running on ApacheDS. Here is the initial LDIF I've loaded on LDAP:
dn: ou=Users,dc=example,dc=com
ou: Users
description: Example.Com Users
objectClass: ...
1
vote
1
answer
2k
views
GSSAPI on Linux when reverse DNS lookup doesn't match AD DNS suffix
I have CentOS 6 server that has been joined to Active Directory using Samba and net ads join -k.
It thus has a keytab like this:
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- ---------------...
1
vote
0
answers
526
views
FreeRadius-GoogleAuthenticator-Kerberos Password Change Weirdness
We are using FreeRadius, Kerberos and Google Authenticator to implement two-factor authentication. The two factor auth works fine, both from radtest and from a Watchguard firewall. To log in, a user ...
- 11
1
vote
0
answers
776
views
Why does MIT Kerberos kinit warn "Your passwod will expire" when your principal is what is about to expire?
While doing some experimenting I noticed that the MIT Kerberos version 5 "kinit" program will warn you when either your password is about to expire (within 7 days) or when your principal is about to ...
- 430
1
vote
0
answers
827
views
Alfresco with Kerberos: Error creating bean with name globalAuthenticationFilter
I configured Alfresco 4.2.c to work with MIT Kerberos, following the documentation.
Because the documentation is only for Active Directory, I adapted some part to Kerberos by reading the forum.
Upon ...
- 1,374
1
vote
1
answer
3k
views
Windows kinit kerberos connection fails with ICMP Port Unreachable
I'm trying to connect to a kerberos server with a keytab:
kinit -k -t securitytest.keytab [email protected]
Exception: ICMP Port Unreachable
java.net.PortUnreachableException: ICMP Port ...
- 183
0
votes
0
answers
43
views
Wrong ouput with kinit, kadmin, klist
I am unable to use the kadmin command after entering the password. list_principals, and klist returns the output "true" without information about the ticket.
Where is the information about ...
- 9
0
votes
0
answers
185
views
NFSv4 with Kerberos takes a long time to mount
I have an NFS server with Kerberos authentication (Debian 11). If I want to mount a share on a client for the first time after a restart, this takes 10-12 seconds. If I then mount another share from ...
- 1
0
votes
1
answer
253
views
Ubuntu 21.10 with Samba AD unable to create domain trust account
I am trying to add domain trust account for additional kerberos5 (MIT) domain
in Samba AD DC with command:
net rpc trustdom add <domain_name>
-UAdministrator%<administrator_password>
What ...
0
votes
1
answer
746
views
Apple client unable to login with LDAP backend and GSSAPI or PLAIN
I have a OpenLDAP server with Kerberos5 for authentication and on Linux/Unix/Windows environments I am able to login without a problem.
The LDAP server is configured to use GSSAPI or PLAIN that passes ...
0
votes
2
answers
614
views
Set network.auth.use-sspi in Firefox with Group Policy
I have downloaded the Group Policy templates and copied them to the appropriate location.
In gpedit.msc I have set:
Computer Configuration > Administrative Templates > Mozilla > Firefox > ...
- 1
0
votes
1
answer
266
views
SSSD Based on KDC and OpenLDAP?
I've installed a MIT KDC instance backed by an OpenLDAP instance, all running on RHEL 7. I'm wanting to configure SSSD to pull users and groups from this combination, but I'm running into a lot of ...
- 153
0
votes
1
answer
870
views
Why both userPassword and krbPrincipalKey
When configuring MIT Kerberos to use an LDAP database instead of DB2, I was surprised to see that user password hashes are stored in two different fields: userPassword and krbPrincipalKey. Seems the ...
- 430
0
votes
1
answer
1k
views
Kerberos Authentication in a Mixed (Windows and LINUX) Environment
I need to map the Service principal name for the user in an Active Directory from Linux environment, where my KDC is located, to Windows.
Is there a way to map the AD user from Linux rather than ...
- 101
0
votes
1
answer
1k
views
nslcd and kerberos without Reverse DNS
I am trying to get nslcd to connect with an ldap instance using GSSAPI and kerberos authentication. Problem i'm having is that nslcd keeps using the wrong principal to try and connected with the ...
0
votes
1
answer
138
views
Kerberos Bootstrap error with ldap
Up until recently I have had no issues deploying Kerberos with an LDAP backend for the database. Recently however I have started to get this error when trying to generate the password stash file ...
0
votes
1
answer
947
views
psql: duplicate GSS authentication request
What does it mean by saying 'duplicate' ? How to troubleshoot this?
guest@www:~$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: user/admin@SOHONET
Valid starting Expires ...
0
votes
1
answer
447
views
Slave Kerberos behind NAT - kprop fails: Incorrect net address while decoding database size from client
I want to synchronize MIT Kerberos database from master to slave, which is in a different geographical location. kprop synchronization fails because of a NAT. Is there any solution to have kprop ...
- 347
0
votes
0
answers
638
views
Establish FAST encrypted channel between linux client and windows server
I am trying to setup windows server for FAST encrypted channel support to test OTP pre authentication in kerberos.
I have already tested on linux machine by deploying KDC using krb5-1.12.1 source ...
