13
votes
Automatic Kerberos Ticket Renewal (Indefinitely)
It's the end of 2018 and I've run into the same question as you. After some digging, I can offer a write-up for posteriority.
tl; dr:
"Infinite renewal" not possible and probably never will be
SSSD ...
- 231
6
votes
Accepted
Kerberos error while initializing kadmin interface from admin server
I've run into the same problem (same Debian and krb5-admin-server versions).
The same as you, it wasn't working when I ran kadmin from the kerberos admin server itself, which rules out time ...
- 76
6
votes
Accepted
MIT Kerberos keeps asking for password when authenticating to OpenSSH
Root login
Judging from your supplied log files I would say that the attempted root login is not your issue here. Notice that all of the authentication attempts as root come from 218.65.30.30, a ...
- 365
3
votes
Accepted
Kerberos rdns=false Breaking Connections From Linux Clients to Windows IIS Server
But isn't this error coming from the IIS webserver?
No, it's coming from the GSSAPI library (libkrb5) used by curl.
Why does a client's configuration setting impact the webserver's functionality? ie-...
- 9,703
3
votes
Accepted
How to force kerberos to use in memory credential cache?
As explained in the linked document, the memory cache is using MEMORY keyword so the following should do the job:
default_ccache_name = MEMORY:
But note that this type of ccache will be destroyed ...
- 9,535
3
votes
apache kerberos authentication tickets are not visible under klist
[Kerberos authentication] is working fine. It is asking the password and logging into the website.
Your Apache server is probably configured to allow some form of fall-back authentication when no ...
- 75k
3
votes
How to set Openssh and Mit kerberos (from windows to linux server)?
I'm adding a late answer since this is question is still one of the top google results for connecting to an OpenSSH SSH / SFTP / SCP server via kerberos.
The short answer is try ssh -K MyServer, and ...
- 307
3
votes
Is it possible to change an MIT Kerberos password programmatically?
When a user changes their Active Directory password, I would like to sync it back into MIT Kerberos.
In its current form, this is too vague of a statement for it to really be answered in one shot.
...
- 55.3k
2
votes
Accepted
apache kerberos authentication tickets are not visible under klist
When KrbMethodNegotiate fails because you don't have a valid (in your case any) ticket, Apache fails back to KrbMethodK5Passwd, which is on by default.
This is the expected behavior with your ...
- 12.8k
2
votes
Accepted
What changes with Kerberos authentication in IPv6 when everyone has a public IPv6 Address?
The same way as with IPv4, but with AAAA records instead of A records. Use IP6.ARPA instead of in-addr.arpa if rDNS is part of your setup.
If you were port forwarding before, you don't have to do ...
- 12.8k
2
votes
Accepted
How to change ccache type of MIT Kerberos
You'll want to alter the KRB5CCACHE environmental variable.
Usually you'll do this for all instances in krb5.conf as follows:
[libdefaults]
default_ccache_name = KEYRING:persistent:%{uid}
However, ...
- 12.8k
2
votes
Kerberos ticket cache location on windows for multiple users
A ~ tilde occurring as the first character of an argument in Unix/Linux shell/bash is the same as the $HOME environment variable. Windows equivalent is %USERPROFILE%.
You can use any user variable ...
- 1,534
2
votes
Using same password for kerberos and openldap
Convention has is that a Kerberos realm will be the same as the domain, but capitalized. This is not a requirement, but it does help to avoid some confusion.
A kerberos principal can only have one ...
- 12.8k
2
votes
Accepted
Use cases for kerberos credential cache type MEMORY?
The answer to this question is exactly what was postulated in the comments. From your code you can include the krb5.h header. This will give you access to the functions that make up the Kerberos code ...
- 365
2
votes
Why the reverse DNS lookup of SPN during initial phase of Kerberos authentication?
I've always assumed it's to break CNAMES.
- 141
1
vote
Putting .k5login credentials in ldap with freeipa
It is not implemented anywhere, thus not available. However, I'd recommend against using this approach. Aside from convenience you would be losing audit of the actions performed. Going with sudo rules ...
- 1,075
1
vote
Accepted
ubuntu ignores default_ccache_name
always defaults to FILE:/tmp/krb5cc_<UID>_<VALUE>
If KRB5CCNAME points to a cache with a random suffix, this indicates that some software has decided to explicitly set up an isolated ...
- 9,703
1
vote
Accepted
MIT Kerberos renew lifetime does not work
The solution:
there are 4 settings (5 to be exact but the 5th is the kinit -r TIME parameter itself) where the minimum of all is taken:
krb5.conf: REALM = { max_renewable_life = 7d }
kdc.conf: REALM ...
- 11
1
vote
Accepted
Single sign on using SSSD against OpenLDAP server with Kerberos SASL/GSSAPI
Abstract
After some tries and error I found that I need one package for gssapi and four packages for sssd. I want to have general configuration centralized so I use a local private dns server for name-...
- 406
1
vote
Migrating from Heimdal to MIT Kerberos
Here's what I have so far:
Dump the Heimdal database. According to the old Heimdal docs, it should be possible to simply dump the db in MIT format using kadmin -l dump -f MIT. But the build of ...
- 240
1
vote
Kerberos KDC server in a docker container
You should check the config file, kdc.conf. That will tell you where the files are stored that are being used.
exec into the container when it's running and find the kdc.conf file. Also the krb5....
- 141
1
vote
Kerberos KDC server in a docker container
Isn't just enough to mount the volume to the container's default KDC database path like docker run -v /var/local/docker-volumes/krb5kdc:/usr/local/var/krb5kdc <kdc_image>? Or you can specify ...
- 692
1
vote
Cross-Realm-Trust between Active Directory and MIT Kerberos
Fair warning, my knowledge in this area is extremely dated at this point. Like early 2000's, Windows 2003 era Active Directory. So things may work differently now.
The main problem is that Windows ...
- 16.7k
1
vote
Accepted
What does it mean to "add" a principal to a keytab file in Kerberos?
A key table (keytab) file contains pairs of Kerberos principal identities and a corresponding encrypted key for that principal. It is as good as a password (and should be secured as such), and can be ...
- 1,640
1
vote
MIT Kerberos keeps asking for password when authenticating to OpenSSH
There are several things to consider:
1. Can you get the service ticket on your client machine?
Verify that you can get the ticket for the service you want to use. For SSH this is usually host/@...
- 2,710
1
vote
Accepted
Which servers to copy keytab file to
in a normal situation, the keytab file you created (usually, using a service account principal (or instance), for example ssh/hostname) should be placed on the "client" of that kerberos service.
and ...
- 524
1
vote
Accepted
Apache Kerberos Authentication : KDC has no support for encryption type
It was indeed due to the activation of the DES support in AD. This actually override any other cipher algorithms.
So disabling it on the service account made the negociation works in AES256.
- 161
1
vote
Kerberos error while initializing kadmin interface from admin server
Check that you have opened kdc ports on the server (749 by default, both tcp and udp) and that the client can connect to it. This was the problem for me that resulted in kadmin: Communication failure ...
- 151
1
vote
Windows - Kerberos SSO from outside the domain
I recently got KERBEROS working from a VPN-connected workstation that's not joined to the domain (an AWS-managed Server 2008R2 Active Directory).
The key was adding the SRV and corresponding A records ...
- 111
Only top scored, non community-wiki answers of a minimum length are eligible