Kerberos is a network authentication system based on shared key cryptography. It is the underlying authentication system used by current versions of Active Directory and is widely used by large organizations.

learn more… | top users | synonyms

0
votes
0answers
42 views

Adding CentOS 7 to Active Directory

I am having a hard time adding a CentOS 7 machine to my domain (Active Directory 2012 running in Windows 2008 mode). I am using realmd to join the machine to the domain. Here is what I have checked so ...
0
votes
1answer
22 views

OS X Directory Services

I have been reading from Advanced Programming in the UNIX environment (Stevenson and Rago), and I am currently reading about how user data is stored on various systems, including Linux, FreeBSD, and ...
1
vote
1answer
24 views

How can I run unattended processes as authenticated AD/LDAP users?

I'm switching some servers over to Debian 8 and using realmd for Active Directory (LDAP/Kerberos) authentication. This has been working great and allows Domain Users to login to my server, etc. ...
1
vote
1answer
67 views

Allow username input sddm (LDAP/Kerberos)

The overarching question: How can I enable SDDM to accept username input in Debian? Underlying/implicit questions: How does SDDM recognize users? What is the Debian alternative to ...
0
votes
0answers
16 views

Can't add any principals in Kerberos

I recently botched a Kerberos install and have been trying to follow the walkthrough here. However, now I've reached an awkward impasse and cannot add any principals. Using kadmin.local I receive ...
0
votes
1answer
28 views

How do I disable Kereberos preauthentication?

I'm seeing this error message: NEEDED_PREAUTH: admin@THIS.LAN for for kadmin/admin@THIS.LAN, Additional pre-authentication required How do I disable Kerberos pre-authentication? The server and ...
0
votes
1answer
21 views

Kerberos/LDAP login fails - remove Preauth?

Using a Debian system with a Kerberos/LDAP client - login fails on KDE as a user directory isn't being created. SSH is successful (and no directory is created); however, desktop login isn't. I've ...
1
vote
0answers
16 views

Where are AFS tokens stored, and how do I get them into running Screen session

I have the following situation, I have a running GNU screen session where I can't access AFS anymore - my token has expired. I can however access it from a new shell. The difference to this question ...
0
votes
1answer
57 views

Troubleshooting GSS-API error on one client authenticating to Kerberos

When authenticating to kadmin with one client of many, it fails with kadmin: GSS-API (or Kerberos) error while initializing kadmin interface. The Kerberos host is specified with its subnet ...
2
votes
1answer
46 views

How can I use different kerberos principals for sudo than for system-auth?

At my organization, we're required to use different kerberos principals when authenticating for sudo than for other types of auth, such as logging in. For instance, my regular (login) principal might ...
0
votes
1answer
77 views

Why is my kerberos ticket not working?

I'm trying to ssh to another machine but my kinit is not working: $ ssh nik@social-1-r.referens.sys.XXXXXXX.se Permission denied (publickey,gssapi-keyex,gssapi-with-mic). Kerberos is used for ...
0
votes
2answers
45 views

How can I install kerberised services on debian?

I installed kerberos in my debian environment and made it work with SSH. I also would like to try it with other services but I could not install them on debian. I followed several tutorials e.g. ...
0
votes
0answers
136 views

RSAT : Samba 4 Server not operational

Samba 4 now supports GPO and management through the Active Directory Windows console. But, when I open it after installation, I cannot access the server nor the domain. The message returned is that ...
0
votes
1answer
45 views

oddjob_mkhomedir doesn't run when logging in via SSH with Kerberos

I currently have a server which has Kerberos/SSSD/Samba to authenticate to Windows 2012 AD. In /etc/pam.d/system-auth oddjob_mkhomedir is set as below: session optional ...
1
vote
1answer
39 views

Not permitted to access my files on $HOME in tmux after log out and log in

My $HOME on a server is in a Andrew file system, and the server runs kerberos. I created a tmux session, wherein I ran a shell process. Then I detached it, and logged out, and after a while logged ...
1
vote
1answer
21 views

permission for accessing files are denied and some sessions are killed

I ssh to a Linux server which runs kerberos. This is the first time I met Kerberos. After some time of being idle or loging out and loging in, I found some strange things, which I am not sure if are ...
1
vote
1answer
115 views

Kerberos Join Active Directory Failure

I try to join Active Directory and Samba 4 in Ubuntu 12.04.05. When I run host -t SRV _kerberos._udp.test.sg I get the error: Host _kerberos._udp.test.sg not found: 3(NXDOMAIN) meanwhile $# host ...
0
votes
0answers
33 views

Automatically creating windows shares when logging on to CentOS7

I am in charge of researching the suitability of deploying CentOS 6 or 7 to around 200-400 macs in a triple boot (OSX,Win7,CentOS 6or7) configuration. We currently dual boot Win7 & OSX using ...
0
votes
0answers
201 views

Why do I get a “preauth required” error when I set “require-preauth = false” in krb5.conf?

On an OS X machine, I'm trying to get a kerb ticket on my organization's kerberos realm. I grabbed a copy of krb5.conf from a Linux machine to make sure my kerberos configuration was correct. I tried ...
1
vote
0answers
112 views

Utilizing Samba Shares Without using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
1
vote
0answers
58 views

kerberos : kinit not picking up updated values in krb5.conf

We are running kinit from our Linux command line and this works well. Before we run kinit we set the KRB5_CONFIG environment variable to point to directory continaing krb5.conf file linuxhost1$ ...
1
vote
1answer
437 views

Can't Login to Debian 7.7 with Kerberos/NIS user

I have a Debian 7.7 system I am trying to configure to use Kerberos and NIS, both served from an Active Directory server. I have kerberos set up such that I can kinit a set of credentials from the AD ...
1
vote
1answer
99 views

What role does krb5.conf actually play when joining a Linux machine to AD via Samba/winbind?

I'm working on a project for a standardized Linux image for our organization. This image will be domain joined, and I've written a script to fire on boot that will guide the IST person doing the ...
2
votes
3answers
1k views

Kerberos error after ArchLinux installation

I've installed ArchLinux successfully on my laptop yesterday. To do this, I've followed the Beginner's guide along with the Raid guide. I could do every step without problem, except the one for the ...
0
votes
1answer
192 views

How to automate ktutil to immediately list keytab entries?

I use MIT ktutil a lot on Linux and I am fed up using the following sequence, even if command shortcuts and file name completion are here to help: ktutil rkt my.keytab l Isn't there a way to get ...
3
votes
0answers
189 views

Kerberos Forwarding in SSSD

So, I'm trying to set up forwarding with Kerberos and seem to have some problems. On some of my servers I'm able to forward after receiving a ticket; however, some I'm not. My system setup is a ...
8
votes
1answer
102 views

List Kerberos principals with valid TGTs

Is it possible to query my (MIT) Kerberos KDC to return a list of principals who have been issued TGTs that are currently valid? My use case is that I would like to find out which users are currently ...
2
votes
1answer
354 views

Understanding Kerberized NFSv4 Authorization

Articles such as this one seem to point out that Kerberizing NFS(v4) mounts not only prevents machines without a Kerberos service ticket from mounting the shared directory but also uses the user's ...
2
votes
2answers
1k views

How would I build a linux based router?

I am looking into building a Linux based router out of a home-built Linux server. I don't have much experience with the software required however. I would like the server to run the following ...
7
votes
1answer
348 views

Kerberos authentication fails with forced password change

I have configured PAM authentication to use Kerberos and can authenticate correctly with my principals using their Kerberos credentials. I ran into trouble when I tried to create a principal with an ...
4
votes
1answer
1k views

Get a Kerberos service ticket from the command line

I am in the process of debugging a Kerberos setup. I have a valid krb5.conf and I can call kinit USERNAME to get a Ticket Granting Ticket (TGT): Credentials cache: /root/krb5cc_root Default ...
2
votes
1answer
236 views

Integrating LDAP and Kerberos V to add users via a useradd-like interface

I'm currently trying to set up an integrated Kerberos V/LDAP system for authentication/authorization. From what I have managed to gather, there are at least two ways to integrate Kerberos V with LDAP: ...
1
vote
0answers
969 views

How to set up Active Directory authentication on CentOS 6.5?

I have: 1. A CentOS machine to which I have SSH and STFP access. 2. The machine is on network where there is a MS SQL Server database and Windows shared drives. 3. All authentication seems to be with ...
1
vote
1answer
887 views

Apache mod_auth_kerb: “Key table entry not found”

I want to use the Apache Module "mod_auth_kerb" to implement SSO for a Webapplication. With the following config: <VirtualHost 10.5.3.200:443> #Proxy <Proxy *> Order deny,allow Allow ...
1
vote
1answer
196 views

Is it possible to attach `kinit` to the first attempt to `ssh` without a Kerberos ticket?

My university uses Kerberos-based authentication for login to our unix servers. One way to get passwordless login is to run kinit, type my password, and then run ssh@host. For this setup, I do the ...
1
vote
0answers
280 views

How is a username determined and can I hide the domain component in a winbind username?

Someone asked a question on Server Fault about a problem which I'm also having but no one has answered it so I'm posing a slightly different question to try and figure it out myself. I've configured ...
4
votes
2answers
3k views

How could I eliminate Kerberos for passwd?

When I issue a command to change my password like this: sudo passwd huahsin The system prompt me: Current Kerberos password: I don't know what I have done to the system configuration, how could I ...
1
vote
1answer
275 views

kdb5_ldap_util fails with cryptic error

Supposedly, in order to set up Kerberos, I need to run kdb5_ldap_util, though I'm not sure why. However, it fails with: # kdb5_ldap_util -D cn=admin,dc=example,dc=com create -subtrees ...
1
vote
1answer
1k views

How does Linux winbindd determine available domain controller?

We are actually in preparation of taking down one of our three domain controller (Win2k3). They are all serving the same domain. Actually we still see connections incoming from Debian (5/6/7) Servers ...
1
vote
0answers
80 views

How to obtain current user environment in pam_script?

I'm running pam_script after pam_krb5 with a session open script. In my script, I need to use the ticket cache generated by krb5 to do something. Well, the script was actually run as root, and ...
1
vote
0answers
99 views

How do I setup kerberos authetication in Fedora 19

I cannnot seem to find documentation on setting up Kerberos authentication on my Fedora 19 workstation. Which files and programs are involved? My Kerberos server is a corporate AD.
0
votes
2answers
19k views

SSH authentication using gssapi-keyex or gssapi-with-mic (publickey not permitted)

My company has disabled SSH public key authentication, therefore I have to manually enter each time my password (I am not suppose to change /etc/ssh/sshd_config). However gssapi-keyex and ...
1
vote
0answers
400 views

tmp/krb5cc_[uid] is not getting purged regularly (kerberos credentials cache)

An ftp id wasn't able to authenticate itself using kerberos because it wasn't able to create /tmp/krb5cc_[uid]. This was caused because /tmp ran out of inode space, as there were innumerbale (don't ...
1
vote
1answer
132 views

kinit returns error salt type 3 unsupported on FreeBSD 9.1-RELEASE install

When attempting to run kinit to log into a Kerberos V5 realm I get the following error on a default install FreeBSD 9.1-RELEASE kinit: krb5_get_init_creds: salt type 3 not supported Any ideas?
2
votes
4answers
2k views

What is the kerberos keytab file used for in UNIX/AD kerberos authentication?

I have proved that UNIX/AD Kerberos authentication works without the presence of a keytab file so I'd like to know whether I should worry about it (given I'll need an individual keytab for each server ...
3
votes
1answer
581 views

Multiple PCs network centralized system authentication

(I couldn't really choose an accurate title as I don't know exactly what the feature I'm looking for is called. Sorry about that. I hope that the following lines may clear this aspect.) I own a dozen ...
4
votes
1answer
1k views

Keep kerberos ticket across sudo invocation

On a regular linux machine, when I use sudo -s as a normal user, I become root but HOME still points to ~user, so every admin has his own environment etc. (this is without env_reset or always_set_home ...
1
vote
2answers
368 views

Command-line web browser with Kerberos authentication?

QUESTION: Is there a Kerberos-friendly web browser usable via an SSH console? I have tried links but it does not seem to work with Kerberos (the webapp asks me for login/password even though I have a ...
5
votes
1answer
832 views

Public Key Auth + Kerberos

I've setup public key authentication for ssh'ing into my university machine. However, it only logs me in on the local machine and doesn't give me Kerberos credentials which I need for accessing my ...
1
vote
1answer
459 views

PostgreSQL on FreeBSD - 'Kerberos 5 authentication not supported'

I've been trying to get a FreeBSD machine to talk to a networked postgreSQL database. I assumed that the machine had kerberos installed, as it's what I use to log in, and I was told that FreeBSD has ...