Kerberos is a network authentication system based on shared key cryptography. It is the underlying authentication system used by current versions of Active Directory and is widely used by large organizations.

learn more… | top users | synonyms

1
vote
2answers
1k views

Failed to join domain: failed to set machine kerberos encryption types: Insufficient access

Has anyone gotten this error when trying to join CentOS 7 to Active Directory? I tried various ways(via cli, gui, tui) and always get same error. Failed to join domain: failed to set machine kerberos ...
0
votes
1answer
33 views

OS X Directory Services

I have been reading from Advanced Programming in the UNIX environment (Stevenson and Rago), and I am currently reading about how user data is stored on various systems, including Linux, FreeBSD, and ...
0
votes
1answer
20 views

Kerberos in Ubuntu system

I would build a kerberos authentication system on Ubuntu based machines. I'm making it for a school project. So i have some questions: 1)What do i need to make client-KDC-server? Do i need a domain ...
1
vote
0answers
88 views

CentOS 6.8 + Samba4 + Kerberos: No credentials cache found

I am trying to release a server using ‍‍CentOS 6.8 + Samba4 (Winbind - LDAP + Kerberos) + NSS. I was able to join the domain, but I still getting this warning/error message: [root@snfs2 ~]# net ads ...
1
vote
1answer
2k views

Apache mod_auth_kerb: “Key table entry not found”

I want to use the Apache Module "mod_auth_kerb" to implement SSO for a Webapplication. With the following config: <VirtualHost 10.5.3.200:443> #Proxy <Proxy *> Order deny,allow Allow ...
0
votes
0answers
24 views

Nautilus/gfvs: Cannot mount cifs shares using only krb5 ticket

we are planning to upgrade our Ubuntu 12.04 clients to Ubuntu 16.04. With Ubuntu 12.04 we are able to mount a cifs share using a krb5 ticket, without providing any username or password. Whenever I ...
3
votes
0answers
38 views

Tomcat, sql, kerberos, oh my!

I am working on setting up tomcat 8.0.35 on ubuntu 16.04 with Oracle Java (not openjdk) 1.8.0_91-b14 to use kerberos authentication when authenticating to our Microsoft SQL database. The issue I am ...
1
vote
0answers
40 views

Why do I get “no credentials cache” error when mounting Kerberized NFS share?

I have two systems on a local network, nfsclient (CentOS 7) and nfsserver (CentOS 6). These names correctly resolve to their IP addresses, and Kerberos is working between them (nfsserver is the KDC). ...
1
vote
1answer
112 views

Can not stop Kerberos on debian 8

I'm trying to install krb5-admin-server and krb5-kdc for a school project, everything is working fine but I can't stop krb5-admin-server nor restart it. Here are the logs I retrieved with cat /var/...
1
vote
1answer
64 views

Can a Linux server that authenticates against an Active Directory accept public/private keys for passwordless login?

I have a Linux server that authenticates users against an Active Directory. Now interactive logins require username and password and automatic login requires a keytab (Kerberos) for passwordless ...
1
vote
1answer
15 views

Generating a keytab for Active Directory user?

I am relatively new to Kerberos, we have integrated Active Directory for authentication. I.E. When we do kinit ad_user, we get a valid TGT. Now I want to run the application as a user in headless ...
2
votes
0answers
573 views

tmp/krb5cc_[uid] is not getting purged regularly (kerberos credentials cache)

A user wasn't able to authenticate using Kerberos because it wasn't able to create /tmp/krb5cc_[uid]. This was because /tmp ran out of inode space, as there were innumerable Kerberos credential cache ...
2
votes
0answers
15 views

How to allow users to register for a single signon account from mit kerberos?

Is there a way to allow users to register for a single sign on account for an mit kerberos server via a web interface of some sort?
2
votes
2answers
523 views

How to automate ktutil to immediately list keytab entries?

I use MIT ktutil a lot on Linux and I am fed up using the following sequence, even if command shortcuts and file name completion are here to help: ktutil rkt my.keytab l Isn't there a way to get ...
3
votes
0answers
101 views

kerberos preauth pkinit failed to initialize: No realms configured correctly for pkinit support

I have successfully installed Kerberos on debian wheezy and can perform service authentication (Apache, ssh) with Kerberos tickets from kinit. I would like to use certificates for kinit (pkinit) ...
3
votes
1answer
78 views

When using an SSH alias, why is SSH ignoring my (valid) Kerberos ticket?

I am successfully connecting to my university's network via ssh with Kerberos ticket authentication. Normal, verbose operation (kinit a ticket, then ssh user@hostname) works fine. The Problem When ...
1
vote
1answer
351 views

Kerberos/Samba can't join Active Directory [DEBIAN 8]

I have an issue when I try to join my domain. I am able to create the kerberos ticket successfully. root@debian:~# kinit Administrateur@ASP.DOMAIN Password for Administrateur@ASP.DOMAIN: root@debian:...
0
votes
0answers
35 views

kerberos: Why sudo command creates a ticket?

I have successfully set up a kerberos (MIT) / OpenLDAP debian server which can authenticate users with kerberos and get SSH access according to OpenLDAP groups. I must mention that as this is a ...
3
votes
1answer
62 views

getent group working, but sshd_config allowgroups does not retrieve appropriate group

I am trying to setup Kerberos MIT authentication with OpenLdap autorisation on Debian Jessie. Authentication part is working great, as I can login to SSH using my kerberos account. I even can create ...
1
vote
1answer
27 views

How can I set kerberos principal in environment automatically on the remote host?

I use both legacy krsh and ssh to login to a variety of boxes for root administration, as do several colleagues of mine. We all keep different history files by use of a variable calculated by running ...
1
vote
2answers
64 views

Renew Kerberos ticket for daemon

Using ISC-DHCPD to renew DHCP leases in an Active Directory domain. This requires using ktutil to generate a keytab for DHCPd to use in order to update secure dynamic DNS. What I need to do is to be ...
1
vote
2answers
182 views

Not permitted to access my files on $HOME in tmux after log out and log in

My $HOME on a server is in a Andrew file system, and the server runs kerberos. I created a tmux session, wherein I ran a shell process. Then I detached it, and logged out, and after a while logged ...
0
votes
0answers
225 views

Issue with mount and kerberos authentication

I am not a sysadmin but a software engineer, but for my current project we need to use kerberos authentication between a linux server and linux client and I am having some issues so I hope you guys ...
0
votes
1answer
55 views

How to keep a long-running process run with Kerberos and Andrew file system?

I am running a bash script on a Scientific Linux server. The script has a loop for copying files and running some programs. The process for running the script probably takes a day or two. But I always ...
-1
votes
2answers
84 views

after power outage no permissions to access samba share from windows machines on the same domain

I am running a ClearCase server on RHEL 6.7. We had a power outage last night (for the life of me I do not know why we don't have damn UPS). At any rate, when the machine was brought back up, we are ...
2
votes
1answer
60 views

Is it possible to have a daemon run a process as another user WITHOUT having a superuser daemon?

I'm working on a project at the moment where I have a daemon that needs to run a process as another user. I would like the daemon to not run as root if possible. However, i'm struggling to figure out ...
3
votes
2answers
738 views

Multiple PCs network centralized system authentication

(I couldn't really choose an accurate title as I don't know exactly what the feature I'm looking for is called. Sorry about that. I hope that the following lines may clear this aspect.) I own a dozen ...
2
votes
1answer
564 views

Kerberos DNS issue with /etc/hosts

Thank you all for your time and attention. Very simply I'm getting this error when invoking kinit to test kerberos authentication against my AD domain (which is hosted on a Server 2012 box). The ...
0
votes
0answers
139 views

Can't add any principals in Kerberos

I recently botched a Kerberos install and have been trying to follow the walkthrough here. However, now I've reached an awkward impasse and cannot add any principals. Using kadmin.local I receive ...
2
votes
1answer
474 views

oddjob_mkhomedir doesn't run when logging in via SSH with Kerberos

I currently have a server which has Kerberos/SSSD/Samba to authenticate to Windows 2012 AD. In /etc/pam.d/system-auth oddjob_mkhomedir is set as below: session optional pam_oddjob_mkhomedir....
1
vote
2answers
36 views

The easiest way to update package above release RHEL

I have to install the krb5-devel package in a version at least 1.12 on a RHEL 6.6. Unfortunately the RHEL 6.6 repositories contains the package in a version 1.10. What would be the easiest way to ...
1
vote
0answers
245 views

realmd join AD and Cross Domain Auth

Small issue with realmd, I use realm join with a kerberos token generated before the join, it's working fine on a simple Active Directory Configuration My issue is when realm join must join a domain ...
0
votes
1answer
189 views

FreeTDS missing encryption support to connect to MS SQL

I'm running a Gentoo Linux and I'm trying to connect to MS SQL via pyodbc using freetds. I enabled the debug log in freetds. Now when I try to connect I'm seeing this: 18:13:00.841828 13523 (net.c:...
0
votes
0answers
45 views

Facing issue while integrating RHEL 6.5 with windows AD

I was integrating my RHEL linux servers with AD. For some servers the integration was completed successfully. For one server I am facing issue,whenever I try to join its showing below error, **[root@...
1
vote
0answers
2k views

Adding CentOS 7 to Active Directory

I am having a hard time adding a CentOS 7 machine to my domain (Active Directory 2012 running in Windows 2008 mode). I am using realmd to join the machine to the domain. Here is what I have checked so ...
1
vote
1answer
833 views

Allow username input sddm (LDAP/Kerberos)

The overarching question: How can I enable SDDM to accept username input in Debian? Underlying/implicit questions: How does SDDM recognize users? What is the Debian alternative to /etc/sddm....
0
votes
1answer
68 views

Kerberos/LDAP login fails - remove Preauth?

Using a Debian system with a Kerberos/LDAP client - login fails on KDE as a user directory isn't being created. SSH is successful (and no directory is created); however, desktop login isn't. I've ...
1
vote
1answer
124 views

How can I run unattended processes as authenticated AD/LDAP users?

I'm switching some servers over to Debian 8 and using realmd for Active Directory (LDAP/Kerberos) authentication. This has been working great and allows Domain Users to login to my server, etc. ...
0
votes
1answer
143 views

Troubleshooting GSS-API error on one client authenticating to Kerberos

When authenticating to kadmin with one client of many, it fails with kadmin: GSS-API (or Kerberos) error while initializing kadmin interface. The Kerberos host is specified with its subnet address....
0
votes
1answer
250 views

How do I disable Kereberos preauthentication?

I'm seeing this error message: NEEDED_PREAUTH: admin@THIS.LAN for for kadmin/admin@THIS.LAN, Additional pre-authentication required How do I disable Kerberos pre-authentication? The server and ...
1
vote
0answers
112 views

Where are AFS tokens stored, and how do I get them into running Screen session

I have the following situation, I have a running GNU screen session where I can't access AFS anymore - my token has expired. I can however access it from a new shell. The difference to this question ...
2
votes
1answer
378 views

How can I use different kerberos principals for sudo than for system-auth?

At my organization, we're required to use different kerberos principals when authenticating for sudo than for other types of auth, such as logging in. For instance, my regular (login) principal might ...
0
votes
1answer
788 views

Why is my kerberos ticket not working?

I'm trying to ssh to another machine but my kinit is not working: $ ssh nik@social-1-r.referens.sys.XXXXXXX.se Permission denied (publickey,gssapi-keyex,gssapi-with-mic). Kerberos is used for ...
0
votes
2answers
133 views

How can I install kerberised services on debian?

I installed kerberos in my debian environment and made it work with SSH. I also would like to try it with other services but I could not install them on debian. I followed several tutorials e.g. ...
0
votes
0answers
447 views

RSAT : Samba 4 Server not operational

Samba 4 now supports GPO and management through the Active Directory Windows console. But, when I open it after installation, I cannot access the server nor the domain. The message returned is that ...
1
vote
1answer
479 views

kdb5_ldap_util fails with cryptic error

Supposedly, in order to set up Kerberos, I need to run kdb5_ldap_util, though I'm not sure why. However, it fails with: # kdb5_ldap_util -D cn=admin,dc=example,dc=com create -subtrees dc=example,dc=...
1
vote
1answer
47 views

permission for accessing files are denied and some sessions are killed

I ssh to a Linux server which runs kerberos. This is the first time I met Kerberos. After some time of being idle or loging out and loging in, I found some strange things, which I am not sure if are ...
1
vote
1answer
454 views

Kerberos Join Active Directory Failure

I try to join Active Directory and Samba 4 in Ubuntu 12.04.05. When I run host -t SRV _kerberos._udp.test.sg I get the error: Host _kerberos._udp.test.sg not found: 3(NXDOMAIN) meanwhile $# host ...
8
votes
3answers
6k views

Automatic kerberos ticket initialization on login

I'm using ksshaskpass to add my password protected keys into ssh-agent upon logging into KDE, is there something similar for kerberos?
3
votes
0answers
324 views

Kerberos Forwarding in SSSD

So, I'm trying to set up forwarding with Kerberos and seem to have some problems. On some of my servers I'm able to forward after receiving a ticket; however, some I'm not. My system setup is a ...