Kerberos is a network authentication system based on shared key cryptography. It is the underlying authentication system used by current versions of Active Directory and is widely used by large organizations.

learn more… | top users | synonyms

8
votes
3answers
6k views

Automatic kerberos ticket initialization on login

I'm using ksshaskpass to add my password protected keys into ssh-agent upon logging into KDE, is there something similar for kerberos?
8
votes
2answers
7k views

How could I eliminate Kerberos for passwd?

When I issue a command to change my password like this: sudo passwd huahsin The system prompt me: Current Kerberos password: I don't know what I have done to the system configuration, how could I ...
8
votes
1answer
186 views

List Kerberos principals with valid TGTs

Is it possible to query my (MIT) Kerberos KDC to return a list of principals who have been issued TGTs that are currently valid? My use case is that I would like to find out which users are currently ...
7
votes
1answer
619 views

Kerberos authentication fails with forced password change

I have configured PAM authentication to use Kerberos and can authenticate correctly with my principals using their Kerberos credentials. I ran into trouble when I tried to create a principal with an ...
5
votes
1answer
1k views

Public Key Auth + Kerberos

I've setup public key authentication for ssh'ing into my university machine. However, it only logs me in on the local machine and doesn't give me Kerberos credentials which I need for accessing my ...
5
votes
1answer
3k views

Get a Kerberos service ticket from the command line

I am in the process of debugging a Kerberos setup. I have a valid krb5.conf and I can call kinit USERNAME to get a Ticket Granting Ticket (TGT): Credentials cache: /root/krb5cc_root Default principal:...
4
votes
1answer
8k views

Java could not get the TGT from cache in Linux client

I have set up a Kerberos server and OpenLDAP in RHEL5.5. I also have a RHEL6 machine as a client. I have run my Java program using jaas to query the OpenLDAP server from the linux client. I can query ...
4
votes
1answer
2k views

Keep kerberos ticket across sudo invocation

On a regular linux machine, when I use sudo -s as a normal user, I become root but HOME still points to ~user, so every admin has his own environment etc. (this is without env_reset or always_set_home ...
3
votes
2answers
27k views

SSH authentication using gssapi-keyex or gssapi-with-mic (publickey not permitted)

My company has disabled SSH public key authentication, therefore I have to manually enter each time my password (I am not suppose to change /etc/ssh/sshd_config). However gssapi-keyex and gssapi-with-...
3
votes
1answer
57 views

getent group working, but sshd_config allowgroups does not retrieve appropriate group

I am trying to setup Kerberos MIT authentication with OpenLdap autorisation on Debian Jessie. Authentication part is working great, as I can login to SSH using my kerberos account. I even can create ...
3
votes
2answers
736 views

Multiple PCs network centralized system authentication

(I couldn't really choose an accurate title as I don't know exactly what the feature I'm looking for is called. Sorry about that. I hope that the following lines may clear this aspect.) I own a dozen ...
3
votes
0answers
37 views

Tomcat, sql, kerberos, oh my!

I am working on setting up tomcat 8.0.35 on ubuntu 16.04 with Oracle Java (not openjdk) 1.8.0_91-b14 to use kerberos authentication when authenticating to our Microsoft SQL database. The issue I am ...
3
votes
1answer
77 views

When using an SSH alias, why is SSH ignoring my (valid) Kerberos ticket?

I am successfully connecting to my university's network via ssh with Kerberos ticket authentication. Normal, verbose operation (kinit a ticket, then ssh user@hostname) works fine. The Problem When ...
3
votes
0answers
99 views

kerberos preauth pkinit failed to initialize: No realms configured correctly for pkinit support

I have successfully installed Kerberos on debian wheezy and can perform service authentication (Apache, ssh) with Kerberos tickets from kinit. I would like to use certificates for kinit (pkinit) ...
3
votes
0answers
323 views

Kerberos Forwarding in SSSD

So, I'm trying to set up forwarding with Kerberos and seem to have some problems. On some of my servers I'm able to forward after receiving a ticket; however, some I'm not. My system setup is a ...
2
votes
3answers
1k views

Kerberos error after ArchLinux installation

I've installed ArchLinux successfully on my laptop yesterday. To do this, I've followed the Beginner's guide along with the Raid guide. I could do every step without problem, except the one for the ...
2
votes
2answers
2k views

How would I build a linux based router?

I am looking into building a Linux based router out of a home-built Linux server. I don't have much experience with the software required however. I would like the server to run the following ...
2
votes
4answers
2k views

What is the kerberos keytab file used for in UNIX/AD kerberos authentication?

I have proved that UNIX/AD Kerberos authentication works without the presence of a keytab file so I'd like to know whether I should worry about it (given I'll need an individual keytab for each server ...
2
votes
1answer
58 views

Is it possible to have a daemon run a process as another user WITHOUT having a superuser daemon?

I'm working on a project at the moment where I have a daemon that needs to run a process as another user. I would like the daemon to not run as root if possible. However, i'm struggling to figure out ...
2
votes
1answer
463 views

oddjob_mkhomedir doesn't run when logging in via SSH with Kerberos

I currently have a server which has Kerberos/SSSD/Samba to authenticate to Windows 2012 AD. In /etc/pam.d/system-auth oddjob_mkhomedir is set as below: session optional pam_oddjob_mkhomedir....
2
votes
1answer
373 views

How can I use different kerberos principals for sudo than for system-auth?

At my organization, we're required to use different kerberos principals when authenticating for sudo than for other types of auth, such as logging in. For instance, my regular (login) principal might ...
2
votes
2answers
515 views

How to automate ktutil to immediately list keytab entries?

I use MIT ktutil a lot on Linux and I am fed up using the following sequence, even if command shortcuts and file name completion are here to help: ktutil rkt my.keytab l Isn't there a way to get ...
2
votes
1answer
806 views

Understanding Kerberized NFSv4 Authorization

Articles such as this one seem to point out that Kerberizing NFS(v4) mounts not only prevents machines without a Kerberos service ticket from mounting the shared directory but also uses the user's ...
2
votes
1answer
363 views

Integrating LDAP and Kerberos V to add users via a useradd-like interface

I'm currently trying to set up an integrated Kerberos V/LDAP system for authentication/authorization. From what I have managed to gather, there are at least two ways to integrate Kerberos V with LDAP: ...
2
votes
0answers
15 views

How to allow users to register for a single signon account from mit kerberos?

Is there a way to allow users to register for a single sign on account for an mit kerberos server via a web interface of some sort?
2
votes
1answer
547 views

Kerberos DNS issue with /etc/hosts

Thank you all for your time and attention. Very simply I'm getting this error when invoking kinit to test kerberos authentication against my AD domain (which is hosted on a Server 2012 box). The ...
2
votes
0answers
571 views

tmp/krb5cc_[uid] is not getting purged regularly (kerberos credentials cache)

A user wasn't able to authenticate using Kerberos because it wasn't able to create /tmp/krb5cc_[uid]. This was because /tmp ran out of inode space, as there were innumerable Kerberos credential cache ...
1
vote
1answer
827 views

Allow username input sddm (LDAP/Kerberos)

The overarching question: How can I enable SDDM to accept username input in Debian? Underlying/implicit questions: How does SDDM recognize users? What is the Debian alternative to /etc/sddm....
1
vote
2answers
181 views

Not permitted to access my files on $HOME in tmux after log out and log in

My $HOME on a server is in a Andrew file system, and the server runs kerberos. I created a tmux session, wherein I ran a shell process. Then I detached it, and logged out, and after a while logged ...
1
vote
2answers
477 views

Command-line web browser with Kerberos authentication?

QUESTION: Is there a Kerberos-friendly web browser usable via an SSH console? I have tried links but it does not seem to work with Kerberos (the webapp asks me for login/password even though I have a ...
1
vote
2answers
62 views

Renew Kerberos ticket for daemon

Using ISC-DHCPD to renew DHCP leases in an Active Directory domain. This requires using ktutil to generate a keytab for DHCPd to use in order to update secure dynamic DNS. What I need to do is to be ...
1
vote
1answer
64 views

Can a Linux server that authenticates against an Active Directory accept public/private keys for passwordless login?

I have a Linux server that authenticates users against an Active Directory. Now interactive logins require username and password and automatic login requires a keytab (Kerberos) for passwordless ...
1
vote
2answers
36 views

The easiest way to update package above release RHEL

I have to install the krb5-devel package in a version at least 1.12 on a RHEL 6.6. Unfortunately the RHEL 6.6 repositories contains the package in a version 1.10. What would be the easiest way to ...
1
vote
1answer
47 views

permission for accessing files are denied and some sessions are killed

I ssh to a Linux server which runs kerberos. This is the first time I met Kerberos. After some time of being idle or loging out and loging in, I found some strange things, which I am not sure if are ...
1
vote
1answer
14 views

Generating a keytab for Active Directory user?

I am relatively new to Kerberos, we have integrated Active Directory for authentication. I.E. When we do kinit ad_user, we get a valid TGT. Now I want to run the application as a user in headless ...
1
vote
1answer
513 views

PostgreSQL on FreeBSD - 'Kerberos 5 authentication not supported'

I've been trying to get a FreeBSD machine to talk to a networked postgreSQL database. I assumed that the machine had kerberos installed, as it's what I use to log in, and I was told that FreeBSD has ...
1
vote
0answers
71 views

CentOS 6.8 + Samba4 + Kerberos: No credentials cache found

I am trying to release a server using ‍‍CentOS 6.8 + Samba4 (Winbind - LDAP + Kerberos) + NSS. I was able to join the domain, but I still getting this warning/error message: [root@snfs2 ~]# net ads ...
1
vote
0answers
38 views

Why do I get “no credentials cache” error when mounting Kerberized NFS share?

I have two systems on a local network, nfsclient (CentOS 7) and nfsserver (CentOS 6). These names correctly resolve to their IP addresses, and Kerberos is working between them (nfsserver is the KDC). ...
1
vote
1answer
329 views

Kerberos/Samba can't join Active Directory [DEBIAN 8]

I have an issue when I try to join my domain. I am able to create the kerberos ticket successfully. root@debian:~# kinit Administrateur@ASP.DOMAIN Password for Administrateur@ASP.DOMAIN: root@debian:...
1
vote
1answer
27 views

How can I set kerberos principal in environment automatically on the remote host?

I use both legacy krsh and ssh to login to a variety of boxes for root administration, as do several colleagues of mine. We all keep different history files by use of a variable calculated by running ...
1
vote
1answer
110 views

Can not stop Kerberos on debian 8

I'm trying to install krb5-admin-server and krb5-kdc for a school project, everything is working fine but I can't stop krb5-admin-server nor restart it. Here are the logs I retrieved with cat /var/...
1
vote
2answers
1k views

Failed to join domain: failed to set machine kerberos encryption types: Insufficient access

did someone have this error when try to join CentOS 7 to Active Directory. I tried on a various ways(via cli, gui, tui) and always get same error. Failed to join domain: failed to set machine ...
1
vote
0answers
240 views

realmd join AD and Cross Domain Auth

Small issue with realmd, I use realm join with a kerberos token generated before the join, it's working fine on a simple Active Directory Configuration My issue is when realm join must join a domain ...
1
vote
0answers
2k views

Adding CentOS 7 to Active Directory

I am having a hard time adding a CentOS 7 machine to my domain (Active Directory 2012 running in Windows 2008 mode). I am using realmd to join the machine to the domain. Here is what I have checked so ...
1
vote
1answer
123 views

How can I run unattended processes as authenticated AD/LDAP users?

I'm switching some servers over to Debian 8 and using realmd for Active Directory (LDAP/Kerberos) authentication. This has been working great and allows Domain Users to login to my server, etc. ...
1
vote
0answers
111 views

Where are AFS tokens stored, and how do I get them into running Screen session

I have the following situation, I have a running GNU screen session where I can't access AFS anymore - my token has expired. I can however access it from a new shell. The difference to this question ...
1
vote
1answer
447 views

Kerberos Join Active Directory Failure

I try to join Active Directory and Samba 4 in Ubuntu 12.04.05. When I run host -t SRV _kerberos._udp.test.sg I get the error: Host _kerberos._udp.test.sg not found: 3(NXDOMAIN) meanwhile $# host ...
1
vote
0answers
184 views

Utilizing Samba Shares Without using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
1
vote
0answers
140 views

kerberos : kinit not picking up updated values in krb5.conf

We are running kinit from our Linux command line and this works well. Before we run kinit we set the KRB5_CONFIG environment variable to point to directory continaing krb5.conf file linuxhost1$ ...
1
vote
1answer
846 views

Can't Login to Debian 7.7 with Kerberos/NIS user

I have a Debian 7.7 system I am trying to configure to use Kerberos and NIS, both served from an Active Directory server. I have kerberos set up such that I can kinit a set of credentials from the AD ...