Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [kerberos]

Kerberos is a network authentication system based on shared key cryptography. It is the underlying authentication system used by current versions of Active Directory and is widely used by large organizations.

0
votes
0answers
7 views

Enforce the usage of a different DNS domain for servicePrincipalNames

For mostly historic reasons our default DNS domain (lets call it new.example.net) differs from our Kerberos REALM (OLD.EXAMPLE.COM) Actually the KDC (an Active Directory Server) does not know about ...
2
votes
0answers
25 views

How to tell Kerberos where to find the root certificate for LDAP with TLS?

I run two Debian servers with MIT Kerberos and OpenLDAP backend. I would like to enforce TLS and encrypt replication. So I created and added certificates… dn: cn=config changetype: modify add: ...
0
votes
0answers
12 views

Debian Stretch: Samba Winbind Offline Logon Not working - kerberos keytab not persistent after reboot?

This is being tried onDebian stretch referred to as 9.6 in /etc/debian_version I'm in a Windows Domain environment with two 2012R2 controllers that have IDMU/Unix Attributes. Other versions of stuff:...
0
votes
0answers
15 views

How to generate keytab for headless AD user

I was provided a headless Active Directory user account with a randomly generated password we need to use to access some network resources. Since this headless account will need to be run from an ...
0
votes
0answers
20 views

mount a cifs share with kerberos on linux with a sssd/kcm kerberos client

As a non-root user I would like to mount a samba share on my Fedora Linux with kerberos (non-password). I have a kerberos client running (sssd with the kcm server for kerberos tickets). when i do a ...
0
votes
0answers
114 views

Stop kerberos KRB5CCNAME env variable from being set

Trying to set up kerberos on a machine and having problem where would like it to use the base default location (/tmp/krb5cc_uid (because setting up kerberos for a specific piece of software that ...
1
vote
0answers
173 views

“incorrect mount option was specified” when mounting krb5p nfs4 partition on Ubuntu

I have a NFS4 share running with krb5p. I have no problems accessing it from CentOS clients, all that is required is: yum install krb5-workstation setup krb5 (edit krb5.conf, setup keytab) systemctl ...
0
votes
0answers
50 views

Oracle Linux won't mount CentOS NFS share, but Arch will

I am trying to get kerberized NFSv4 running on our network. Server is CentOS 7. I am able to mount the share on my Arch Linux workstation, but not our Oracle Linux 7 database servers. I am trying to ...
1
vote
0answers
176 views

How to access NFSv4 shared folder with Kerberos authentication without root rights

I'm setting up a NFSv4 shared folder with Kerberos authentication. The issue I'm facing is that when the user on the client machine runs mount /mnt (see the fstab configuration below) he's not able to ...
1
vote
0answers
143 views

Permission denied on NFSv4 shared directory with authentication with SSO (OpenLDAP + Kerberos)

I'm trying to set up Single Sign On (SSO) with Kerberos and LDAP but I have an issue with NFSv4 with Kerberos for authentication and encryption (krb5p) service. My environment: 1 server (named ...
1
vote
0answers
177 views

pam_sss access denied with kerberos authentication ok

I'm trying to use sssd with kerberos authentication and ldap on Ubuntu 18.04 (server and client machine). On Ubuntu client side I installed sssd sssd-tools packages. But when I want to log in to alice,...
0
votes
0answers
304 views

Cannot contact any KDC for realm error happens after restarting the system

I didn't find any solution for this problem on the Internet ipa-server installed and all settings are done. kinit admin and ipa user-add usernameand ipa user-find username commands worked well till ...
1
vote
0answers
37 views

About connecting to Active Directory from CentOS7

I've searched several videos on Youtube, articles in other Stack Exchange sites, and some blogs.. but I couldn't make this done yet.. My environment is Windows Server 2012 RC and CentOS7. 1. I ...
0
votes
0answers
49 views

How it possible to use Samba as a Fileserver with AD, but using another LDAP server for SSH-Login?

We have a mixed Linux and Windows environment. There is an active directory server for the Windows side. For the Linux side, we will install an LDAP server. Now we would like to set up a Samba file ...
2
votes
0answers
229 views

CIFS mount no longer working

I have several RHEL6 systems with the same configuration. I have had CIFS mounts working for years. However in the past month, it has stopped working on one of my systems and I cannot seem to figure ...
2
votes
1answer
1k views

How do I clear a user's cached Active Directory password on CentOS 7?

I built a CentOS 7 install on my company laptop and configured it to authenticate to the company AD servers like so: Install packages: yum install sssd realmd oddjob oddjob-mkhomedir adcli samba-...
0
votes
0answers
117 views

ldap search is looking at wrong kerberos ticket

How can I specify the Kerberos ticket to use when running ldapsearch? If it makes a difference, it shouldn't, I am running a Cygwin wrapped Windows machine. Using the following: $ kinit Password ...
0
votes
1answer
133 views

How nsswitch call sssd for credential?

I'm stuck with Kerberos - sssd - AD. I've tried a lot of things, with lot of googling, in LinuxMint, Ubuntu 16.04 and Debian 9. I have always the same result : kinit username works fine msktutil -u --...
0
votes
0answers
49 views

Why isn't my principal found in the Kerberos database?

I am trying to join multiple Linux machines to my institution's Active Directory domain so that they can participate in domain authentication, not only for logins but also for access to domain ...
0
votes
0answers
36 views

FreeIPA client on workstations

I have set up a FreeIPA server, and I am having trouble getting my workstations to log in with the enterprise account. I have have my IPA server running on Fedora 27 Server, with the DNS set up as ...
0
votes
2answers
176 views

Connect to NFS with Kerberos automatically on login

I have a server, Ubuntu 16.04, exporting an NFS share with Kerberos security. I have a laptop client, Ubuntu 17.10, that connects to the server. The client is configured to mount the share using ...
0
votes
0answers
252 views

Unable to remote desktop from Fedora into Windows 10 from 1 machine only

I used to be able to rdp(using Remmina) from my Fedora machine(A) into a Windows 10 computer(B). But a few days ago I shut down my Linux computer(A) while connected, and since then have been unable to ...
0
votes
0answers
106 views

Printing to smb with kerberos auth?

I want to set up a printer via samba client to a Windows printserver. I managed to do it specifying this connection string: smb://user:pass@printserver/printer Is there a way to do auth through ...
0
votes
1answer
205 views

Samba integration with existing OpenLDAP, MIT Kerberos and Bind9 services

I have a network domain running OpenLDAP, MIT Kerberos and Bind9. Now I want to enable some MS Windows hosts access to a NAS, in such a way that user credentials stay in my LDAP and Kerberos ...
0
votes
1answer
45 views

How does Kerberos know it's me?

I log into my remote server as root (I know it's bad practice, but just bear with me). I kinit as my principal. I do whatever I have to do, then exit from the remote server. Next time I ssh in, I ...
1
vote
4answers
283 views

How to keep users with local sudo rights from having sudo rights on NFS file server?

Imagine this scenario in a LAN: one Linux NFS fileserver (srv) and three Linux clients (A, B, C). There are files / directories on srv with root ownership and no access rights granted to non-root ...
0
votes
2answers
203 views

What are the requirements for a Kerberos realm name?

Every example I have seen so far of a valid Kerberos realm name is of the form "example.com". None of the pages I have read give the actual naming rules. What are the naming rules? Must a Kerberos ...
1
vote
1answer
1k views

host/remote-hostname@REALM.COM not found in Kerberos database

To keep it short, I recently stood up a RHEL 7 server and enrolled it in FreeIPA. All other enrolled servers can SSH to each other without any issue using just the hostname, authenticating with gssapi-...
2
votes
0answers
371 views

How to get persistent (permanent) smb mount using kerberos authentication on RHEL7?

Environment: I have joined a few of my RHEL 7.3 boxes with MS AD domain using realmd/sssd. I have allowed only members of a few allowed groups can login to the box. Credentials caching is disabled. ...
0
votes
0answers
198 views

Libvirt error with TCP

I am using CentOS 7 with KVM and Libvirt. I have enable the TCP connection on Libvirt: File: /etc/libvirt/libvirtd.conf listen_tls = 0 listen_tcp = 1 auth_tcp = "sasl" File: /etc/sysconfig/...
0
votes
1answer
635 views

SSH with Kerberos Auth not working

I'm trying to log in my Linux VM with SSH using kerberos authentication. My Linux VM has successfully joined my AD using realmd / sssd method. I changed my sshd_config settings to : ...
0
votes
0answers
204 views

One server, two Kerberos realms

I have a number of CentOS 7 servers which need to authenticate with two different Kerberos realms: A.EXAMPLE.COM and B.EXAMPLE.POOP. Most users exist in the one, a few in the other. I have them ...
1
vote
0answers
2k views

How to use authentication with negiotiation (e.g. Kerberos) to HTTP proxy?

Generally accepted is the use of HTTP_PROXY/HTTPS_PROXY environment variables to specify the use of a proxy server. Authentication can be included in this URL, e.g. HTTP_PROXY=http://user:pass@myproxy....
2
votes
1answer
105 views

PAM Kerberos and RStudio

I am trying to get Kerberos PAM to pull a ticket and not destroy it after an RStudio login on CentOS 7. My rstudio file in /etc/pam.d/ looks like: #%PAM-1.0 auth required pam_krb5....
1
vote
0answers
181 views

Setting up a kerberized HA NFS share

I'm trying to set up a kerberized NFS share from an HA cluster. I've successfully set up a krb-aware NFS share from a single server, I'm using a mostly identical configuration on the cluster. Exports ...
0
votes
0answers
60 views

AFS not working after Upgrade to Debian 9

We are using Debian 8 and 9 with Gnome 3 / KDE 5, kerberos authentification and an AFS filesystem. Debian 8 works fine, but after Upgrading some PCs to Debian 9 we have the following problem: Gnome ...
2
votes
1answer
45 views

Unable to import kerberos.schema [closed]

I am trying to import kerberos.schema into OpenLDAP on RHEL7. I create a file with include /etc/ldap/schema/kerberos.schema in it and then run: slapcat -f schema_convert.conf -F /tmp/ldif_output -...
1
vote
0answers
60 views

Unexpected error when joining computer to AC/DC Samba 4

I present the problem: On a PC with 32-bit Debian Jessie, using Samba 4.1.7 I have a Domain Controller, it has been running for 2 years but since 2 weeks ago it is giving me the following error: When ...
5
votes
1answer
2k views

Fedora 26 NFS + Kerberos “Preauthentication failed” (mount lead to no permission)

I'm having a hard time trying to setup nfs + kerberos at Fedora 26. I've followed this tutorial: RHEL7: Use Kerberos to control access to NFS network shares | CertDepot At the moment, pure NFS ...
1
vote
0answers
300 views

Uppercase usernames in Kerberos principals upon SSH login with password entry

We've been having trouble with users logging in to our Linux machines and the username part of their Kerberos principal being in uppercase. This is a disaster for the security policies on our Hadoop ...
-1
votes
1answer
234 views

Does Tomcat with Kerberos need a keytab file linked with a specific user?

We are trying to setup a tomcat server on RHEL 6.5 to use Kerberos authentication. We have tried to follow this guide, but it seems more appropriate for a Windows implementation. In our environment, ...
1
vote
0answers
213 views

Renew kerberos ticket in tmux

I have two servers, server 1 and server 2. To login onto each server, I need a valid kerberos ticket, the same ticket is valid for both servers. If I run a tmux session on server 1, with several ...
0
votes
1answer
184 views

Cannot mount nfsv4 exports

i tried to setup nfsv4 server and client on centos7.3,both server(ark-centos7-ker ),client(ark-centos-smb4) are joined to AD domain by realm command,AD domain users could log in to centos server run ...
2
votes
0answers
158 views

openldap integration with MIT kerberos

I am integrating openldap with MIT kerberos and have couple of questions regarding that. I was able to do this integration and kerberos services only starting with ldap_kerberos_container_dn = cn=...
0
votes
0answers
386 views

kinit - cannot contact any KDC (missing packages?)

I'm quite new to Linux but have to get through it for an assignment. I have to send jobs to a Hadoop cluster. I'm sending these jobs inside a Docker container. To access the cluster i have to use the ...
1
vote
0answers
311 views

pipe password of kinit over ssh

Disclaimer: I'm creating a quick and dirty script for my own personal use, I'm aware that this isn't the correct way to do things. I want to initialize a kinit on a remote host (no keytab available). ...
1
vote
1answer
2k views

AD Users Cannot Login Through GDM/LightDM

I've setup Winbind & Kerberos on my CentOS 7 server to allow network users to login. The network users can login fine through SSH, but not through the display manager. I've experienced the same ...
1
vote
0answers
120 views

How to connect Kerberos with multiple LDAP servers?

My actual task is to make our kerberized Hadoop cluster usable by all our teams. Right now we have a very weird setup in our company: The Hadoop cluster has a dedicated KDC (openSUSE Kerberos with ...
1
vote
0answers
395 views

Server: Using Active Directory Groups For Sudo Fails Unless Name of File in /etc/sudoers Matches The Name Of The AD Group

I work for an organization with many linux servers that we'd like to start authenticating with Active Directory. I have a proof-of-concept server set up on which I use SSSD and Kerberos to ...
2
votes
0answers
262 views

Changing Active Directory password for service account in Linux

I am really new to but I am trying to use Kerberos to authenticate my active directory service account from my own CentOS 7 box, after which I then proceed to run queries in a remote database using ...