Skip to main content

Questions tagged [kerberos]

Kerberos is a network authentication system based on shared key cryptography. It is the underlying authentication system used by current versions of Active Directory and is widely used by large organizations.

Filter by
Sorted by
Tagged with
0 votes
0 answers
10 views

Timedatectl output does not change after running ntpdate command in Kali Linux

I am currently doing a pen testing CTF challenge on HacktheBox.com (HTB) that involves manipulation of Kerberos TGT tickets so need to sync my local system time on my Kali Linux instance with the ...
Anthony's user avatar
  • 101
1 vote
2 answers
25 views

Help importing kerberos key into openafs

I'm having trouble exporting and importing kerberos keys into openafs. My first problem is that when using addprinc and ktadd commands in kadmin.local, the encryption key type -e option appears to be ...
ealfonso's user avatar
  • 953
0 votes
1 answer
92 views

How to join the Ubuntu 22.04 Server to the Window Active Directory

I have new server running on the ubuntu and I want to join that server to our existing AD which is resolve as "ad.xyz.edu" and under that AD our department (OU) "med.abc.edu" is ...
Aditya vakharia's user avatar
0 votes
1 answer
83 views

Unable to SSH Login using kerberos

Setup I have some basic KDC setup at kerberos.domain.intranet (This is in my own Intranet DNS) I have another machine at xux.domain.intranet (This being the target machine to which SSH) I setup the ...
Delfin's user avatar
  • 150
1 vote
1 answer
105 views

Renew kerberos ticket, krenew not available

I'm fairly new to Linux. I have a shell script that runs daily off a cron. It requires a connection to sql server, which requires a valid kerberos ticket. I want to add logic to my script that renews ...
holcoje's user avatar
  • 13
1 vote
1 answer
99 views

How to run a command/program using system account in Linux

My goal is to run LDAP search and get a password for a gMSA account. I have an Ubuntu VM which is Dev_Linux. My user account is sja. I want to run LDAP search using the Dev_Linux account. I refer to ...
sachyy's user avatar
  • 111
1 vote
1 answer
276 views

krb5.keytab entries need to have uppercase service type

I'm encountering an issue with the keytab entries that are automatically created when I join a Linux server to an Active Directory domain. First, my process: Install the needed Linux packages yum ...
Seeker's user avatar
  • 13
5 votes
0 answers
524 views

SSH with Kerberos from Windows client

I have an Ubuntu 22.04 LTS machine which I've joined to my Active Directory with SSSD. Everything works great, I can login with my AD-users to the Linux-server the user gets a kerberos ticket etc. ...
PatricF's user avatar
  • 151
0 votes
1 answer
154 views

How to authenticate through OpenSSH then sudo with only one Ticket Service (Kerberos TGS host/fqdn)

By now, we are using OpenSSH GSSAPI authentication on all of our servers (Debian from 10 to 12). Then we sudo -i, using ldap authentication (through sssd-ldap). I would like to get rid of the ldap ...
neophenx's user avatar
0 votes
0 answers
62 views

Active directory server default gateway resolution issues

I am using a Raspberry Pi 2 running Ubuntu Server acting as an active directory domain controller with samba and kerberos etc as detailed in this video. I have three Windows 11 Professional clients ...
Oliver Ricketts's user avatar
0 votes
1 answer
689 views

freeipa client installation in ubuntu

I am installing freeipa client in ubuntu VM, but getting the following error. failed to obtain host tgt: major (458752): no credentials were supplied, or the credentials were unavailable or ...
Muhammad Naeem Akhtar's user avatar
2 votes
1 answer
157 views

Can not administering kerberos for a long time brick it?

I have this strange issue where a kerberos/openldap environment has gotten bricked. I can't add new users, computers, or other things to it, as everything I try results in various variations on ...
aphid's user avatar
  • 189
1 vote
1 answer
156 views

Cannot kinit nfs/ principal

I'm trying to mount a NFSv4 share but the mount command cannot get permissions to mount the share. When I try to mount a share I receive the message: mount.nfs4: mount(2): Permission denied And if I ...
igorkattar's user avatar
0 votes
1 answer
159 views

How does kpasswd change password?

When you change password via kpasswd, does it change your password that is stored on the Kerberos server, or does it change your password that is stored in the OpenLDAP server?
JLC's user avatar
  • 317
0 votes
1 answer
3k views

"Sealing" secrets with FreeIPA?

Recently we've been researching how to set up TPM on our Linux hosts: when they boot, the grub parameters and kernel are checksummed, and if the checksum is as expected the TPM module unseals a key ...
PFudd's user avatar
  • 173
1 vote
1 answer
363 views

Autofs with CIFS for home directories not really working

I'm having a bit of grief trying to get home directories that are automounted from a CIFS share working. In auto.master I have added the line /home/ /etc/auto.home and in /etc/auto.home I have * -...
BumpySiren's user avatar
0 votes
0 answers
362 views

gssapi-with-mic authentication from Windows to CentOS 7.9

We are a Windows shop with some CentOS servers, which we recently joined to our domain using realmd. I can successfully log into each CentOS using my domain username and password. Now, I'm trying to ...
Andrea Di Stefano's user avatar
0 votes
1 answer
57 views

Is it possible to install Kerberos for different distros?

I want to install Kerberos on AlmaLinux as server to manage Ubuntu clients. is this possible? I read somewhere that in order to use Kerberos, "Both devices have the same operating system". ...
Pejman Rezaei's user avatar
0 votes
0 answers
95 views

Why my file gets deleted from /tmp directory on LINUX?

(Linux Sles12 OS) After running command kinit to create a Kerberos ticket, I run klist and I see the file is stored at: /tmp/krb5cc_123456789 its seems like after a random short time (few min/sec) the ...
ILIYA's user avatar
  • 1
0 votes
1 answer
4k views

What does the error stty: 'standard input': Inappropriate ioctl for device Can't obtain kerberos tickets mean?

I ran the command: nohup sh -c "echo $SU_PASSWORD | /afs/cs/software/bin/reauth; python -u ~/diversity-for-predictive-success-of-meta-learning/div_src/diversity_src/experiment_mains/...
Charlie Parker's user avatar
2 votes
1 answer
450 views

How does one send new commands to run to an already running nohup process or run two commands together/concurrently in nohup?

I want to run a nohup job and to that already running process run a specific new command (e.g. kerberos authentication). In fact the ideal solution would be to first run the reauth command and then ...
Charlie Parker's user avatar
0 votes
2 answers
1k views

How do I wait for a process to end and then do a series of actions (e.g. kill a tmux session) without blocking my main terminal?

I am trying to "re-implement" nohup inside of tmux (so dispatching a job without blocking me and then killing the tmux command acting as nohup). My attempt is here (and it has several issues ...
Charlie Parker's user avatar
1 vote
1 answer
3k views

How to run a job in the background using tmux without interacting with tmux (like dispatching a nohup job)?

Due to me having to re-authenticate with Kerberos I need to run my long lived processes in tmux. I wrote a script that I thought would work but it didn't. The issue is that after I run the tmux ...
Charlie Parker's user avatar
0 votes
1 answer
40 views

Custom kerberos tmux doesn't let me name my sessions, help forcing it?

I can't name my session with this weird version of tmux: (metalearning_gpu) brando9~ $ cat /afs/cs/software/bin/krbtmux #!/usr/bin/pagsh +x aklog NEWKRB5=/tmp/krb5cc_${USER}_screen NEWKRB4=/tmp/tkt_${...
Charlie Parker's user avatar
0 votes
1 answer
899 views

How does one authenticate with a command that requires your password in linux?

I have this issue that if I run nohup in a server for some reason when I log out of the server the permissions change and it crashes. So I was recommended to run this: /afs/cs/software/bin/reauth in ...
Charlie Parker's user avatar
2 votes
2 answers
5k views

The kerberos option is deprecated on smbclient, but is the only option working!

On Slackware 15 (Samba version 4.15.10) I want to do smbclient, with gssapi/kerberos auth. Of course the kerberos client cache is aready set at login and I can see the file cache in tmp dir. Pam are ...
elbarna's user avatar
  • 12.8k
2 votes
1 answer
413 views

Strange permissions issue krb/windows domain/synology: within existing subfolders all access is denied

There are three machines in a network for this minimal example. A windows server acts as a domain (with everything that involves), a Synology NAS that's used to store some data and backups, and a ...
aphid's user avatar
  • 189
2 votes
1 answer
4k views

kinit: invalid UID in persistent keyring name while getting default ccache while using Ansible

Let me start with a short description: Target host: RHEL7, kernel 3.10, Python2.7 On the target host, there is a perl script (run by a particular user) which, among others, does stuff like: kdestroy -...
just_a_noob's user avatar
0 votes
1 answer
359 views

How to convert kerberos user to local user in Ubuntu?

I am having issues upgrading Ubuntu distribution, as my user is authenticated with kerberos. During upgrade, kerberos packages are removed and after restart I can't login anymore. I wonder, if I can ...
Saren Tasciyan's user avatar
1 vote
2 answers
299 views

SSH with GSSAPITrustDns in Arch

I am trying to set-up my computer to ssh without a password to a remote server. I am following these instructions, but I am having a problem: I can successfully run kinit -f [email protected] and I ...
user17004502's user avatar
1 vote
0 answers
1k views

curl request with spnego authentication fails with "gss_init_sec_context() failed: : Success"

curl request with kerberos authentication fails. Checking the output with -v option, the output says: $ curl -v -u : --negotiate https://URL ... < Connection: keep-alive < Set-Cookie: ...
yoon's user avatar
  • 183
1 vote
2 answers
145 views

Kerberos NFS encryption stops working after clock moved backwards

I have a system that uses krb5p security for its NFS mounts. It seems to all work well except when the time is moved backwards (a few hours or so, not sure the exact threshold). When the clock is ...
vtwaldo21's user avatar
2 votes
0 answers
206 views

Is pam_krb5 affected by Active Directory kerberos changes due to CVE-2021-42287?

I use pam_krb5 to authenticate Linux users against a Microsoft Active Directory. Due to CVE-2021-42287, Microsoft is pushing out updates that will change the way kerberos works in AD. Microsoft's ...
Bryan Wright's user avatar
4 votes
0 answers
219 views

Infrequent kerberos authentication issue (pam_krb5 vs. pam_unix)

My Linux computer belongs to a company network using a windows domain. The authentication is done using kerberos. Usually the authentication works fine and I am happy with my linux desktop. But ...
stollr's user avatar
  • 167
3 votes
1 answer
4k views

NFS permission denied with sec=krb5p

I'm setting up NFSv4.2 with MIT Kerberos (sec=krb5p) on two Hyper-V VMs running Debian 11 (Bullseye). When I use machine-based authentication (sec=sys), everything works fine. With Kerberos (sec=krb5p)...
Dylan L's user avatar
  • 48
1 vote
0 answers
879 views

Can't find kutil after installation of krb5-usr

I need to merge keytab files and all tutorials mention kutil. But I can't find it: root@nfsserver:/etc# kutil bash: kutil: command not found But krb5-usr is already installed: krb5-user is already ...
Standard's user avatar
  • 161
0 votes
0 answers
293 views

How to insert new users directories

I am trying to set up the directories on Ubuntu Server, Linux 4.15.0-162-generic #170-Ubuntu SMP using command chown user:group however, I have gotten an error like chown: invalid spec: ‘2163147:’ ...
Rodrigo N M's user avatar
0 votes
0 answers
905 views

How can I find the definitions for the -k, -e, and -p flags of ktutil addent?

I'm replacing a developer on a project & trying to understand their code: $ ktutil ktutil: addent -password -p $userName@$domainName -k 1 -e rc4-hmac Password for <$userName>@<$...
A yo's user avatar
  • 1
1 vote
1 answer
947 views

Linux in Active Directory: Persistent users

I was able to successfully join my Ubuntu 18.04 machine into AD. For this I'm using SSSD and Kerberos. I can ssh into in using AD domain credentials. Everything is fine except that those domain users ...
Anton  Merzliakov's user avatar
3 votes
2 answers
3k views

NFSv4 wrong effective user / owner, sec=krb5 mount squashes to anonymous user

I'm setting up kerberized NFSv4 for personal use manually configured NFS, KDC no nameservers (using /etc/hosts instead), no LDAP same users on all machines (not necessarily the same id) and using id ...
tpecar's user avatar
  • 81
1 vote
1 answer
381 views

Can't read ~/.Xauthority after implementing NFS Kerberos mount

I'm using Debian Buster where I have Kerberos, LDAP and SSSD working. I was mounting my home directory on the client using NFS however I realized it was insecure. So I implemented Kerberos mounting. ...
Ben's user avatar
  • 55
1 vote
0 answers
624 views

Kerberos auth with smartcard

I've got a fresh install of Fedora 34 installed and I'm trying to configure kinit to get kerberos tickets using my smartcard. I dont want to join the domain (which is Windows AD). I've been successful ...
Frank's user avatar
  • 11
1 vote
2 answers
1k views

Why is PAM broken after installing nis?

I'm a Software Engineer with some system admin experience currently trying to setup some Linux infrastructure at a new workplace which previously only had Windows infrastucture. For Political reasons ...
Ben's user avatar
  • 55
0 votes
2 answers
4k views

What are the "/tmp/kerb5cc_<user-id>" files exactly?

I'm trying to figure how kerberos works. In /tmp/ I have bunch of Kerberos files like krb5cc_<user-id>. What are they exactly? Looking into them I find out that they are just some encrypted ...
vesii's user avatar
  • 203
2 votes
0 answers
2k views

SMB mount with Kerberos

I have set up a server with Fedora 33 and joined it to an Active Directory. This worked successful and users can authenticate themselves with their Active Directory user names. I can also see my Linux ...
T. Pluess's user avatar
  • 552
3 votes
0 answers
3k views

SSO Kerberos Apache2 "No key table entry found matching" error

I am working on a wordpress page that uses NTLM SSO with LDAP Integration. The problem that I am having is that, for some reasons when you acces the website I am getting a 500 Internal server error ...
Sebastian Bulearca's user avatar
2 votes
1 answer
892 views

SSH doesn't prompt for new password when expired

I'd like to setup SSH to prompt for a new password when a user's existing one is expired, but currently it just fails to login. I use Kerberos as an authentication backend. You can see this user's ...
Joshua Schaeffer's user avatar
1 vote
0 answers
3k views

SUSE 15 SP2 AD Authentication: Server not found in Kerberos database

I am trying to configure configure Active Directory authentication on a SLE 15 SP2 host. The AD-domain exists of multiple DCs/AD-servers. I followed these guides: https://www.suse.com/c/the-sssd-...
Diskoteket's user avatar
2 votes
0 answers
68 views

NFS server with more secure export control

Is it possible to restrict access to a NFS server to machines based on some kind of key, password or token, instead on just an IP address? I would like to exports a /home folder with user files to ...
John Lee McMahon's user avatar
0 votes
0 answers
2k views

alpine krb5 install kerberos commands missing in docker container

I have created a docker image based on alpine 3.8 that includes krb5. I can then create a container and I can see that krb5 packages are installed but none of the kerberos commands are in the /bin e.g ...
ScubaMan's user avatar