Questions tagged [kerberos]

Kerberos is a network authentication system based on shared key cryptography. It is the underlying authentication system used by current versions of Active Directory and is widely used by large organizations.

Filter by
Sorted by
Tagged with
0 votes
0 answers
31 views

curl request with spnego authentication fails with "gss_init_sec_context() failed: : Success"

curl request with kerberos authentication fails. Checking the output with -v option, the output says: $ curl -v -u : --negotiate https://URL ... < Connection: keep-alive < Set-Cookie: ...
user avatar
  • 133
0 votes
1 answer
36 views

Kerberos NFS encryption stops working after clock moved backwards

I have a system that uses krb5p security for its NFS mounts. It seems to all work well except when the time is moved backwards (a few hours or so, not sure the exact threshold). When the clock is ...
user avatar
2 votes
0 answers
79 views

Is pam_krb5 affected by Active Directory kerberos changes due to CVE-2021-42287?

I use pam_krb5 to authenticate Linux users against a Microsoft Active Directory. Due to CVE-2021-42287, Microsoft is pushing out updates that will change the way kerberos works in AD. Microsoft's ...
user avatar
2 votes
0 answers
38 views

Infrequent kerberos authentication issue (pam_krb5 vs. pam_unix)

My Linux computer belongs to a company network using a windows domain. The authentication is done using kerberos. Usually the authentication works fine and I am happy with my linux desktop. But ...
user avatar
  • 147
2 votes
1 answer
231 views

NFS permission denied with sec=krb5p

I'm setting up NFSv4.2 with MIT Kerberos (sec=krb5p) on two Hyper-V VMs running Debian 11 (Bullseye). When I use machine-based authentication (sec=sys), everything works fine. With Kerberos (sec=krb5p)...
user avatar
  • 36
0 votes
0 answers
74 views

Can't find kutil after installation of krb5-usr

I need to merge keytab files and all tutorials mention kutil. But I can't find it: root@nfsserver:/etc# kutil bash: kutil: command not found But krb5-usr is already installed: krb5-user is already ...
user avatar
  • 151
0 votes
0 answers
94 views

How to insert new users directories

I am trying to set up the directories on Ubuntu Server, Linux 4.15.0-162-generic #170-Ubuntu SMP using command chown user:group however, I have gotten an error like chown: invalid spec: ‘2163147:’ ...
user avatar
0 votes
0 answers
57 views

How can I find the definitions for the -k, -e, and -p flags of ktutil addent?

I'm replacing a developer on a project & trying to understand their code: $ ktutil ktutil: addent -password -p $userName@$domainName -k 1 -e rc4-hmac Password for <$userName>@<$...
user avatar
  • 1
1 vote
1 answer
104 views

Linux in Active Directory: Persistent users

I was able to successfully join my Ubuntu 18.04 machine into AD. For this I'm using SSSD and Kerberos. I can ssh into in using AD domain credentials. Everything is fine except that those domain users ...
user avatar
1 vote
1 answer
1k views

NFSv4 wrong effective user / owner, sec=krb5 mount squashes to anonymous user

I'm setting up kerberized NFSv4 for personal use manually configured NFS, KDC no nameservers (using /etc/hosts instead), no LDAP same users on all machines (not necessarily the same id) and using id ...
user avatar
  • 41
1 vote
1 answer
249 views

Can't read ~/.Xauthority after implementing NFS Kerberos mount

I'm using Debian Buster where I have Kerberos, LDAP and SSSD working. I was mounting my home directory on the client using NFS however I realized it was insecure. So I implemented Kerberos mounting. ...
user avatar
  • 45
1 vote
0 answers
113 views

Kerberos auth with smartcard

I've got a fresh install of Fedora 34 installed and I'm trying to configure kinit to get kerberos tickets using my smartcard. I dont want to join the domain (which is Windows AD). I've been successful ...
user avatar
  • 11
1 vote
2 answers
394 views

Why is PAM broken after installing nis?

I'm a Software Engineer with some system admin experience currently trying to setup some Linux infrastructure at a new workplace which previously only had Windows infrastucture. For Political reasons ...
user avatar
  • 45
0 votes
1 answer
193 views

What are the "/tmp/kerb5cc_<user-id>" files exactly?

I'm trying to figure how kerberos works. In /tmp/ I have bunch of Kerberos files like krb5cc_<user-id>. What are they exactly? Looking into them I find out that they are just some encrypted ...
user avatar
  • 63
2 votes
0 answers
598 views

SMB mount with Kerberos

I have set up a server with Fedora 33 and joined it to an Active Directory. This worked successful and users can authenticate themselves with their Active Directory user names. I can also see my Linux ...
user avatar
  • 430
2 votes
0 answers
2k views

SSO Kerberos Apache2 "No key table entry found matching" error

I am working on a wordpress page that uses NTLM SSO with LDAP Integration. The problem that I am having is that, for some reasons when you acces the website I am getting a 500 Internal server error ...
user avatar
0 votes
1 answer
175 views

SSH doesn't prompt for new password when expired

I'd like to setup SSH to prompt for a new password when a user's existing one is expired, but currently it just fails to login. I use Kerberos as an authentication backend. You can see this user's ...
user avatar
0 votes
0 answers
2k views

SUSE 15 SP2 AD Authentication: Server not found in Kerberos database

I am trying to configure configure Active Directory authentication on a SLE 15 SP2 host. The AD-domain exists of multiple DCs/AD-servers. I followed these guides: https://www.suse.com/c/the-sssd-...
user avatar
2 votes
0 answers
29 views

NFS server with more secure export control

Is it possible to restrict access to a NFS server to machines based on some kind of key, password or token, instead on just an IP address? I would like to exports a /home folder with user files to ...
user avatar
0 votes
0 answers
1k views

Centos 8 apache kerberos authentication sso

For some reason I am unable to authenticate via sso to internal website when you connect it directly via cname. Centos linux is joined in the domain itself. What happens is that when I enter the ...
user avatar
  • 1
0 votes
0 answers
848 views

alpine krb5 install kerberos commands missing in docker container

I have created a docker image based on alpine 3.8 that includes krb5. I can then create a container and I can see that krb5 packages are installed but none of the kerberos commands are in the /bin e.g ...
user avatar
0 votes
1 answer
66 views

Kerberos with i3-dmenu-desktop

I use Kerberos authentication in Thunderbird, Firefox and for ssh and it works just fine if I use the programs from the shell. But when I use i3-dmenu-desktop to start Thunderbird and Firefox, the ...
user avatar
0 votes
0 answers
95 views

Restricting ssh access for shared software accounts

We have passwordless login on all hosts through kerberos. We have user accounts and shared accounts - all (host and sudo access) managed through LDAP (FreeIPA by RedHat). Now if we give shell access ...
user avatar
0 votes
1 answer
107 views

krb command not working in ksh script

On a RedHat 7, when I run the following command to get a Kerberos ticket: krb my_user It sends back : Ticket for 'my_user' is valid until 08:36 (28/01) Now I need to run this command from a script....
user avatar
  • 93
0 votes
0 answers
32 views

centOS 7 access denied when logging on kerberized environment

When I am trying to log in to one of my hadoop nodes running centos 7. I am receiving a 'access denied' error. Typically, in these situations, I login as the local admin for the box, go to /tmp and ...
user avatar
2 votes
1 answer
209 views

Samba 4.11 and des-cbc-md5

Although noted as an weak encryption type, I want to know how to enable des-cbc-md5 on Samba 4.11, in this doc is stated: des-cbc-md5 (disabled by default) des-cbc-md5 can be enabled by enabling DES ...
user avatar
  • 10.9k
0 votes
1 answer
935 views

mount in fstab with krb5 at login

I have a cifs fileshare that I use. My organisation requires that it uses Kerberos so it's mounted with sec=krb5. This is fine, but I'd like it to mount after login automatically without having to ...
user avatar
  • 621
2 votes
2 answers
2k views

PAM configuration with Kerberos authentication but without need of local accounts

I have a working Kerberos authentication tested with kinit on Debian Buster. Now I try to use it with PAM for login with Kerberos and installed libpam-krb5 and configured it with pam-auth-update. But ...
user avatar
  • 506
2 votes
2 answers
294 views

establish connection between Redhat7 and MSSQL database over kerberos [jdbc driver]

i'm working on very annoying issue, namely our java app on redhat 7 is created to connect to mssql, which cannot parse principal stored in keytab generated by our company automats. Principal stored ...
user avatar
1 vote
1 answer
4k views

Samba winbind: how to authenticate from trusted AD domain (one-way trust)?

Hello linux newbie here. What I am trying to achieve: to be able to login to Linux machine with Active Directory credentials from trusted domain. I have the following setup: +...
user avatar
0 votes
0 answers
145 views

How to make CentOS iterate over principals in .k5login (take password for one of them)

at my work, we use combination of Debian and newly some CentOS 7 machines. We have a group of kerberos+LDAP servers to provide means of user authentication to another machines. Everything is fine ...
user avatar
0 votes
1 answer
2k views

Kerberos key fails with AutoFS

Our Kubuntu computers are configured to automatically connect to their network drive via AutoFS. When we upgrade machines to Kubuntu 18.04 LTS this AutoFS connection no longer works. It is still ...
user avatar
  • 141
2 votes
1 answer
3k views

How to mount cifs with kerberos for a generic user?

I am able to mount a corporate shared directory on my AWS Workspace manually but I need to do this for all users. $ sudo ksu [sudo] password for <Domain>\<User.Name>: Leaving uid as root ...
user avatar
1 vote
0 answers
2k views

Alternative to autofs to mount CIFS folders in user home folders in multi-user environment

My use case seems very simple. I want to automount CIFS folder CIFS1 and CIFS2 which exist for all users on my fileserver in each user home during login on this multi-user 18.04 Ubuntu machine. So ...
user avatar
  • 123
1 vote
1 answer
477 views

centos and kerberized nfs works fine but only for nfs3

I want to mount a nfs4 kerberized share. I'm on centos7, the kerberos server is Freeipa,the client is centos7. The problem is my configuration is working for nfs3 but not for nfs4. First I put my ...
user avatar
  • 10.9k
1 vote
1 answer
4k views

kinit using keytab fails while using password succeeds

I'm facing a strange problem configuring KRB5 on Ubuntu 16.04 using Windows 2012 DCs as KDC. Calling kinit with an service AD account succeeds, if the password is provided to kinit's password prompt, ...
user avatar
  • 373
1 vote
0 answers
3k views

Access Windows share via CIFS and Kerberos: "Key has been revoked"

I'm trying to mount a Windows share on a Linux host (Ubuntu 16.04) using Kerberos / Active Directory authentication. The Linux host has been joined to the AD, and I can access shares on it from the ...
user avatar
  • 559
2 votes
0 answers
413 views

How to tell Kerberos where to find the root certificate for LDAP with TLS?

I run two Debian servers with MIT Kerberos and OpenLDAP backend. I would like to enforce TLS and encrypt replication. So I created and added certificates… dn: cn=config changetype: modify add: ...
user avatar
  • 338
1 vote
0 answers
693 views

Debian Stretch: Samba Winbind Offline Logon Not working - kerberos keytab not persistent after reboot?

This is being tried onDebian stretch referred to as 9.6 in /etc/debian_version I'm in a Windows Domain environment with two 2012R2 controllers that have IDMU/Unix Attributes. Other versions of stuff:...
user avatar
2 votes
1 answer
5k views

"incorrect mount option was specified" when mounting krb5p nfs4 partition on Ubuntu

I have a NFS4 share running with krb5p. I have no problems accessing it from CentOS clients, all that is required is: yum install krb5-workstation setup krb5 (edit krb5.conf, setup keytab) systemctl ...
user avatar
1 vote
0 answers
2k views

How to access NFSv4 shared folder with Kerberos authentication without root rights

I'm setting up a NFSv4 shared folder with Kerberos authentication. The issue I'm facing is that when the user on the client machine runs mount /mnt (see the fstab configuration below) he's not able to ...
user avatar
  • 31
2 votes
0 answers
1k views

Permission denied on NFSv4 shared directory with authentication with SSO (OpenLDAP + Kerberos)

I'm trying to set up Single Sign On (SSO) with Kerberos and LDAP but I have an issue with NFSv4 with Kerberos for authentication and encryption (krb5p) service. My environment: 1 server (named ...
user avatar
  • 31
1 vote
0 answers
97 views

About connecting to Active Directory from CentOS7

I've searched several videos on Youtube, articles in other Stack Exchange sites, and some blogs.. but I couldn't make this done yet.. My environment is Windows Server 2012 RC and CentOS7. 1. I ...
user avatar
3 votes
0 answers
1k views

CIFS mount no longer working

I have several RHEL6 systems with the same configuration. I have had CIFS mounts working for years. However in the past month, it has stopped working on one of my systems and I cannot seem to figure ...
user avatar
  • 239
6 votes
1 answer
14k views

How do I clear a user's cached Active Directory password on CentOS 7?

I built a CentOS 7 install on my company laptop and configured it to authenticate to the company AD servers like so: Install packages: yum install sssd realmd oddjob oddjob-mkhomedir adcli samba-...
user avatar
1 vote
1 answer
3k views

How nsswitch call sssd for credential?

I'm stuck with Kerberos - sssd - AD. I've tried a lot of things, with lot of googling, in LinuxMint, Ubuntu 16.04 and Debian 9. I have always the same result : kinit username works fine msktutil -u --...
user avatar
  • 113
0 votes
2 answers
680 views

Connect to NFS with Kerberos automatically on login

I have a server, Ubuntu 16.04, exporting an NFS share with Kerberos security. I have a laptop client, Ubuntu 17.10, that connects to the server. The client is configured to mount the share using ...
user avatar
  • 121
3 votes
0 answers
402 views

Printing to smb with kerberos auth?

I want to set up a printer via samba client to a Windows printserver. I managed to do it specifying this connection string: smb://user:pass@printserver/printer Is there a way to do auth through ...
user avatar
0 votes
1 answer
954 views

Samba integration with existing OpenLDAP, MIT Kerberos and Bind9 services

I have a network domain running OpenLDAP, MIT Kerberos and Bind9. Now I want to enable some MS Windows hosts access to a NAS, in such a way that user credentials stay in my LDAP and Kerberos ...
user avatar
0 votes
1 answer
139 views

How does Kerberos know it's me?

I log into my remote server as root (I know it's bad practice). I kinit as my principal. I do whatever I have to do, then exit from the remote server. Next time I ssh in, I klist, and I'm already ...
user avatar