Questions tagged [kerberos]

Kerberos is a network authentication system based on shared key cryptography. It is the underlying authentication system used by current versions of Active Directory and is widely used by large organizations.

0
votes
1answer
57 views

Kerberos key fails with AutoFS

Our Kubuntu computers are configured to automatically connect to their network drive via AutoFS. When we upgrade machines to Kubuntu 18.04 LTS this AutoFS connection no longer works. It is still ...
0
votes
0answers
7 views

Kerberos fallback to app login

I have to mount a SSO to connect to a GLPI application. For some reason NTML don't work, but we managed to get kerberos functionnal. I would like to authenticate against Kerberos, but if that fails, ...
1
vote
0answers
165 views

How to connect Kerberos with multiple LDAP servers?

My actual task is to make our kerberized Hadoop cluster usable by all our teams. Right now we have a very weird setup in our company: The Hadoop cluster has a dedicated KDC (openSUSE Kerberos with ...
6
votes
2answers
5k views

SSH login without password with kerberos

I try to login onto a server which only supports login with kerberos authentication. Here's what I try: kinit user@FOO.ORG aklog -c foo.org ssh server But then I'm asked again for a password. Here'...
0
votes
1answer
106 views

How to mount cifs with kerberos for a generic user?

I am able to mount a corporate shared directory on my AWS Workspace manually but I need to do this for all users. $ sudo ksu [sudo] password for <Domain>\<User.Name>: Leaving uid as root ...
2
votes
1answer
7k views

Kerberos/Samba can't join Active Directory [DEBIAN 8]

I have an issue when I try to join my domain. I am able to create the kerberos ticket successfully. root@debian:~# kinit Administrateur@ASP.DOMAIN Password for Administrateur@ASP.DOMAIN: root@debian:...
3
votes
2answers
3k views

Failed to join domain: failed to set machine kerberos encryption types: Insufficient access

Has anyone gotten this error when trying to join CentOS 7 to Active Directory? I tried various ways(via cli, gui, tui) and always get same error. Failed to join domain: failed to set machine kerberos ...
1
vote
0answers
138 views

Alternative to autofs to mount CIFS folders in user home folders in multi-user environment

My use case seems very simple. I want to automount CIFS folder CIFS1 and CIFS2 which exist for all users on my fileserver in each user home during login on this multi-user 18.04 Ubuntu machine. So ...
3
votes
2answers
1k views

Multiple PCs network centralized system authentication

(I couldn't really choose an accurate title as I don't know exactly what the feature I'm looking for is called. Sorry about that. I hope that the following lines may clear this aspect.) I own a dozen ...
1
vote
0answers
3k views

How to use authentication with negiotiation (e.g. Kerberos) to HTTP proxy?

Generally accepted is the use of HTTP_PROXY/HTTPS_PROXY environment variables to specify the use of a proxy server. Authentication can be included in this URL, e.g. HTTP_PROXY=http://user:pass@myproxy....
1
vote
1answer
975 views

kdb5_ldap_util fails with cryptic error

Supposedly, in order to set up Kerberos, I need to run kdb5_ldap_util, though I'm not sure why. However, it fails with: # kdb5_ldap_util -D cn=admin,dc=example,dc=com create -subtrees dc=example,dc=...
7
votes
1answer
2k views

Kerberos authentication fails with forced password change

I have configured PAM authentication to use Kerberos and can authenticate correctly with my principals using their Kerberos credentials. I ran into trouble when I tried to create a principal with an ...
0
votes
1answer
44 views

centos and kerberized nfs works fine but only for nfs3

I want to mount a nfs4 kerberized share. I'm on centos7, the kerberos server is Freeipa,the client is centos7. The problem is my configuration is working for nfs3 but not for nfs4. First I put my ...
0
votes
0answers
116 views

Freeipa client on debian 9 - Cannot find user error

EDIT 1: added solution, pam was faulty i'm trying to set up freeipa client on debian 9 client using this guide: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/...
5
votes
3answers
6k views

NFS + Kerberos: access denied by server while mounting

I have NFS&Kerberos configured as described here: How do I configure a Kerberos NFS server on Red Hat Enterprise Linux 7 All diagnostics operations come fine, but when I try to mount my shares on ...
0
votes
0answers
67 views

kinit using keytab fails while using password succeeds

I'm facing a strange problem configuring KRB5 on Ubuntu 16.04 using Windows 2012 DCs as KDC. Calling kinit with an service AD account succeeds, if the password is provided to kinit's password prompt, ...
0
votes
0answers
326 views

Access Windows share via CIFS and Kerberos: “Key has been revoked”

I'm trying to mount a Windows share on a Linux host (Ubuntu 16.04) using Kerberos / Active Directory authentication. The Linux host has been joined to the AD, and I can access shares on it from the ...
0
votes
0answers
178 views

Allow NTLM Authentication after inclusion in Windows Domain

In a user session outside of domain authentication, I had NTLM authentication working for web requests sending Auth headers: WWW-Authenticate: Negotiate WWW-Authenticate: NTLM But, now I've ...
0
votes
1answer
61 views

How does Kerberos know it's me?

I log into my remote server as root (I know it's bad practice). I kinit as my principal. I do whatever I have to do, then exit from the remote server. Next time I ssh in, I klist, and I'm already ...
1
vote
0answers
195 views

Debian Stretch: Samba Winbind Offline Logon Not working - kerberos keytab not persistent after reboot?

This is being tried onDebian stretch referred to as 9.6 in /etc/debian_version I'm in a Windows Domain environment with two 2012R2 controllers that have IDMU/Unix Attributes. Other versions of stuff:...
0
votes
0answers
24 views

openstack keystone and kerberos

I have integrated the openstack and kerberos using the link provided here : https://www.jamielennox.net/blog/2015/02/12/step-by-step-kerberized-keystone/ It is successfully installed and I am able to ...
5
votes
3answers
3k views

Why do I get permission denied error when I log out of the SSH session?

I have to run some tests on a server at the University. I have ssh access to the server from the desktop in my office. I want to launch a python script on the server that will run several tests during ...
0
votes
0answers
10 views

Enforce the usage of a different DNS domain for servicePrincipalNames

For mostly historic reasons our default DNS domain (lets call it new.example.net) differs from our Kerberos REALM (OLD.EXAMPLE.COM) Actually the KDC (an Active Directory Server) does not know about ...
2
votes
0answers
53 views

How to tell Kerberos where to find the root certificate for LDAP with TLS?

I run two Debian servers with MIT Kerberos and OpenLDAP backend. I would like to enforce TLS and encrypt replication. So I created and added certificates… dn: cn=config changetype: modify add: ...
0
votes
0answers
261 views

How to generate keytab for headless AD user

I was provided a headless Active Directory user account with a randomly generated password we need to use to access some network resources. Since this headless account will need to be run from an ...
0
votes
1answer
135 views

Kerberos in Ubuntu system

I would build a kerberos authentication system on Ubuntu based machines. So i have some questions: 1)What do i need to make client-KDC-server? Do i need a domain controller? 2)How man machines do i ...
0
votes
0answers
285 views

mount a cifs share with kerberos on linux with a sssd/kcm kerberos client

As a non-root user I would like to mount a samba share on my Fedora Linux with kerberos (non-password). I have a kerberos client running (sssd with the kcm server for kerberos tickets). when i do a ...
2
votes
1answer
2k views

host/remote-hostname@REALM.COM not found in Kerberos database

To keep it short, I recently stood up a RHEL 7 server and enrolled it in FreeIPA. All other enrolled servers can SSH to each other without any issue using just the hostname, authenticating with gssapi-...
1
vote
0answers
1k views

“incorrect mount option was specified” when mounting krb5p nfs4 partition on Ubuntu

I have a NFS4 share running with krb5p. I have no problems accessing it from CentOS clients, all that is required is: yum install krb5-workstation setup krb5 (edit krb5.conf, setup keytab) systemctl ...
2
votes
1answer
655 views

Utilizing Samba Shares Without using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
0
votes
0answers
108 views

Oracle Linux won't mount CentOS NFS share, but Arch will

I am trying to get kerberized NFSv4 running on our network. Server is CentOS 7. I am able to mount the share on my Arch Linux workstation, but not our Oracle Linux 7 database servers. I am trying to ...
3
votes
1answer
6k views

Apache mod_auth_kerb: “Key table entry not found”

I want to use the Apache Module mod_auth_kerb to implement SSO for a web application. With the following config: <VirtualHost 10.5.3.200:443> #Proxy <Proxy *> Order deny,allow Allow from ...
1
vote
0answers
347 views

How to access NFSv4 shared folder with Kerberos authentication without root rights

I'm setting up a NFSv4 shared folder with Kerberos authentication. The issue I'm facing is that when the user on the client machine runs mount /mnt (see the fstab configuration below) he's not able to ...
4
votes
1answer
3k views

How do I clear a user's cached Active Directory password on CentOS 7?

I built a CentOS 7 install on my company laptop and configured it to authenticate to the company AD servers like so: Install packages: yum install sssd realmd oddjob oddjob-mkhomedir adcli samba-...
1
vote
0answers
273 views

Permission denied on NFSv4 shared directory with authentication with SSO (OpenLDAP + Kerberos)

I'm trying to set up Single Sign On (SSO) with Kerberos and LDAP but I have an issue with NFSv4 with Kerberos for authentication and encryption (krb5p) service. My environment: 1 server (named ...
1
vote
2answers
1k views

Can keytab file location be configured in OpenSSH?

We are running OpenSSH server under Debian jessie. We use Kerberos as one of our authentication methods. The standard place to put the Kerberos keytab file on the OpenSSH server is in /etc/krb5.keytab....
1
vote
0answers
359 views

pam_sss access denied with kerberos authentication ok [closed]

I'm trying to use sssd with kerberos authentication and ldap on Ubuntu 18.04 (server and client machine). On Ubuntu client side I installed sssd sssd-tools packages. But when I want to log in to alice,...
1
vote
0answers
44 views

About connecting to Active Directory from CentOS7

I've searched several videos on Youtube, articles in other Stack Exchange sites, and some blogs.. but I couldn't make this done yet.. My environment is Windows Server 2012 RC and CentOS7. 1. I ...
2
votes
2answers
3k views

How would I build a linux based router?

I am looking into building a Linux based router out of a home-built Linux server. I don't have much experience with the software required however. I would like the server to run the following ...
2
votes
0answers
355 views

CIFS mount no longer working

I have several RHEL6 systems with the same configuration. I have had CIFS mounts working for years. However in the past month, it has stopped working on one of my systems and I cannot seem to figure ...
0
votes
1answer
337 views

How nsswitch call sssd for credential?

I'm stuck with Kerberos - sssd - AD. I've tried a lot of things, with lot of googling, in LinuxMint, Ubuntu 16.04 and Debian 9. I have always the same result : kinit username works fine msktutil -u --...
4
votes
0answers
1k views

KrbException: Fail to create credential. (63) - No service creds

I am working on setting up Tomcat 8.0.35 on Ubuntu 16.04 with Oracle Java 1.8.0_91-b14 (not openjdk) to use Kerberos authentication when authenticating to our Microsoft SQL database. The issue I am ...
2
votes
1answer
672 views

Where are AFS tokens stored, and how do I get them into running Screen session

I have the following situation, I have a running GNU screen session where I can't access AFS anymore - my token has expired. I can however access it from a new shell. The difference to this question ...
0
votes
1answer
324 views

Samba integration with existing OpenLDAP, MIT Kerberos and Bind9 services

I have a network domain running OpenLDAP, MIT Kerberos and Bind9. Now I want to enable some MS Windows hosts access to a NAS, in such a way that user credentials stay in my LDAP and Kerberos ...
0
votes
2answers
277 views

Connect to NFS with Kerberos automatically on login

I have a server, Ubuntu 16.04, exporting an NFS share with Kerberos security. I have a laptop client, Ubuntu 17.10, that connects to the server. The client is configured to mount the share using ...
4
votes
1answer
16k views

Java could not get the TGT from cache in Linux client

I have set up a Kerberos server and OpenLDAP in RHEL5.5. I also have a RHEL6 machine as a client. I have run my Java program using jaas to query the OpenLDAP server from the Linux client. I can query ...
2
votes
2answers
6k views

Why do I get “no credentials cache” error when mounting Kerberized NFS share?

I have two systems on a local network, nfsclient (CentOS 7) and nfsserver (CentOS 6). These names correctly resolve to their IP addresses, and Kerberos is working between them (nfsserver is the KDC). ...
2
votes
0answers
189 views

Printing to smb with kerberos auth?

I want to set up a printer via samba client to a Windows printserver. I managed to do it specifying this connection string: smb://user:pass@printserver/printer Is there a way to do auth through ...
2
votes
1answer
169 views

PAM Kerberos and RStudio

I am trying to get Kerberos PAM to pull a ticket and not destroy it after an RStudio login on CentOS 7. My rstudio file in /etc/pam.d/ looks like: #%PAM-1.0 auth required pam_krb5....
2
votes
0answers
242 views

Setting up a kerberized HA NFS share

I'm trying to set up a kerberized NFS share from an HA cluster. I've successfully set up a krb-aware NFS share from a single server, I'm using a mostly identical configuration on the cluster. Exports ...