Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [kerberos]

Kerberos is a network authentication system based on shared key cryptography. It is the underlying authentication system used by current versions of Active Directory and is widely used by large organizations.

4
votes
0answers
1k views

KrbException: Fail to create credential. (63) - No service creds

I am working on setting up Tomcat 8.0.35 on Ubuntu 16.04 with Oracle Java 1.8.0_91-b14 (not openjdk) to use Kerberos authentication when authenticating to our Microsoft SQL database. The issue I am ...
3
votes
0answers
218 views

SSH into server using kerberos service ticket that is not the host principal

I want to ssh into a server that is running OpenSSH. My client is also OpenSSH. The server is configured to accept GSSAPI authentication, but the keytab it uses is non-standard in that the principal ...
3
votes
0answers
746 views

Automatically renew kerberos tickets in GNU screen

I have a program (which I cannnot modify) which runs for > 1 day. I want to start it via SSH in GNU screen and detach then. The remote is a Fedora system using a Kerberos-based file server on which I'...
3
votes
0answers
1k views

kerberos preauth pkinit failed to initialize: No realms configured correctly for pkinit support

I have successfully installed Kerberos on debian wheezy and can perform service authentication (Apache, ssh) with Kerberos tickets from kinit. I would like to use certificates for kinit (pkinit) ...
2
votes
0answers
49 views

How to tell Kerberos where to find the root certificate for LDAP with TLS?

I run two Debian servers with MIT Kerberos and OpenLDAP backend. I would like to enforce TLS and encrypt replication. So I created and added certificates… dn: cn=config changetype: modify add: ...
2
votes
0answers
346 views

CIFS mount no longer working

I have several RHEL6 systems with the same configuration. I have had CIFS mounts working for years. However in the past month, it has stopped working on one of my systems and I cannot seem to figure ...
2
votes
0answers
178 views

Printing to smb with kerberos auth?

I want to set up a printer via samba client to a Windows printserver. I managed to do it specifying this connection string: smb://user:pass@printserver/printer Is there a way to do auth through ...
2
votes
0answers
459 views

How to get persistent (permanent) smb mount using kerberos authentication on RHEL7?

Environment: I have joined a few of my RHEL 7.3 boxes with MS AD domain using realmd/sssd. I have allowed only members of a few allowed groups can login to the box. Credentials caching is disabled. ...
2
votes
0answers
232 views

Setting up a kerberized HA NFS share

I'm trying to set up a kerberized NFS share from an HA cluster. I've successfully set up a krb-aware NFS share from a single server, I'm using a mostly identical configuration on the cluster. Exports ...
2
votes
0answers
351 views

Uppercase usernames in Kerberos principals upon SSH login with password entry

We've been having trouble with users logging in to our Linux machines and the username part of their Kerberos principal being in uppercase. This is a disaster for the security policies on our Hadoop ...
2
votes
0answers
185 views

openldap integration with MIT kerberos

I am integrating openldap with MIT kerberos and have couple of questions regarding that. I was able to do this integration and kerberos services only starting with ldap_kerberos_container_dn = cn=...
2
votes
0answers
320 views

Changing Active Directory password for service account in Linux

I am really new to but I am trying to use Kerberos to authenticate my active directory service account from my own CentOS 7 box, after which I then proceed to run queries in a remote database using ...
2
votes
0answers
305 views

mount.cifs without put user password again

I'm already did the login with user an generate kerberos file: #klist Ticket cache: FILE:/tmp/krb5cc_625342619 Default principal: wecitrixteste@MYDOMAIN.CORPDOMAIN.COM Valid starting Expires ...
2
votes
0answers
123 views

Apache: how to access files using the requesting user's credentials?

I have a domain-joined (via samba/sssd) CentOS 7 server, acting as a SFTP server, which has a mountpoint mapped to a Windows' share: SFTP Client -> Linux SFTP Server -> Windows File Server My goal ...
2
votes
0answers
22 views

How to allow users to register for a single signon account from mit kerberos?

Is there a way to allow users to register for a single sign on account for an mit kerberos server via a web interface of some sort?
2
votes
0answers
927 views

tmp/krb5cc_[uid] is not getting purged regularly (kerberos credentials cache)

A user wasn't able to authenticate using Kerberos because it wasn't able to create /tmp/krb5cc_[uid]. This was because /tmp ran out of inode space, as there were innumerable Kerberos credential cache ...
1
vote
0answers
101 views

Alternative to autofs to mount CIFS folders in user home folders in multi-user environment

My use case seems very simple. I want to automount CIFS folder CIFS1 and CIFS2 which exist for all users on my fileserver in each user home during login on this multi-user 18.04 Ubuntu machine. So ...
1
vote
0answers
174 views

Debian Stretch: Samba Winbind Offline Logon Not working - kerberos keytab not persistent after reboot?

This is being tried onDebian stretch referred to as 9.6 in /etc/debian_version I'm in a Windows Domain environment with two 2012R2 controllers that have IDMU/Unix Attributes. Other versions of stuff:...
1
vote
0answers
919 views

“incorrect mount option was specified” when mounting krb5p nfs4 partition on Ubuntu

I have a NFS4 share running with krb5p. I have no problems accessing it from CentOS clients, all that is required is: yum install krb5-workstation setup krb5 (edit krb5.conf, setup keytab) systemctl ...
1
vote
0answers
322 views

How to access NFSv4 shared folder with Kerberos authentication without root rights

I'm setting up a NFSv4 shared folder with Kerberos authentication. The issue I'm facing is that when the user on the client machine runs mount /mnt (see the fstab configuration below) he's not able to ...
1
vote
0answers
265 views

Permission denied on NFSv4 shared directory with authentication with SSO (OpenLDAP + Kerberos)

I'm trying to set up Single Sign On (SSO) with Kerberos and LDAP but I have an issue with NFSv4 with Kerberos for authentication and encryption (krb5p) service. My environment: 1 server (named ...
1
vote
0answers
40 views

About connecting to Active Directory from CentOS7

I've searched several videos on Youtube, articles in other Stack Exchange sites, and some blogs.. but I couldn't make this done yet.. My environment is Windows Server 2012 RC and CentOS7. 1. I ...
1
vote
0answers
3k views

How to use authentication with negiotiation (e.g. Kerberos) to HTTP proxy?

Generally accepted is the use of HTTP_PROXY/HTTPS_PROXY environment variables to specify the use of a proxy server. Authentication can be included in this URL, e.g. HTTP_PROXY=http://user:pass@myproxy....
1
vote
0answers
67 views

Unexpected error when joining computer to AC/DC Samba 4

I present the problem: On a PC with 32-bit Debian Jessie, using Samba 4.1.7 I have a Domain Controller, it has been running for 2 years but since 2 weeks ago it is giving me the following error: When ...
1
vote
0answers
272 views

Renew kerberos ticket in tmux

I have two servers, server 1 and server 2. To login onto each server, I need a valid kerberos ticket, the same ticket is valid for both servers. If I run a tmux session on server 1, with several ...
1
vote
0answers
375 views

pipe password of kinit over ssh

Disclaimer: I'm creating a quick and dirty script for my own personal use, I'm aware that this isn't the correct way to do things. I want to initialize a kinit on a remote host (no keytab available). ...
1
vote
0answers
162 views

How to connect Kerberos with multiple LDAP servers?

My actual task is to make our kerberized Hadoop cluster usable by all our teams. Right now we have a very weird setup in our company: The Hadoop cluster has a dedicated KDC (openSUSE Kerberos with ...
1
vote
0answers
485 views

Server: Using Active Directory Groups For Sudo Fails Unless Name of File in /etc/sudoers Matches The Name Of The AD Group

I work for an organization with many linux servers that we'd like to start authenticating with Active Directory. I have a proof-of-concept server set up on which I use SSSD and Kerberos to ...
1
vote
0answers
92 views

'Merging' Local Server and AD Accounts

I am investigating LDAP-bridge options, but have a hurdle to overcome: pre-existing local accounts. There are a large number of *nix servers (hundreds) with local accounts on them formatted in all ...
1
vote
0answers
403 views

How do I setup a connection to a database over a SSH-Tunnel with kerberos in a gui?

I need to connect to a Mysql database on a server that is only accessible over ssh with a Kerberos ticket. In a console this is easy, I only do: kinit (then enter password) ssh username@server (...
1
vote
0answers
257 views

Kerberos net ads join doesn't respond

I'm trying to join Active Directory in Xubuntu 16.04 in a enterprise business enviroment so I'll change the name of my REALM by MY.EXAMPLE.CORP. My issue is: when I run net ads join -U Administrator ...
1
vote
0answers
66 views

Authentication for Both windows and Unix users

We have Active directory to authenticate users for windows machines. We have nis to authenticate linux users. These users are using both windows as well as Linux. They are using two different ...
1
vote
0answers
2k views

CentOS 6.8 + Samba4 + Kerberos: No credentials cache found

I am trying to release a server using ‍‍CentOS 6.8 + Samba4 (Winbind - LDAP + Kerberos) + NSS. I was able to join the domain, but I still getting this warning/error message: [root@snfs2 ~]# net ads ...
1
vote
0answers
1k views

realmd join AD and Cross Domain Auth

Small issue with realmd, I use realm join with a kerberos token generated before the join, it's working fine on a simple Active Directory Configuration My issue is when realm join must join a domain ...
1
vote
0answers
4k views

Adding CentOS 7 to Active Directory

I am having a hard time adding a CentOS 7 machine to my domain (Active Directory 2012 running in Windows 2008 mode). I am using realmd to join the machine to the domain. Here is what I have checked so ...
1
vote
0answers
662 views

kerberos : kinit not picking up updated values in krb5.conf

We are running kinit from our Linux command line and this works well. Before we run kinit we set the KRB5_CONFIG environment variable to point to directory continaing krb5.conf file linuxhost1$ ...
1
vote
0answers
514 views

How is a username determined and can I hide the domain component in a winbind username?

Someone asked a question on Server Fault about a problem which I'm also having but no one has answered it so I'm posing a slightly different question to try and figure it out myself. I've configured ...
1
vote
0answers
184 views

How to obtain current user environment in pam_script?

I'm running pam_script after pam_krb5 with a session open script. In my script, I need to use the ticket cache generated by krb5 to do something. Well, the script was actually run as root, and ...
1
vote
0answers
143 views

How do I setup kerberos authetication in Fedora 19

I cannnot seem to find documentation on setting up Kerberos authentication on my Fedora 19 workstation. Which files and programs are involved? My Kerberos server is a corporate AD.
0
votes
0answers
6 views

Kerberos fallback to app login

I have to mount a SSO to connect to a GLPI application. For some reason NTML don't work, but we managed to get kerberos functionnal. I would like to authenticate against Kerberos, but if that fails, ...
0
votes
0answers
31 views

Kerberos key fails with AutoFS

Our Kubuntu computers are configured to automatically connect to their network drive via AutoFS. When we upgrade machines to Kubuntu 18.04 LTS this AutoFS connection no longer works. It is still ...
0
votes
0answers
85 views

Freeipa client on debian 9 - Cannot find user error

EDIT 1: added solution, pam was faulty i'm trying to set up freeipa client on debian 9 client using this guide: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/...
0
votes
0answers
45 views

kinit using keytab fails while using password succeeds

I'm facing a strange problem configuring KRB5 on Ubuntu 16.04 using Windows 2012 DCs as KDC. Calling kinit with an service AD account succeeds, if the password is provided to kinit's password prompt, ...
0
votes
0answers
250 views

Access Windows share via CIFS and Kerberos: “Key has been revoked”

I'm trying to mount a Windows share on a Linux host (Ubuntu 16.04) using Kerberos / Active Directory authentication. The Linux host has been joined to the AD, and I can access shares on it from the ...
0
votes
0answers
139 views

Allow NTLM Authentication after inclusion in Windows Domain

In a user session outside of domain authentication, I had NTLM authentication working for web requests sending Auth headers: WWW-Authenticate: Negotiate WWW-Authenticate: NTLM But, now I've ...
0
votes
0answers
23 views

openstack keystone and kerberos

I have integrated the openstack and kerberos using the link provided here : https://www.jamielennox.net/blog/2015/02/12/step-by-step-kerberized-keystone/ It is successfully installed and I am able to ...
0
votes
0answers
10 views

Enforce the usage of a different DNS domain for servicePrincipalNames

For mostly historic reasons our default DNS domain (lets call it new.example.net) differs from our Kerberos REALM (OLD.EXAMPLE.COM) Actually the KDC (an Active Directory Server) does not know about ...
0
votes
0answers
215 views

How to generate keytab for headless AD user

I was provided a headless Active Directory user account with a randomly generated password we need to use to access some network resources. Since this headless account will need to be run from an ...
0
votes
0answers
261 views

mount a cifs share with kerberos on linux with a sssd/kcm kerberos client

As a non-root user I would like to mount a samba share on my Fedora Linux with kerberos (non-password). I have a kerberos client running (sssd with the kcm server for kerberos tickets). when i do a ...
0
votes
0answers
100 views

Oracle Linux won't mount CentOS NFS share, but Arch will

I am trying to get kerberized NFSv4 running on our network. Server is CentOS 7. I am able to mount the share on my Arch Linux workstation, but not our Oracle Linux 7 database servers. I am trying to ...