Questions tagged [kerberos]

Kerberos is a network authentication system based on shared key cryptography. It is the underlying authentication system used by current versions of Active Directory and is widely used by large organizations.

68 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
1k views

KrbException: Fail to create credential. (63) - No service creds

I am working on setting up Tomcat 8.0.35 on Ubuntu 16.04 with Oracle Java 1.8.0_91-b14 (not openjdk) to use Kerberos authentication when authenticating to our Microsoft SQL database. The issue I am ...
3
votes
0answers
225 views

SSH into server using kerberos service ticket that is not the host principal

I want to ssh into a server that is running OpenSSH. My client is also OpenSSH. The server is configured to accept GSSAPI authentication, but the keytab it uses is non-standard in that the principal ...
3
votes
0answers
795 views

Automatically renew kerberos tickets in GNU screen

I have a program (which I cannnot modify) which runs for > 1 day. I want to start it via SSH in GNU screen and detach then. The remote is a Fedora system using a Kerberos-based file server on which I'...
3
votes
0answers
1k views

kerberos preauth pkinit failed to initialize: No realms configured correctly for pkinit support

I have successfully installed Kerberos on debian wheezy and can perform service authentication (Apache, ssh) with Kerberos tickets from kinit. I would like to use certificates for kinit (pkinit) ...
3
votes
2answers
3k views

Failed to join domain: failed to set machine kerberos encryption types: Insufficient access

Has anyone gotten this error when trying to join CentOS 7 to Active Directory? I tried various ways(via cli, gui, tui) and always get same error. Failed to join domain: failed to set machine kerberos ...
3
votes
1answer
985 views

Kerberos Forwarding in SSSD

So, I'm trying to set up forwarding with Kerberos and seem to have some problems. On some of my servers I'm able to forward after receiving a ticket; however, some I'm not. My system setup is a ...
2
votes
0answers
54 views

How to tell Kerberos where to find the root certificate for LDAP with TLS?

I run two Debian servers with MIT Kerberos and OpenLDAP backend. I would like to enforce TLS and encrypt replication. So I created and added certificates… dn: cn=config changetype: modify add: ...
2
votes
0answers
369 views

CIFS mount no longer working

I have several RHEL6 systems with the same configuration. I have had CIFS mounts working for years. However in the past month, it has stopped working on one of my systems and I cannot seem to figure ...
2
votes
0answers
198 views

Printing to smb with kerberos auth?

I want to set up a printer via samba client to a Windows printserver. I managed to do it specifying this connection string: smb://user:pass@printserver/printer Is there a way to do auth through ...
2
votes
0answers
492 views

How to get persistent (permanent) smb mount using kerberos authentication on RHEL7?

Environment: I have joined a few of my RHEL 7.3 boxes with MS AD domain using realmd/sssd. I have allowed only members of a few allowed groups can login to the box. Credentials caching is disabled. ...
2
votes
1answer
175 views

PAM Kerberos and RStudio

I am trying to get Kerberos PAM to pull a ticket and not destroy it after an RStudio login on CentOS 7. My rstudio file in /etc/pam.d/ looks like: #%PAM-1.0 auth required pam_krb5....
2
votes
0answers
254 views

Setting up a kerberized HA NFS share

I'm trying to set up a kerberized NFS share from an HA cluster. I've successfully set up a krb-aware NFS share from a single server, I'm using a mostly identical configuration on the cluster. Exports ...
2
votes
0answers
372 views

Uppercase usernames in Kerberos principals upon SSH login with password entry

We've been having trouble with users logging in to our Linux machines and the username part of their Kerberos principal being in uppercase. This is a disaster for the security policies on our Hadoop ...
2
votes
0answers
191 views

openldap integration with MIT kerberos

I am integrating openldap with MIT kerberos and have couple of questions regarding that. I was able to do this integration and kerberos services only starting with ldap_kerberos_container_dn = cn=...
2
votes
0answers
312 views

mount.cifs without put user password again

I'm already did the login with user an generate kerberos file: #klist Ticket cache: FILE:/tmp/krb5cc_625342619 Default principal: wecitrixteste@MYDOMAIN.CORPDOMAIN.COM Valid starting Expires ...
2
votes
0answers
123 views

Apache: how to access files using the requesting user's credentials?

I have a domain-joined (via samba/sssd) CentOS 7 server, acting as a SFTP server, which has a mountpoint mapped to a Windows' share: SFTP Client -> Linux SFTP Server -> Windows File Server My goal ...
2
votes
0answers
22 views

How to allow users to register for a single signon account from mit kerberos?

Is there a way to allow users to register for a single sign on account for an mit kerberos server via a web interface of some sort?
2
votes
1answer
7k views

Kerberos/Samba can't join Active Directory [DEBIAN 8]

I have an issue when I try to join my domain. I am able to create the kerberos ticket successfully. root@debian:~# kinit Administrateur@ASP.DOMAIN Password for Administrateur@ASP.DOMAIN: root@debian:...
2
votes
1answer
678 views

Utilizing Samba Shares Without using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
2
votes
0answers
941 views

tmp/krb5cc_[uid] is not getting purged regularly (kerberos credentials cache)

A user wasn't able to authenticate using Kerberos because it wasn't able to create /tmp/krb5cc_[uid]. This was because /tmp ran out of inode space, as there were innumerable Kerberos credential cache ...
1
vote
0answers
173 views

Alternative to autofs to mount CIFS folders in user home folders in multi-user environment

My use case seems very simple. I want to automount CIFS folder CIFS1 and CIFS2 which exist for all users on my fileserver in each user home during login on this multi-user 18.04 Ubuntu machine. So ...
1
vote
0answers
220 views

Debian Stretch: Samba Winbind Offline Logon Not working - kerberos keytab not persistent after reboot?

This is being tried onDebian stretch referred to as 9.6 in /etc/debian_version I'm in a Windows Domain environment with two 2012R2 controllers that have IDMU/Unix Attributes. Other versions of stuff:...
1
vote
0answers
1k views

“incorrect mount option was specified” when mounting krb5p nfs4 partition on Ubuntu

I have a NFS4 share running with krb5p. I have no problems accessing it from CentOS clients, all that is required is: yum install krb5-workstation setup krb5 (edit krb5.conf, setup keytab) systemctl ...
1
vote
0answers
365 views

How to access NFSv4 shared folder with Kerberos authentication without root rights

I'm setting up a NFSv4 shared folder with Kerberos authentication. The issue I'm facing is that when the user on the client machine runs mount /mnt (see the fstab configuration below) he's not able to ...
1
vote
0answers
289 views

Permission denied on NFSv4 shared directory with authentication with SSO (OpenLDAP + Kerberos)

I'm trying to set up Single Sign On (SSO) with Kerberos and LDAP but I have an issue with NFSv4 with Kerberos for authentication and encryption (krb5p) service. My environment: 1 server (named ...
1
vote
0answers
45 views

About connecting to Active Directory from CentOS7

I've searched several videos on Youtube, articles in other Stack Exchange sites, and some blogs.. but I couldn't make this done yet.. My environment is Windows Server 2012 RC and CentOS7. 1. I ...
1
vote
0answers
3k views

How to use authentication with negiotiation (e.g. Kerberos) to HTTP proxy?

Generally accepted is the use of HTTP_PROXY/HTTPS_PROXY environment variables to specify the use of a proxy server. Authentication can be included in this URL, e.g. HTTP_PROXY=http://user:pass@myproxy....
1
vote
0answers
68 views

Unexpected error when joining computer to AC/DC Samba 4

I present the problem: On a PC with 32-bit Debian Jessie, using Samba 4.1.7 I have a Domain Controller, it has been running for 2 years but since 2 weeks ago it is giving me the following error: When ...
1
vote
0answers
287 views

Renew kerberos ticket in tmux

I have two servers, server 1 and server 2. To login onto each server, I need a valid kerberos ticket, the same ticket is valid for both servers. If I run a tmux session on server 1, with several ...
1
vote
0answers
393 views

pipe password of kinit over ssh

Disclaimer: I'm creating a quick and dirty script for my own personal use, I'm aware that this isn't the correct way to do things. I want to initialize a kinit on a remote host (no keytab available). ...
1
vote
0answers
169 views

How to connect Kerberos with multiple LDAP servers?

My actual task is to make our kerberized Hadoop cluster usable by all our teams. Right now we have a very weird setup in our company: The Hadoop cluster has a dedicated KDC (openSUSE Kerberos with ...
1
vote
0answers
499 views

Server: Using Active Directory Groups For Sudo Fails Unless Name of File in /etc/sudoers Matches The Name Of The AD Group

I work for an organization with many linux servers that we'd like to start authenticating with Active Directory. I have a proof-of-concept server set up on which I use SSSD and Kerberos to ...
1
vote
0answers
341 views

Changing Active Directory password for service account in Linux

I am really new to but I am trying to use Kerberos to authenticate my active directory service account from my own CentOS 7 box, after which I then proceed to run queries in a remote database using ...
1
vote
0answers
94 views

'Merging' Local Server and AD Accounts

I am investigating LDAP-bridge options, but have a hurdle to overcome: pre-existing local accounts. There are a large number of *nix servers (hundreds) with local accounts on them formatted in all ...
1
vote
0answers
415 views

How do I setup a connection to a database over a SSH-Tunnel with kerberos in a gui?

I need to connect to a Mysql database on a server that is only accessible over ssh with a Kerberos ticket. In a console this is easy, I only do: kinit (then enter password) ssh username@server (...
1
vote
0answers
274 views

Kerberos net ads join doesn't respond

I'm trying to join Active Directory in Xubuntu 16.04 in a enterprise business enviroment so I'll change the name of my REALM by MY.EXAMPLE.CORP. My issue is: when I run net ads join -U Administrator ...
1
vote
0answers
68 views

Authentication for Both windows and Unix users

We have Active directory to authenticate users for windows machines. We have nis to authenticate linux users. These users are using both windows as well as Linux. They are using two different ...
1
vote
0answers
3k views

CentOS 6.8 + Samba4 + Kerberos: No credentials cache found

I am trying to release a server using ‍‍CentOS 6.8 + Samba4 (Winbind - LDAP + Kerberos) + NSS. I was able to join the domain, but I still getting this warning/error message: [root@snfs2 ~]# net ads ...
1
vote
1answer
65 views

How can I set kerberos principal in environment automatically on the remote host?

I use both legacy krsh and ssh to login to a variety of boxes for root administration, as do several colleagues of mine. We all keep different history files by use of a variable calculated by running ...
1
vote
0answers
1k views

realmd join AD and Cross Domain Auth

Small issue with realmd, I use realm join with a kerberos token generated before the join, it's working fine on a simple Active Directory Configuration My issue is when realm join must join a domain ...
1
vote
0answers
4k views

Adding CentOS 7 to Active Directory

I am having a hard time adding a CentOS 7 machine to my domain (Active Directory 2012 running in Windows 2008 mode). I am using realmd to join the machine to the domain. Here is what I have checked so ...
1
vote
1answer
447 views

How can I run unattended processes as authenticated AD/LDAP users?

I'm switching some servers over to Debian 8 and using realmd for Active Directory (LDAP/Kerberos) authentication. This has been working great and allows Domain Users to login to my server, etc. ...
1
vote
2answers
490 views

How can I install kerberised services on debian?

I installed kerberos in my debian environment and made it work with SSH. I also would like to try it with other services but I could not install them on debian. I followed several tutorials e.g. ...
1
vote
0answers
682 views

kerberos : kinit not picking up updated values in krb5.conf

We are running kinit from our Linux command line and this works well. Before we run kinit we set the KRB5_CONFIG environment variable to point to directory continaing krb5.conf file linuxhost1$ ...
1
vote
0answers
517 views

How is a username determined and can I hide the domain component in a winbind username?

Someone asked a question on Server Fault about a problem which I'm also having but no one has answered it so I'm posing a slightly different question to try and figure it out myself. I've configured ...
1
vote
1answer
988 views

kdb5_ldap_util fails with cryptic error

Supposedly, in order to set up Kerberos, I need to run kdb5_ldap_util, though I'm not sure why. However, it fails with: # kdb5_ldap_util -D cn=admin,dc=example,dc=com create -subtrees dc=example,dc=...
1
vote
0answers
185 views

How to obtain current user environment in pam_script?

I'm running pam_script after pam_krb5 with a session open script. In my script, I need to use the ticket cache generated by krb5 to do something. Well, the script was actually run as root, and ...
1
vote
0answers
145 views

How do I setup kerberos authetication in Fedora 19

I cannnot seem to find documentation on setting up Kerberos authentication on my Fedora 19 workstation. Which files and programs are involved? My Kerberos server is a corporate AD.
1
vote
1answer
215 views

kinit returns error salt type 3 unsupported on FreeBSD 9.1-RELEASE install

When attempting to run kinit to log into a Kerberos V5 realm I get the following error on a default install FreeBSD 9.1-RELEASE kinit: krb5_get_init_creds: salt type 3 not supported Any ideas?
0
votes
0answers
8 views

Kerberos fallback to app login

I have to mount a SSO to connect to a GLPI application. For some reason NTML don't work, but we managed to get kerberos functionnal. I would like to authenticate against Kerberos, but if that fails, ...