Questions tagged [kerberos]

Kerberos is a network authentication system based on shared key cryptography. It is the underlying authentication system used by current versions of Active Directory and is widely used by large organizations.

1
vote
0answers
517 views

How is a username determined and can I hide the domain component in a winbind username?

Someone asked a question on Server Fault about a problem which I'm also having but no one has answered it so I'm posing a slightly different question to try and figure it out myself. I've configured ...
1
vote
1answer
977 views

kdb5_ldap_util fails with cryptic error

Supposedly, in order to set up Kerberos, I need to run kdb5_ldap_util, though I'm not sure why. However, it fails with: # kdb5_ldap_util -D cn=admin,dc=example,dc=com create -subtrees dc=example,dc=...
1
vote
1answer
4k views

How does Linux winbindd determine available domain controller?

We are actually in preparation of taking down one of our three domain controller (Win2k3). They are all serving the same domain. Actually we still see connections incoming from Debian (5/6/7) Servers ...
1
vote
0answers
185 views

How to obtain current user environment in pam_script?

I'm running pam_script after pam_krb5 with a session open script. In my script, I need to use the ticket cache generated by krb5 to do something. Well, the script was actually run as root, and ...
1
vote
0answers
144 views

How do I setup kerberos authetication in Fedora 19

I cannnot seem to find documentation on setting up Kerberos authentication on my Fedora 19 workstation. Which files and programs are involved? My Kerberos server is a corporate AD.
1
vote
1answer
215 views

kinit returns error salt type 3 unsupported on FreeBSD 9.1-RELEASE install

When attempting to run kinit to log into a Kerberos V5 realm I get the following error on a default install FreeBSD 9.1-RELEASE kinit: krb5_get_init_creds: salt type 3 not supported Any ideas?
0
votes
2answers
279 views

Connect to NFS with Kerberos automatically on login

I have a server, Ubuntu 16.04, exporting an NFS share with Kerberos security. I have a laptop client, Ubuntu 17.10, that connects to the server. The client is configured to mount the share using ...
0
votes
1answer
342 views

How nsswitch call sssd for credential?

I'm stuck with Kerberos - sssd - AD. I've tried a lot of things, with lot of googling, in LinuxMint, Ubuntu 16.04 and Debian 9. I have always the same result : kinit username works fine msktutil -u --...
0
votes
2answers
360 views

What are the requirements for a Kerberos realm name?

Every example I have seen so far of a valid Kerberos realm name is of the form "example.com". None of the pages I have read give the actual naming rules. What are the naming rules? Must a Kerberos ...
0
votes
1answer
277 views

Cannot mount nfsv4 exports

i tried to setup nfsv4 server and client on centos7.3,both server(ark-centos7-ker ),client(ark-centos-smb4) are joined to AD domain by realm command,AD domain users could log in to centos server run ...
0
votes
1answer
2k views

Why is my kerberos ticket not working?

I'm trying to ssh to another machine but my kinit is not working: $ ssh nik@social-1-r.referens.sys.XXXXXXX.se Permission denied (publickey,gssapi-keyex,gssapi-with-mic). Kerberos is used for ...
0
votes
1answer
115 views

How to mount cifs with kerberos for a generic user?

I am able to mount a corporate shared directory on my AWS Workspace manually but I need to do this for all users. $ sudo ksu [sudo] password for <Domain>\<User.Name>: Leaving uid as root ...
0
votes
1answer
1k views

SSH with Kerberos Auth not working

I'm trying to log in my Linux VM with SSH using kerberos authentication. My Linux VM has successfully joined my AD using realmd / sssd method. I changed my sshd_config settings to : ...
0
votes
1answer
167 views

What problems could I have if I use the same keytab for all Linux servers authenticating against Active Directory?

Today I use the same keytab for all Linux servers (hundreds). I'm considering using a different keytab for each machine because I suppose that if I use the same keytab the Active Directory thinks I ...
0
votes
1answer
513 views

How to keep a long-running process run with Kerberos and Andrew file system?

I am running a bash script on a Scientific Linux server. The script has a loop for copying files and running some programs. The process for running the script probably takes a day or two. But I always ...
0
votes
1answer
828 views

Can't add any principals in Kerberos

I recently botched a Kerberos install and have been trying to follow the walkthrough here. However, now I've reached an awkward impasse and cannot add any principals. Using kadmin.local I receive ...
0
votes
1answer
3k views

How do I disable Kereberos preauthentication?

I'm seeing this error message: NEEDED_PREAUTH: admin@THIS.LAN for for kadmin/admin@THIS.LAN, Additional pre-authentication required How do I disable Kerberos pre-authentication? The server and ...
0
votes
0answers
7 views

Kerberos fallback to app login

I have to mount a SSO to connect to a GLPI application. For some reason NTML don't work, but we managed to get kerberos functionnal. I would like to authenticate against Kerberos, but if that fails, ...
0
votes
1answer
59 views

Kerberos key fails with AutoFS

Our Kubuntu computers are configured to automatically connect to their network drive via AutoFS. When we upgrade machines to Kubuntu 18.04 LTS this AutoFS connection no longer works. It is still ...
0
votes
1answer
46 views

centos and kerberized nfs works fine but only for nfs3

I want to mount a nfs4 kerberized share. I'm on centos7, the kerberos server is Freeipa,the client is centos7. The problem is my configuration is working for nfs3 but not for nfs4. First I put my ...
0
votes
0answers
116 views

Freeipa client on debian 9 - Cannot find user error

EDIT 1: added solution, pam was faulty i'm trying to set up freeipa client on debian 9 client using this guide: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/...
0
votes
0answers
67 views

kinit using keytab fails while using password succeeds

I'm facing a strange problem configuring KRB5 on Ubuntu 16.04 using Windows 2012 DCs as KDC. Calling kinit with an service AD account succeeds, if the password is provided to kinit's password prompt, ...
0
votes
0answers
337 views

Access Windows share via CIFS and Kerberos: “Key has been revoked”

I'm trying to mount a Windows share on a Linux host (Ubuntu 16.04) using Kerberos / Active Directory authentication. The Linux host has been joined to the AD, and I can access shares on it from the ...
0
votes
0answers
182 views

Allow NTLM Authentication after inclusion in Windows Domain

In a user session outside of domain authentication, I had NTLM authentication working for web requests sending Auth headers: WWW-Authenticate: Negotiate WWW-Authenticate: NTLM But, now I've ...
0
votes
0answers
25 views

openstack keystone and kerberos

I have integrated the openstack and kerberos using the link provided here : https://www.jamielennox.net/blog/2015/02/12/step-by-step-kerberized-keystone/ It is successfully installed and I am able to ...
0
votes
0answers
10 views

Enforce the usage of a different DNS domain for servicePrincipalNames

For mostly historic reasons our default DNS domain (lets call it new.example.net) differs from our Kerberos REALM (OLD.EXAMPLE.COM) Actually the KDC (an Active Directory Server) does not know about ...
0
votes
0answers
268 views

How to generate keytab for headless AD user

I was provided a headless Active Directory user account with a randomly generated password we need to use to access some network resources. Since this headless account will need to be run from an ...
0
votes
0answers
285 views

mount a cifs share with kerberos on linux with a sssd/kcm kerberos client

As a non-root user I would like to mount a samba share on my Fedora Linux with kerberos (non-password). I have a kerberos client running (sssd with the kcm server for kerberos tickets). when i do a ...
0
votes
0answers
108 views

Oracle Linux won't mount CentOS NFS share, but Arch will

I am trying to get kerberized NFSv4 running on our network. Server is CentOS 7. I am able to mount the share on my Arch Linux workstation, but not our Oracle Linux 7 database servers. I am trying to ...
0
votes
1answer
325 views

Samba integration with existing OpenLDAP, MIT Kerberos and Bind9 services

I have a network domain running OpenLDAP, MIT Kerberos and Bind9. Now I want to enable some MS Windows hosts access to a NAS, in such a way that user credentials stay in my LDAP and Kerberos ...
0
votes
1answer
61 views

How does Kerberos know it's me?

I log into my remote server as root (I know it's bad practice). I kinit as my principal. I do whatever I have to do, then exit from the remote server. Next time I ssh in, I klist, and I'm already ...
0
votes
0answers
76 views

AFS not working after Upgrade to Debian 9

We are using Debian 8 and 9 with Gnome 3 / KDE 5, kerberos authentification and an AFS filesystem. Debian 8 works fine, but after Upgrading some PCs to Debian 9 we have the following problem: Gnome ...
0
votes
1answer
413 views

What to do if SetEnvIf regex could not be compiled

In our company we are working with apache vhosts and kerberos. I changed the kerberos.inc file. I added one line: SetEnvIf X-Forwarded-For ^1\.[1-3]\.[0-255]\.[1-254] env_var Now when I'm ...
0
votes
1answer
401 views

Authorized authentication by public key ssh , when active directory disabled account [duplicate]

Good Morning , Why can I still authenticate with a public key via ssh while my account is disabled on active directory? My infrastructure is CentOS and authentication by active directory with ...
0
votes
1answer
681 views

Samba does not perform reverse mapping for sssd users

I have configured the users through SSSD native AD support. However when I try to access the share it's mapped as "Unix User\username@domain" instead of "domain\username". My sssd: [sssd] ...
0
votes
1answer
135 views

Kerberos in Ubuntu system

I would build a kerberos authentication system on Ubuntu based machines. So i have some questions: 1)What do i need to make client-KDC-server? Do i need a domain controller? 2)How man machines do i ...
0
votes
1answer
659 views

FreeTDS missing encryption support to connect to MS SQL

I'm running a Gentoo Linux and I'm trying to connect to MS SQL via pyodbc using freetds. I enabled the debug log in freetds. Now when I try to connect I'm seeing this: 18:13:00.841828 13523 (net.c:...
0
votes
1answer
65 views

OS X Directory Services

I have been reading from Advanced Programming in the UNIX environment (Stevenson and Rago), and I am currently reading about how user data is stored on various systems, including Linux, FreeBSD, and ...
0
votes
1answer
364 views

Kerberos/LDAP login fails - remove Preauth?

Using a Debian system with a Kerberos/LDAP client - login fails on KDE as a user directory isn't being created. SSH is successful (and no directory is created); however, desktop login isn't. I've ...
0
votes
1answer
804 views

Troubleshooting GSS-API error on one client authenticating to Kerberos

When authenticating to kadmin with one client of many, it fails with kadmin: GSS-API (or Kerberos) error while initializing kadmin interface. The Kerberos host is specified with its subnet address. ...
0
votes
0answers
1k views

RSAT : Samba 4 Server not operational

Samba 4 now supports GPO and management through the Active Directory Windows console. But, when I open it after installation, I cannot access the server nor the domain. The message returned is that ...
-1
votes
2answers
571 views

after power outage no permissions to access samba share from windows machines on the same domain

I am running a ClearCase server on RHEL 6.7. We had a power outage last night (for the life of me I do not know why we don't have damn UPS). At any rate, when the machine was brought back up, we are ...
-1
votes
1answer
317 views

Does Tomcat with Kerberos need a keytab file linked with a specific user?

We are trying to setup a tomcat server on RHEL 6.5 to use Kerberos authentication. We have tried to follow this guide, but it seems more appropriate for a Windows implementation. In our environment, ...