Questions tagged [kerberos]

Kerberos is a network authentication system based on shared key cryptography. It is the underlying authentication system used by current versions of Active Directory and is widely used by large organizations.

Filter by
Sorted by
Tagged with
0
votes
1answer
2k views

kinit using keytab fails while using password succeeds

I'm facing a strange problem configuring KRB5 on Ubuntu 16.04 using Windows 2012 DCs as KDC. Calling kinit with an service AD account succeeds, if the password is provided to kinit's password prompt, ...
2
votes
1answer
1k views

Utilizing Samba Shares Without using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
0
votes
0answers
76 views

SSO Kerberos Apache2 “No key table entry found matching” error

I am working on a wordpress page that uses NTLM SSO with LDAP Integration. The problem that I am having is that, for some reasons when you acces the website I am getting a 500 Internal server error ...
0
votes
1answer
40 views

SSH doesn't prompt for new password when expired

I'd like to setup SSH to prompt for a new password when a user's existing one is expired, but currently it just fails to login. I use Kerberos as an authentication backend. You can see this user's ...
1
vote
1answer
2k views

Samba winbind: how to authenticate from trusted AD domain (one-way trust)?

Hello linux newbie here. What I am trying to achieve: to be able to login to Linux machine with Active Directory credentials from trusted domain. I have the following setup: +...
0
votes
0answers
263 views

SUSE 15 SP2 AD Authentication: Server not found in Kerberos database

I am trying to configure configure Active Directory authentication on a SLE 15 SP2 host. The AD-domain exists of multiple DCs/AD-servers. I followed these guides: https://www.suse.com/c/the-sssd-...
2
votes
0answers
19 views

NFS server with more secure export control

Is it possible to restrict access to a NFS server to machines based on some kind of key, password or token, instead on just an IP address? I would like to exports a /home folder with user files to ...
0
votes
0answers
321 views

Centos 8 apache kerberos authentication sso

For some reason I am unable to authenticate via sso to internal website when you connect it directly via cname. Centos linux is joined in the domain itself. What happens is that when I enter the ...
5
votes
1answer
2k views

When using an SSH alias, why is SSH ignoring my (valid) Kerberos ticket?

I am successfully connecting to my university's network via ssh with Kerberos ticket authentication. Normal, verbose operation (kinit a ticket, then ssh user@hostname) works fine. The Problem When ...
2
votes
1answer
9k views

Kerberos/Samba can't join Active Directory [DEBIAN 8]

I have an issue when I try to join my domain. I am able to create the kerberos ticket successfully. root@debian:~# kinit Administrateur@ASP.DOMAIN Password for Administrateur@ASP.DOMAIN: root@debian:...
5
votes
4answers
10k views

NFS + Kerberos: access denied by server while mounting

I have NFS&Kerberos configured as described here: How do I configure a Kerberos NFS server on Red Hat Enterprise Linux 7 All diagnostics operations come fine, but when I try to mount my shares on ...
0
votes
1answer
206 views

mount in fstab with krb5 at login

I have a cifs fileshare that I use. My organisation requires that it uses Kerberos so it's mounted with sec=krb5. This is fine, but I'd like it to mount after login automatically without having to ...
0
votes
0answers
168 views

alpine krb5 install kerberos commands missing in docker container

I have created a docker image based on alpine 3.8 that includes krb5. I can then create a container and I can see that krb5 packages are installed but none of the kerberos commands are in the /bin e.g ...
2
votes
2answers
4k views

Unable to start nfs-secure-server?

I want to make kerberized nfs server on my machine, I follow these steps: /etc/krb5.keytab systemctl enable nfs-sever; systemctl start nfs-server systemctl enable nfs-secure-server; systemctl start ...
0
votes
0answers
84 views

How can I authenticate to Linux from AD using a KeyTab files?

I was reading the following blog post https://docs.microsoft.com/en-gb/archive/blogs/pie/all-you-need-to-know-about-keytab-files I went through the exercise and created the keytab file and used it on ...
2
votes
4answers
4k views

What is the kerberos keytab file used for in UNIX/AD kerberos authentication?

I have proved that UNIX/AD Kerberos authentication works without the presence of a keytab file so I'd like to know whether I should worry about it (given I'll need an individual keytab for each server ...
1
vote
0answers
30 views

AutoFS doesn't use user's krb5 ticket when in conjunction with sssd

I'm using a default /etc/auto.smb (uploaded to your convenience) and a single-line auto.master (/media /etc/auto.smb --timeout=300 --ghost) on Debian 10. SSSD is set up and working just fine - users ...
0
votes
0answers
69 views

Change password expiration warning message

I would like to change the password expiration warning message on CentOS 7.6. We are using Kerberos krb5 and want to add some instructions inside the default warning message, but I couldn't find ...
2
votes
1answer
140 views

Samba 4.11 and des-cbc-md5

Although noted as an weak encryption type, I want to know how to enable des-cbc-md5 on Samba 4.11, in this doc is stated: des-cbc-md5 (disabled by default) des-cbc-md5 can be enabled by enabling DES ...
0
votes
0answers
48 views

Kerberos with i3-dmenu-desktop

I use Kerberos authentication in Thunderbird, Firefox and for ssh and it works just fine if I use the programs from the shell. But when I use i3-dmenu-desktop to start Thunderbird and Firefox, the ...
0
votes
0answers
65 views

Restricting ssh access for shared software accounts

We have passwordless login on all hosts through kerberos. We have user accounts and shared accounts - all (host and sudo access) managed through LDAP (FreeIPA by RedHat). Now if we give shell access ...
0
votes
1answer
68 views

krb command not working in ksh script

On a RedHat 7, when I run the following command to get a Kerberos ticket: krb my_user It sends back : Ticket for 'my_user' is valid until 08:36 (28/01) Now I need to run this command from a script....
0
votes
1answer
3k views

SSH with Kerberos Auth not working

I'm trying to log in my Linux VM with SSH using kerberos authentication. My Linux VM has successfully joined my AD using realmd / sssd method. I changed my sshd_config settings to : ...
0
votes
0answers
12 views

centOS 7 access denied when logging on kerberized environment

When I am trying to log in to one of my hadoop nodes running centos 7. I am receiving a 'access denied' error. Typically, in these situations, I login as the local admin for the box, go to /tmp and ...
3
votes
2answers
3k views

Failed to join domain: failed to set machine kerberos encryption types: Insufficient access

Has anyone gotten this error when trying to join CentOS 7 to Active Directory? I tried various ways(via cli, gui, tui) and always get same error. Failed to join domain: failed to set machine kerberos ...
5
votes
1answer
3k views

Understanding Kerberized NFSv4 Authorization

Articles such as this one seem to point out that Kerberizing NFS(v4) mounts not only prevents machines without a Kerberos service ticket from mounting the shared directory but also uses the user's ...
2
votes
2answers
1k views

PAM configuration with Kerberos authentication but without need of local accounts

I have a working Kerberos authentication tested with kinit on Debian Buster. Now I try to use it with PAM for login with Kerberos and installed libpam-krb5 and configured it with pam-auth-update. But ...
2
votes
2answers
161 views

establish connection between Redhat7 and MSSQL database over kerberos [jdbc driver]

i'm working on very annoying issue, namely our java app on redhat 7 is created to connect to mssql, which cannot parse principal stored in keytab generated by our company automats. Principal stored ...
0
votes
0answers
81 views

How to make CentOS iterate over principals in .k5login (take password for one of them)

at my work, we use combination of Debian and newly some CentOS 7 machines. We have a group of kerberos+LDAP servers to provide means of user authentication to another machines. Everything is fine ...
2
votes
3answers
332 views

PAM Kerberos and RStudio

I am trying to get Kerberos PAM to pull a ticket and not destroy it after an RStudio login on CentOS 7. My rstudio file in /etc/pam.d/ looks like: #%PAM-1.0 auth required pam_krb5....
2
votes
1answer
1k views

kdb5_ldap_util fails with cryptic error

Supposedly, in order to set up Kerberos, I need to run kdb5_ldap_util, though I'm not sure why. However, it fails with: # kdb5_ldap_util -D cn=admin,dc=example,dc=com create -subtrees dc=example,dc=...
0
votes
1answer
824 views

Kerberos key fails with AutoFS

Our Kubuntu computers are configured to automatically connect to their network drive via AutoFS. When we upgrade machines to Kubuntu 18.04 LTS this AutoFS connection no longer works. It is still ...
1
vote
0answers
208 views

How to connect Kerberos with multiple LDAP servers?

My actual task is to make our kerberized Hadoop cluster usable by all our teams. Right now we have a very weird setup in our company: The Hadoop cluster has a dedicated KDC (openSUSE Kerberos with ...
6
votes
2answers
9k views

SSH login without password with kerberos

I try to login onto a server which only supports login with kerberos authentication. Here's what I try: kinit user@FOO.ORG aklog -c foo.org ssh server But then I'm asked again for a password. Here'...
1
vote
1answer
2k views

How to mount cifs with kerberos for a generic user?

I am able to mount a corporate shared directory on my AWS Workspace manually but I need to do this for all users. $ sudo ksu [sudo] password for <Domain>\<User.Name>: Leaving uid as root ...
1
vote
0answers
1k views

Alternative to autofs to mount CIFS folders in user home folders in multi-user environment

My use case seems very simple. I want to automount CIFS folder CIFS1 and CIFS2 which exist for all users on my fileserver in each user home during login on this multi-user 18.04 Ubuntu machine. So ...
3
votes
2answers
1k views

Multiple PCs network centralized system authentication

(I couldn't really choose an accurate title as I don't know exactly what the feature I'm looking for is called. Sorry about that. I hope that the following lines may clear this aspect.) I own a dozen ...
2
votes
0answers
6k views

How to use authentication with negiotiation (e.g. Kerberos) to HTTP proxy?

Generally accepted is the use of HTTP_PROXY/HTTPS_PROXY environment variables to specify the use of a proxy server. Authentication can be included in this URL, e.g. HTTP_PROXY=http://user:pass@myproxy....
7
votes
1answer
2k views

Kerberos authentication fails with forced password change

I have configured PAM authentication to use Kerberos and can authenticate correctly with my principals using their Kerberos credentials. I ran into trouble when I tried to create a principal with an ...
1
vote
1answer
372 views

centos and kerberized nfs works fine but only for nfs3

I want to mount a nfs4 kerberized share. I'm on centos7, the kerberos server is Freeipa,the client is centos7. The problem is my configuration is working for nfs3 but not for nfs4. First I put my ...
0
votes
0answers
1k views

Access Windows share via CIFS and Kerberos: “Key has been revoked”

I'm trying to mount a Windows share on a Linux host (Ubuntu 16.04) using Kerberos / Active Directory authentication. The Linux host has been joined to the AD, and I can access shares on it from the ...
0
votes
1answer
108 views

How does Kerberos know it's me?

I log into my remote server as root (I know it's bad practice). I kinit as my principal. I do whatever I have to do, then exit from the remote server. Next time I ssh in, I klist, and I'm already ...
1
vote
0answers
559 views

Debian Stretch: Samba Winbind Offline Logon Not working - kerberos keytab not persistent after reboot?

This is being tried onDebian stretch referred to as 9.6 in /etc/debian_version I'm in a Windows Domain environment with two 2012R2 controllers that have IDMU/Unix Attributes. Other versions of stuff:...
6
votes
3answers
4k views

Why do I get permission denied error when I log out of the SSH session?

I have to run some tests on a server at the University. I have ssh access to the server from the desktop in my office. I want to launch a python script on the server that will run several tests during ...
2
votes
0answers
283 views

How to tell Kerberos where to find the root certificate for LDAP with TLS?

I run two Debian servers with MIT Kerberos and OpenLDAP backend. I would like to enforce TLS and encrypt replication. So I created and added certificates… dn: cn=config changetype: modify add: ...
0
votes
1answer
149 views

Kerberos in Ubuntu system

I would build a kerberos authentication system on Ubuntu based machines. So i have some questions: 1)What do i need to make client-KDC-server? Do i need a domain controller? 2)How man machines do i ...
4
votes
1answer
4k views

host/remote-hostname@REALM.COM not found in Kerberos database

To keep it short, I recently stood up a RHEL 7 server and enrolled it in FreeIPA. All other enrolled servers can SSH to each other without any issue using just the hostname, authenticating with gssapi-...
1
vote
0answers
3k views

“incorrect mount option was specified” when mounting krb5p nfs4 partition on Ubuntu

I have a NFS4 share running with krb5p. I have no problems accessing it from CentOS clients, all that is required is: yum install krb5-workstation setup krb5 (edit krb5.conf, setup keytab) systemctl ...
3
votes
1answer
7k views

Apache mod_auth_kerb: “Key table entry not found”

I want to use the Apache Module mod_auth_kerb to implement SSO for a web application. With the following config: <VirtualHost 10.5.3.200:443> #Proxy <Proxy *> Order deny,allow Allow from ...
1
vote
0answers
1k views

How to access NFSv4 shared folder with Kerberos authentication without root rights

I'm setting up a NFSv4 shared folder with Kerberos authentication. The issue I'm facing is that when the user on the client machine runs mount /mnt (see the fstab configuration below) he's not able to ...