The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [kerberos]

Kerberos is a network authentication system based on shared key cryptography. It is the underlying authentication system used by current versions of Active Directory and is widely used by large organizations.

Filter by
Sorted by
Tagged with
1
vote
2answers
38 views

PAM configuration with Kerberos authentication but without need of local accounts

I have a working Kerberos authentication tested with kinit on Debian Buster. Now I try to use it with PAM for login with Kerberos and installed libpam-krb5 and configured it with pam-auth-update. But ...
0
votes
0answers
8 views

Run httpd as domain account for NFS-mounted storage

I have this VM running CentOS 8 that hosts a web app. I want the files for the web app to be hosted over NFS on a dedicated file server so I don't have to deal with virtual disk sizing (because they ...
0
votes
0answers
5 views

No TGS_REP and AS_REP in Kerberos logs

This is what the logs shows Sep 30 03:55:37 krb5.kerbserv.com krb5kdc[7028](info): AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 10.10.10.103: ISSUE: authtime 1569830137, etypes {rep=18 tkt=18 ses=18}, ...
0
votes
0answers
10 views

Kerberos ticket successfully received via kvno command but not in a default ccache (KEYRING:session)

To receive Kerberos TGS tickets on Linux I use following configuration: TGT is located in KEYRING:sessions KEYRING:session is linked to KEYRING:user TGS tickets are received via kvno command (...
0
votes
0answers
15 views

LDAP disable local account, and pub/private key on centos

I am currently setting LDAP/krb5 on Centos7. I followed the instruction on: https://wiki.cac.washington.edu/display/LDI/Configuring+Linux+Clients+for+LDI (thanks to Eric) http://staff.washington.edu/...
2
votes
2answers
23 views

establish connection between Redhat7 and MSSQL database over kerberos [jdbc driver]

i'm working on very annoying issue, namely our java app on redhat 7 is created to connect to mssql, which cannot parse principal stored in keytab generated by our company automats. Principal stored ...
0
votes
0answers
80 views

Samba winbind: how to authenticate from trusted AD domain (one-way trust)?

Hello linux newbie here. What I am trying to achieve: to be able to login to Linux machine with Active Directory credentials from trusted domain. I have the following setup: +...
0
votes
0answers
18 views

How to make CentOS iterate over principals in .k5login (take password for one of them)

at my work, we use combination of Debian and newly some CentOS 7 machines. We have a group of kerberos+LDAP servers to provide means of user authentication to another machines. Everything is fine ...
0
votes
0answers
63 views

How to Use Single-Sign-On/Custom Auth/Django-login Authentication for Linux PAM?

I have a web application and i want to let all my application-users to access vsftpd server with the same login credentials. At any time, single source of truth for authentication should be my web ...
0
votes
0answers
15 views

Kerberos fallback to app login

I have to mount a SSO to connect to a GLPI application. For some reason NTML don't work, but we managed to get kerberos functionnal. I would like to authenticate against Kerberos, but if that fails, ...
0
votes
1answer
209 views

Kerberos key fails with AutoFS

Our Kubuntu computers are configured to automatically connect to their network drive via AutoFS. When we upgrade machines to Kubuntu 18.04 LTS this AutoFS connection no longer works. It is still ...
1
vote
1answer
419 views

How to mount cifs with kerberos for a generic user?

I am able to mount a corporate shared directory on my AWS Workspace manually but I need to do this for all users. $ sudo ksu [sudo] password for <Domain>\<User.Name>: Leaving uid as root ...
1
vote
0answers
350 views

Alternative to autofs to mount CIFS folders in user home folders in multi-user environment

My use case seems very simple. I want to automount CIFS folder CIFS1 and CIFS2 which exist for all users on my fileserver in each user home during login on this multi-user 18.04 Ubuntu machine. So ...
1
vote
1answer
101 views

centos and kerberized nfs works fine but only for nfs3

I want to mount a nfs4 kerberized share. I'm on centos7, the kerberos server is Freeipa,the client is centos7. The problem is my configuration is working for nfs3 but not for nfs4. First I put my ...
0
votes
0answers
182 views

Freeipa client on debian 9 - Cannot find user error

EDIT 1: added solution, pam was faulty i'm trying to set up freeipa client on debian 9 client using this guide: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/...
0
votes
1answer
203 views

kinit using keytab fails while using password succeeds

I'm facing a strange problem configuring KRB5 on Ubuntu 16.04 using Windows 2012 DCs as KDC. Calling kinit with an service AD account succeeds, if the password is provided to kinit's password prompt, ...
0
votes
0answers
585 views

Access Windows share via CIFS and Kerberos: “Key has been revoked”

I'm trying to mount a Windows share on a Linux host (Ubuntu 16.04) using Kerberos / Active Directory authentication. The Linux host has been joined to the AD, and I can access shares on it from the ...
0
votes
0answers
279 views

Allow NTLM Authentication after inclusion in Windows Domain

In a user session outside of domain authentication, I had NTLM authentication working for web requests sending Auth headers: WWW-Authenticate: Negotiate WWW-Authenticate: NTLM But, now I've ...
0
votes
0answers
42 views

openstack keystone and kerberos

I have integrated the openstack and kerberos using the link provided here : https://www.jamielennox.net/blog/2015/02/12/step-by-step-kerberized-keystone/ It is successfully installed and I am able to ...
0
votes
0answers
11 views

Enforce the usage of a different DNS domain for servicePrincipalNames

For mostly historic reasons our default DNS domain (lets call it new.example.net) differs from our Kerberos REALM (OLD.EXAMPLE.COM) Actually the KDC (an Active Directory Server) does not know about ...
2
votes
0answers
83 views

How to tell Kerberos where to find the root certificate for LDAP with TLS?

I run two Debian servers with MIT Kerberos and OpenLDAP backend. I would like to enforce TLS and encrypt replication. So I created and added certificates… dn: cn=config changetype: modify add: ...
1
vote
0answers
325 views

Debian Stretch: Samba Winbind Offline Logon Not working - kerberos keytab not persistent after reboot?

This is being tried onDebian stretch referred to as 9.6 in /etc/debian_version I'm in a Windows Domain environment with two 2012R2 controllers that have IDMU/Unix Attributes. Other versions of stuff:...
0
votes
0answers
436 views

How to generate keytab for headless AD user

I was provided a headless Active Directory user account with a randomly generated password we need to use to access some network resources. Since this headless account will need to be run from an ...
0
votes
0answers
387 views

mount a cifs share with kerberos on linux with a sssd/kcm kerberos client

As a non-root user I would like to mount a samba share on my Fedora Linux with kerberos (non-password). I have a kerberos client running (sssd with the kcm server for kerberos tickets). when i do a ...
1
vote
0answers
2k views

“incorrect mount option was specified” when mounting krb5p nfs4 partition on Ubuntu

I have a NFS4 share running with krb5p. I have no problems accessing it from CentOS clients, all that is required is: yum install krb5-workstation setup krb5 (edit krb5.conf, setup keytab) systemctl ...
1
vote
0answers
489 views

How to access NFSv4 shared folder with Kerberos authentication without root rights

I'm setting up a NFSv4 shared folder with Kerberos authentication. The issue I'm facing is that when the user on the client machine runs mount /mnt (see the fstab configuration below) he's not able to ...
1
vote
0answers
340 views

Permission denied on NFSv4 shared directory with authentication with SSO (OpenLDAP + Kerberos)

I'm trying to set up Single Sign On (SSO) with Kerberos and LDAP but I have an issue with NFSv4 with Kerberos for authentication and encryption (krb5p) service. My environment: 1 server (named ...
1
vote
0answers
57 views

About connecting to Active Directory from CentOS7

I've searched several videos on Youtube, articles in other Stack Exchange sites, and some blogs.. but I couldn't make this done yet.. My environment is Windows Server 2012 RC and CentOS7. 1. I ...
2
votes
0answers
456 views

CIFS mount no longer working

I have several RHEL6 systems with the same configuration. I have had CIFS mounts working for years. However in the past month, it has stopped working on one of my systems and I cannot seem to figure ...
4
votes
1answer
4k views

How do I clear a user's cached Active Directory password on CentOS 7?

I built a CentOS 7 install on my company laptop and configured it to authenticate to the company AD servers like so: Install packages: yum install sssd realmd oddjob oddjob-mkhomedir adcli samba-...
0
votes
1answer
485 views

How nsswitch call sssd for credential?

I'm stuck with Kerberos - sssd - AD. I've tried a lot of things, with lot of googling, in LinuxMint, Ubuntu 16.04 and Debian 9. I have always the same result : kinit username works fine msktutil -u --...
0
votes
2answers
362 views

Connect to NFS with Kerberos automatically on login

I have a server, Ubuntu 16.04, exporting an NFS share with Kerberos security. I have a laptop client, Ubuntu 17.10, that connects to the server. The client is configured to mount the share using ...
3
votes
0answers
250 views

Printing to smb with kerberos auth?

I want to set up a printer via samba client to a Windows printserver. I managed to do it specifying this connection string: smb://user:pass@printserver/printer Is there a way to do auth through ...
0
votes
1answer
417 views

Samba integration with existing OpenLDAP, MIT Kerberos and Bind9 services

I have a network domain running OpenLDAP, MIT Kerberos and Bind9. Now I want to enable some MS Windows hosts access to a NAS, in such a way that user credentials stay in my LDAP and Kerberos ...
0
votes
1answer
73 views

How does Kerberos know it's me?

I log into my remote server as root (I know it's bad practice). I kinit as my principal. I do whatever I have to do, then exit from the remote server. Next time I ssh in, I klist, and I'm already ...
1
vote
4answers
1k views

How to keep users with local sudo rights from having sudo rights on NFS file server?

Imagine this scenario in a LAN: one Linux NFS fileserver (srv) and three Linux clients (A, B, C). There are files / directories on srv with root ownership and no access rights granted to non-root ...
0
votes
2answers
449 views

What are the requirements for a Kerberos realm name?

Every example I have seen so far of a valid Kerberos realm name is of the form "example.com". None of the pages I have read give the actual naming rules. What are the naming rules? Must a Kerberos ...
4
votes
1answer
2k views

host/remote-hostname@REALM.COM not found in Kerberos database

To keep it short, I recently stood up a RHEL 7 server and enrolled it in FreeIPA. All other enrolled servers can SSH to each other without any issue using just the hostname, authenticating with gssapi-...
2
votes
0answers
554 views

How to get persistent (permanent) smb mount using kerberos authentication on RHEL7?

Environment: I have joined a few of my RHEL 7.3 boxes with MS AD domain using realmd/sssd. I have allowed only members of a few allowed groups can login to the box. Credentials caching is disabled. ...
0
votes
1answer
1k views

SSH with Kerberos Auth not working

I'm trying to log in my Linux VM with SSH using kerberos authentication. My Linux VM has successfully joined my AD using realmd / sssd method. I changed my sshd_config settings to : ...
1
vote
0answers
4k views

How to use authentication with negiotiation (e.g. Kerberos) to HTTP proxy?

Generally accepted is the use of HTTP_PROXY/HTTPS_PROXY environment variables to specify the use of a proxy server. Authentication can be included in this URL, e.g. HTTP_PROXY=http://user:pass@myproxy....
2
votes
3answers
205 views

PAM Kerberos and RStudio

I am trying to get Kerberos PAM to pull a ticket and not destroy it after an RStudio login on CentOS 7. My rstudio file in /etc/pam.d/ looks like: #%PAM-1.0 auth required pam_krb5....
2
votes
0answers
268 views

Setting up a kerberized HA NFS share

I'm trying to set up a kerberized NFS share from an HA cluster. I've successfully set up a krb-aware NFS share from a single server, I'm using a mostly identical configuration on the cluster. Exports ...
0
votes
0answers
80 views

AFS not working after Upgrade to Debian 9

We are using Debian 8 and 9 with Gnome 3 / KDE 5, kerberos authentification and an AFS filesystem. Debian 8 works fine, but after Upgrading some PCs to Debian 9 we have the following problem: Gnome ...
2
votes
1answer
87 views

Unable to import kerberos.schema [closed]

I am trying to import kerberos.schema into OpenLDAP on RHEL7. I create a file with include /etc/ldap/schema/kerberos.schema in it and then run: slapcat -f schema_convert.conf -F /tmp/ldif_output -...
1
vote
0answers
69 views

Unexpected error when joining computer to AC/DC Samba 4

I present the problem: On a PC with 32-bit Debian Jessie, using Samba 4.1.7 I have a Domain Controller, it has been running for 2 years but since 2 weeks ago it is giving me the following error: When ...
5
votes
1answer
3k views

Fedora 26 NFS + Kerberos “Preauthentication failed” (mount lead to no permission)

I'm having a hard time trying to setup nfs + kerberos at Fedora 26. I've followed this tutorial: RHEL7: Use Kerberos to control access to NFS network shares | CertDepot At the moment, pure NFS ...
2
votes
0answers
395 views

Uppercase usernames in Kerberos principals upon SSH login with password entry

We've been having trouble with users logging in to our Linux machines and the username part of their Kerberos principal being in uppercase. This is a disaster for the security policies on our Hadoop ...
-1
votes
1answer
367 views

Does Tomcat with Kerberos need a keytab file linked with a specific user?

We are trying to setup a tomcat server on RHEL 6.5 to use Kerberos authentication. We have tried to follow this guide, but it seems more appropriate for a Windows implementation. In our environment, ...
1
vote
0answers
306 views

Renew kerberos ticket in tmux

I have two servers, server 1 and server 2. To login onto each server, I need a valid kerberos ticket, the same ticket is valid for both servers. If I run a tmux session on server 1, with several ...