Questions tagged [kerberos]

Kerberos is a network authentication system based on shared key cryptography. It is the underlying authentication system used by current versions of Active Directory and is widely used by large organizations.

Filter by
Sorted by
Tagged with
14
votes
2answers
57k views

SSH authentication using gssapi-keyex or gssapi-with-mic (publickey not permitted)

My company has disabled SSH public key authentication, therefore I have to manually enter each time my password (I am not suppose to change /etc/ssh/sshd_config). However gssapi-keyex and gssapi-with-...
12
votes
2answers
21k views

How could I eliminate Kerberos for passwd?

When I issue a command to change my password like this: sudo passwd huahsin The system prompt me: Current Kerberos password: I don't know what I have done to the system configuration, how could I ...
10
votes
1answer
9k views

PAM vs LDAP vs SSSD vs Kerberos

I am basically aware of what these services do separate from each other. What I want to know: what exactly happens on a successful login in a linux based network that uses all of these services? In ...
10
votes
1answer
13k views

Get a Kerberos service ticket from the command line

I am in the process of debugging a Kerberos setup. I have a valid krb5.conf and I can call kinit USERNAME to get a Ticket Granting Ticket (TGT): Credentials cache: /root/krb5cc_root Default principal:...
9
votes
2answers
14k views

Automatic kerberos ticket initialization on login

I'm using ksshaskpass to add my password protected keys into ssh-agent upon logging into KDE, is there something similar for kerberos?
8
votes
1answer
311 views

List Kerberos principals with valid TGTs

Is it possible to query my (MIT) Kerberos KDC to return a list of principals who have been issued TGTs that are currently valid? My use case is that I would like to find out which users are currently ...
7
votes
1answer
2k views

Kerberos authentication fails with forced password change

I have configured PAM authentication to use Kerberos and can authenticate correctly with my principals using their Kerberos credentials. I ran into trouble when I tried to create a principal with an ...
6
votes
1answer
3k views

Public Key Auth + Kerberos

I've setup public key authentication for enabling SSH connection into my university machine. However, it only logs me in on the local machine and doesn't give me Kerberos credentials which I need for ...
6
votes
2answers
6k views

SSH login without password with kerberos

I try to login onto a server which only supports login with kerberos authentication. Here's what I try: kinit user@FOO.ORG aklog -c foo.org ssh server But then I'm asked again for a password. Here'...
6
votes
1answer
4k views

Keep kerberos ticket across sudo invocation

On a regular linux machine, when I use sudo -s as a normal user, I become root but HOME still points to ~user, so every admin has his own environment etc. (this is without env_reset or always_set_home ...
5
votes
3answers
3k views

Why do I get permission denied error when I log out of the SSH session?

I have to run some tests on a server at the University. I have ssh access to the server from the desktop in my office. I want to launch a python script on the server that will run several tests during ...
5
votes
1answer
2k views

Understanding Kerberized NFSv4 Authorization

Articles such as this one seem to point out that Kerberizing NFS(v4) mounts not only prevents machines without a Kerberos service ticket from mounting the shared directory but also uses the user's ...
5
votes
1answer
3k views

Fedora 26 NFS + Kerberos “Preauthentication failed” (mount lead to no permission)

I'm having a hard time trying to setup nfs + kerberos at Fedora 26. I've followed this tutorial: RHEL7: Use Kerberos to control access to NFS network shares | CertDepot At the moment, pure NFS ...
5
votes
2answers
3k views

How to automate ktutil to immediately list keytab entries?

I use MIT ktutil a lot on Linux and I am fed up using the following sequence, even if command shortcuts and file name completion are here to help: ktutil rkt my.keytab l Isn't there a way to get the ...
5
votes
3answers
7k views

NFS + Kerberos: access denied by server while mounting

I have NFS&Kerberos configured as described here: How do I configure a Kerberos NFS server on Red Hat Enterprise Linux 7 All diagnostics operations come fine, but when I try to mount my shares on ...
4
votes
1answer
3k views

host/remote-hostname@REALM.COM not found in Kerberos database

To keep it short, I recently stood up a RHEL 7 server and enrolled it in FreeIPA. All other enrolled servers can SSH to each other without any issue using just the hostname, authenticating with gssapi-...
4
votes
1answer
17k views

Java could not get the TGT from cache in Linux client

I have set up a Kerberos server and OpenLDAP in RHEL5.5. I also have a RHEL6 machine as a client. I have run my Java program using jaas to query the OpenLDAP server from the Linux client. I can query ...
4
votes
1answer
5k views

How do I clear a user's cached Active Directory password on CentOS 7?

I built a CentOS 7 install on my company laptop and configured it to authenticate to the company AD servers like so: Install packages: yum install sssd realmd oddjob oddjob-mkhomedir adcli samba-...
4
votes
1answer
2k views

When using an SSH alias, why is SSH ignoring my (valid) Kerberos ticket?

I am successfully connecting to my university's network via ssh with Kerberos ticket authentication. Normal, verbose operation (kinit a ticket, then ssh user@hostname) works fine. The Problem When ...
4
votes
0answers
2k views

KrbException: Fail to create credential. (63) - No service creds

I am working on setting up Tomcat 8.0.35 on Ubuntu 16.04 with Oracle Java 1.8.0_91-b14 (not openjdk) to use Kerberos authentication when authenticating to our Microsoft SQL database. The issue I am ...
3
votes
2answers
5k views

oddjob_mkhomedir doesn't run when logging in via SSH with Kerberos

I currently have a server which has Kerberos/SSSD/Samba to authenticate to Windows 2012 AD. In /etc/pam.d/system-auth oddjob_mkhomedir is set as below: session optional pam_oddjob_mkhomedir....
3
votes
1answer
1k views

getent group working, but sshd_config allowgroups does not retrieve appropriate group

I am trying to setup Kerberos MIT authentication with OpenLdap autorisation on Debian Jessie. Authentication part is working great, as I can login to SSH using my kerberos account. I even can create ...
3
votes
2answers
1k views

Renew Kerberos ticket for daemon

Using ISC-DHCPD to renew DHCP leases in an Active Directory domain. This requires using ktutil to generate a keytab for DHCPd to use in order to update secure dynamic DNS. What I need to do is to be ...
3
votes
1answer
471 views

How can I manually specify token (tgt) for ssh -K?

As far as I understand, issuing ssh -K somehost will use a kerberos token to authenticate with somehost. Is it possible to specify which file to use as the token? Note that Kerberos is not properly ...
3
votes
1answer
7k views

Generating a keytab for Active Directory user?

I am relatively new to Kerberos, we have integrated Active Directory for authentication. I.E. When we do kinit ad_user, we get a valid TGT. Now I want to run the application as a user in headless ...
3
votes
1answer
6k views

Apache mod_auth_kerb: “Key table entry not found”

I want to use the Apache Module mod_auth_kerb to implement SSO for a web application. With the following config: <VirtualHost 10.5.3.200:443> #Proxy <Proxy *> Order deny,allow Allow from ...
3
votes
2answers
1k views

Multiple PCs network centralized system authentication

(I couldn't really choose an accurate title as I don't know exactly what the feature I'm looking for is called. Sorry about that. I hope that the following lines may clear this aspect.) I own a dozen ...
3
votes
0answers
269 views

Printing to smb with kerberos auth?

I want to set up a printer via samba client to a Windows printserver. I managed to do it specifying this connection string: smb://user:pass@printserver/printer Is there a way to do auth through ...
3
votes
0answers
247 views

SSH into server using kerberos service ticket that is not the host principal

I want to ssh into a server that is running OpenSSH. My client is also OpenSSH. The server is configured to accept GSSAPI authentication, but the keytab it uses is non-standard in that the principal ...
3
votes
0answers
927 views

Automatically renew kerberos tickets in GNU screen

I have a program (which I cannnot modify) which runs for > 1 day. I want to start it via SSH in GNU screen and detach then. The remote is a Fedora system using a Kerberos-based file server on which I'...
3
votes
0answers
1k views

kerberos preauth pkinit failed to initialize: No realms configured correctly for pkinit support

I have successfully installed Kerberos on debian wheezy and can perform service authentication (Apache, ssh) with Kerberos tickets from kinit. I would like to use certificates for kinit (pkinit) ...
3
votes
2answers
3k views

Failed to join domain: failed to set machine kerberos encryption types: Insufficient access

Has anyone gotten this error when trying to join CentOS 7 to Active Directory? I tried various ways(via cli, gui, tui) and always get same error. Failed to join domain: failed to set machine kerberos ...
3
votes
1answer
1k views

Kerberos Forwarding in SSSD

So, I'm trying to set up forwarding with Kerberos and seem to have some problems. On some of my servers I'm able to forward after receiving a ticket; however, some I'm not. My system setup is a ...
2
votes
1answer
10k views

Samba not starting on Ubuntu Server 16.10

Samba was running well on ubuntu server 14.04. After upgrading to 16.10 it doesn't start anymore. I've tried also to install samba on a fresh 16.10 vm and it doesn't work. Here the service error ...
2
votes
1answer
3k views

Allow username input sddm (LDAP/Kerberos)

The overarching question: How can I enable SDDM to accept username input in Debian? Underlying/implicit questions: How does SDDM recognize users? What is the Debian alternative to /etc/sddm.conf ? ...
2
votes
3answers
991 views

Not permitted to access my files on $HOME in tmux after log out and log in

My $HOME on a server is in a Andrew file system, and the server runs kerberos. I created a tmux session, wherein I ran a shell process. Then I detached it, and logged out, and after a while logged ...
2
votes
3answers
2k views

Kerberos error after ArchLinux installation

I've installed ArchLinux successfully on my laptop yesterday. To do this, I've followed the Beginner's guide along with the Raid guide. I could do every step without problem, except the one for the ...
2
votes
2answers
3k views

How would I build a linux based router?

I am looking into building a Linux based router out of a home-built Linux server. I don't have much experience with the software required however. I would like the server to run the following ...
2
votes
2answers
946 views

Command-line web browser with Kerberos authentication?

QUESTION: Is there a Kerberos-friendly web browser usable via an SSH console? I have tried links but it does not seem to work with Kerberos (the webapp asks me for login/password even though I have a ...
2
votes
4answers
3k views

What is the kerberos keytab file used for in UNIX/AD kerberos authentication?

I have proved that UNIX/AD Kerberos authentication works without the presence of a keytab file so I'd like to know whether I should worry about it (given I'll need an individual keytab for each server ...
2
votes
2answers
4k views

Unable to start nfs-secure-server?

I want to make kerberized nfs server on my machine, I follow these steps: /etc/krb5.keytab systemctl enable nfs-sever; systemctl start nfs-server systemctl enable nfs-secure-server; systemctl start ...
2
votes
1answer
497 views

Archlinux + GSSapi + kerberos

I am trying to use ssh supporting GSSAPI with KeyExchange protocol with some servers that authenticate using kerberos. I have installed aur/openssh-gssapi. The problems is after getting the key from ...
2
votes
2answers
7k views

Why do I get “no credentials cache” error when mounting Kerberized NFS share?

I have two systems on a local network, nfsclient (CentOS 7) and nfsserver (CentOS 6). These names correctly resolve to their IP addresses, and Kerberos is working between them (nfsserver is the KDC). ...
2
votes
1answer
250 views

Is it possible to have a daemon run a process as another user WITHOUT having a superuser daemon?

I'm working on a project at the moment where I have a daemon that needs to run a process as another user. I would like the daemon to not run as root if possible. However, i'm struggling to figure out ...
2
votes
1answer
845 views

Where are AFS tokens stored, and how do I get them into running Screen session

I have the following situation, I have a running GNU screen session where I can't access AFS anymore - my token has expired. I can however access it from a new shell. The difference to this question ...
2
votes
1answer
1k views

How can I use different kerberos principals for sudo than for system-auth?

At my organization, we're required to use different kerberos principals when authenticating for sudo than for other types of auth, such as logging in. For instance, my regular (login) principal might ...
2
votes
2answers
3k views

Is it possible to attach `kinit` to the first attempt to `ssh` without a Kerberos ticket?

My university uses Kerberos-based authentication for login to our unix servers. One way to get passwordless login is to run kinit, type my password, and then run ssh@host. For this setup, I do the ...
2
votes
1answer
89 views

Unable to import kerberos.schema [closed]

I am trying to import kerberos.schema into OpenLDAP on RHEL7. I create a file with include /etc/ldap/schema/kerberos.schema in it and then run: slapcat -f schema_convert.conf -F /tmp/ldif_output -...
2
votes
1answer
677 views

Integrating LDAP and Kerberos V to add users via a useradd-like interface

I'm currently trying to set up an integrated Kerberos V/LDAP system for authentication/authorization. From what I have managed to gather, there are at least two ways to integrate Kerberos V with LDAP: ...
2
votes
1answer
1k views

kdb5_ldap_util fails with cryptic error

Supposedly, in order to set up Kerberos, I need to run kdb5_ldap_util, though I'm not sure why. However, it fails with: # kdb5_ldap_util -D cn=admin,dc=example,dc=com create -subtrees dc=example,dc=...