Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [kerberos]

Kerberos is a network authentication system based on shared key cryptography. It is the underlying authentication system used by current versions of Active Directory and is widely used by large organizations.

Filter by
Sorted by
Tagged with
2
votes
1answer
777 views

Where are AFS tokens stored, and how do I get them into running Screen session

I have the following situation, I have a running GNU screen session where I can't access AFS anymore - my token has expired. I can however access it from a new shell. The difference to this question ...
0
votes
1answer
420 views

Samba integration with existing OpenLDAP, MIT Kerberos and Bind9 services

I have a network domain running OpenLDAP, MIT Kerberos and Bind9. Now I want to enable some MS Windows hosts access to a NAS, in such a way that user credentials stay in my LDAP and Kerberos ...
0
votes
2answers
363 views

Connect to NFS with Kerberos automatically on login

I have a server, Ubuntu 16.04, exporting an NFS share with Kerberos security. I have a laptop client, Ubuntu 17.10, that connects to the server. The client is configured to mount the share using ...
4
votes
1answer
17k views

Java could not get the TGT from cache in Linux client

I have set up a Kerberos server and OpenLDAP in RHEL5.5. I also have a RHEL6 machine as a client. I have run my Java program using jaas to query the OpenLDAP server from the Linux client. I can query ...
2
votes
2answers
7k views

Why do I get “no credentials cache” error when mounting Kerberized NFS share?

I have two systems on a local network, nfsclient (CentOS 7) and nfsserver (CentOS 6). These names correctly resolve to their IP addresses, and Kerberos is working between them (nfsserver is the KDC). ...
3
votes
0answers
250 views

Printing to smb with kerberos auth?

I want to set up a printer via samba client to a Windows printserver. I managed to do it specifying this connection string: smb://user:pass@printserver/printer Is there a way to do auth through ...
2
votes
0answers
268 views

Setting up a kerberized HA NFS share

I'm trying to set up a kerberized NFS share from an HA cluster. I've successfully set up a krb-aware NFS share from a single server, I'm using a mostly identical configuration on the cluster. Exports ...
5
votes
1answer
3k views

Fedora 26 NFS + Kerberos “Preauthentication failed” (mount lead to no permission)

I'm having a hard time trying to setup nfs + kerberos at Fedora 26. I've followed this tutorial: RHEL7: Use Kerberos to control access to NFS network shares | CertDepot At the moment, pure NFS ...
2
votes
1answer
10k views

Samba not starting on Ubuntu Server 16.10

Samba was running well on ubuntu server 14.04. After upgrading to 16.10 it doesn't start anymore. I've tried also to install samba on a fresh 16.10 vm and it doesn't work. Here the service error ...
0
votes
1answer
1k views

SSH with Kerberos Auth not working

I'm trying to log in my Linux VM with SSH using kerberos authentication. My Linux VM has successfully joined my AD using realmd / sssd method. I changed my sshd_config settings to : ...
1
vote
4answers
1k views

How to keep users with local sudo rights from having sudo rights on NFS file server?

Imagine this scenario in a LAN: one Linux NFS fileserver (srv) and three Linux clients (A, B, C). There are files / directories on srv with root ownership and no access rights granted to non-root ...
0
votes
2answers
451 views

What are the requirements for a Kerberos realm name?

Every example I have seen so far of a valid Kerberos realm name is of the form "example.com". None of the pages I have read give the actual naming rules. What are the naming rules? Must a Kerberos ...
2
votes
0answers
554 views

How to get persistent (permanent) smb mount using kerberos authentication on RHEL7?

Environment: I have joined a few of my RHEL 7.3 boxes with MS AD domain using realmd/sssd. I have allowed only members of a few allowed groups can login to the box. Credentials caching is disabled. ...
0
votes
0answers
81 views

AFS not working after Upgrade to Debian 9

We are using Debian 8 and 9 with Gnome 3 / KDE 5, kerberos authentification and an AFS filesystem. Debian 8 works fine, but after Upgrading some PCs to Debian 9 we have the following problem: Gnome ...
2
votes
1answer
87 views

Unable to import kerberos.schema [closed]

I am trying to import kerberos.schema into OpenLDAP on RHEL7. I create a file with include /etc/ldap/schema/kerberos.schema in it and then run: slapcat -f schema_convert.conf -F /tmp/ldif_output -...
1
vote
0answers
69 views

Unexpected error when joining computer to AC/DC Samba 4

I present the problem: On a PC with 32-bit Debian Jessie, using Samba 4.1.7 I have a Domain Controller, it has been running for 2 years but since 2 weeks ago it is giving me the following error: When ...
1
vote
1answer
3k views

AD Users Cannot Login Through GDM/LightDM

I've setup Winbind & Kerberos on my CentOS 7 server to allow network users to login. The network users can login fine through SSH, but not through the display manager. I've experienced the same ...
10
votes
2answers
20k views

How could I eliminate Kerberos for passwd?

When I issue a command to change my password like this: sudo passwd huahsin The system prompt me: Current Kerberos password: I don't know what I have done to the system configuration, how could I ...
2
votes
0answers
396 views

Uppercase usernames in Kerberos principals upon SSH login with password entry

We've been having trouble with users logging in to our Linux machines and the username part of their Kerberos principal being in uppercase. This is a disaster for the security policies on our Hadoop ...
-1
votes
1answer
369 views

Does Tomcat with Kerberos need a keytab file linked with a specific user?

We are trying to setup a tomcat server on RHEL 6.5 to use Kerberos authentication. We have tried to follow this guide, but it seems more appropriate for a Windows implementation. In our environment, ...
2
votes
1answer
3k views

Allow username input sddm (LDAP/Kerberos)

The overarching question: How can I enable SDDM to accept username input in Debian? Underlying/implicit questions: How does SDDM recognize users? What is the Debian alternative to /etc/sddm.conf ? ...
1
vote
0answers
308 views

Renew kerberos ticket in tmux

I have two servers, server 1 and server 2. To login onto each server, I need a valid kerberos ticket, the same ticket is valid for both servers. If I run a tmux session on server 1, with several ...
0
votes
1answer
320 views

Cannot mount nfsv4 exports

i tried to setup nfsv4 server and client on centos7.3,both server(ark-centos7-ker ),client(ark-centos-smb4) are joined to AD domain by realm command,AD domain users could log in to centos server run ...
2
votes
0answers
195 views

openldap integration with MIT kerberos

I am integrating openldap with MIT kerberos and have couple of questions regarding that. I was able to do this integration and kerberos services only starting with ldap_kerberos_container_dn = cn=...
1
vote
0answers
442 views

pipe password of kinit over ssh

Disclaimer: I'm creating a quick and dirty script for my own personal use, I'm aware that this isn't the correct way to do things. I want to initialize a kinit on a remote host (no keytab available). ...
0
votes
1answer
875 views

Can't add any principals in Kerberos

I recently botched a Kerberos install and have been trying to follow the walkthrough here. However, now I've reached an awkward impasse and cannot add any principals. Using kadmin.local I receive ...
2
votes
3answers
973 views

Not permitted to access my files on $HOME in tmux after log out and log in

My $HOME on a server is in a Andrew file system, and the server runs kerberos. I created a tmux session, wherein I ran a shell process. Then I detached it, and logged out, and after a while logged ...
1
vote
0answers
542 views

Server: Using Active Directory Groups For Sudo Fails Unless Name of File in /etc/sudoers Matches The Name Of The AD Group

I work for an organization with many linux servers that we'd like to start authenticating with Active Directory. I have a proof-of-concept server set up on which I use SSSD and Kerberos to ...
1
vote
0answers
377 views

Changing Active Directory password for service account in Linux

I am really new to but I am trying to use Kerberos to authenticate my active directory service account from my own CentOS 7 box, after which I then proceed to run queries in a remote database using ...
3
votes
1answer
442 views

How can I manually specify token (tgt) for ssh -K?

As far as I understand, issuing ssh -K somehost will use a kerberos token to authenticate with somehost. Is it possible to specify which file to use as the token? Note that Kerberos is not properly ...
0
votes
1answer
452 views

What to do if SetEnvIf regex could not be compiled

In our company we are working with apache vhosts and kerberos. I changed the kerberos.inc file. I added one line: SetEnvIf X-Forwarded-For ^1\.[1-3]\.[0-255]\.[1-254] env_var Now when I'm ...
2
votes
2answers
4k views

Unable to start nfs-secure-server?

I want to make kerberized nfs server on my machine, I follow these steps: /etc/krb5.keytab systemctl enable nfs-sever; systemctl start nfs-server systemctl enable nfs-secure-server; systemctl start ...
1
vote
0answers
99 views

'Merging' Local Server and AD Accounts

I am investigating LDAP-bridge options, but have a hurdle to overcome: pre-existing local accounts. There are a large number of *nix servers (hundreds) with local accounts on them formatted in all ...
1
vote
0answers
464 views

How do I setup a connection to a database over a SSH-Tunnel with kerberos in a gui?

I need to connect to a Mysql database on a server that is only accessible over ssh with a Kerberos ticket. In a console this is easy, I only do: kinit (then enter password) ssh username@server (...
3
votes
0answers
244 views

SSH into server using kerberos service ticket that is not the host principal

I want to ssh into a server that is running OpenSSH. My client is also OpenSSH. The server is configured to accept GSSAPI authentication, but the keytab it uses is non-standard in that the principal ...
2
votes
0answers
51 views

Unable to login to KDC server without password prompt [duplicate]

I am now configuring KDC client and server. My goal is to login to KDC server from KDC client using user1 without password prompt. However, although I have below configuration, password prompt still ...
10
votes
1answer
8k views

PAM vs LDAP vs SSSD vs Kerberos

I am basically aware of what these services do separate from each other. What I want to know: what exactly happens on a successful login in a linux based network that uses all of these services? In ...
1
vote
2answers
3k views

Is it possible to attach `kinit` to the first attempt to `ssh` without a Kerberos ticket?

My university uses Kerberos-based authentication for login to our unix servers. One way to get passwordless login is to run kinit, type my password, and then run ssh@host. For this setup, I do the ...
3
votes
2answers
5k views

oddjob_mkhomedir doesn't run when logging in via SSH with Kerberos

I currently have a server which has Kerberos/SSSD/Samba to authenticate to Windows 2012 AD. In /etc/pam.d/system-auth oddjob_mkhomedir is set as below: session optional pam_oddjob_mkhomedir....
2
votes
0answers
322 views

mount.cifs without put user password again

I'm already did the login with user an generate kerberos file: #klist Ticket cache: FILE:/tmp/krb5cc_625342619 Default principal: wecitrixteste@MYDOMAIN.CORPDOMAIN.COM Valid starting Expires ...
0
votes
1answer
179 views

What problems could I have if I use the same keytab for all Linux servers authenticating against Active Directory?

Today I use the same keytab for all Linux servers (hundreds). I'm considering using a different keytab for each machine because I suppose that if I use the same keytab the Active Directory thinks I ...
0
votes
1answer
438 views

Authorized authentication by public key ssh , when active directory disabled account [duplicate]

Good Morning , Why can I still authenticate with a public key via ssh while my account is disabled on active directory? My infrastructure is CentOS and authentication by active directory with ...
1
vote
0answers
326 views

Kerberos net ads join doesn't respond

I'm trying to join Active Directory in Xubuntu 16.04 in a enterprise business enviroment so I'll change the name of my REALM by MY.EXAMPLE.CORP. My issue is: when I run net ads join -U Administrator ...
3
votes
0answers
895 views

Automatically renew kerberos tickets in GNU screen

I have a program (which I cannnot modify) which runs for > 1 day. I want to start it via SSH in GNU screen and detach then. The remote is a Fedora system using a Kerberos-based file server on which I'...
2
votes
1answer
488 views

Archlinux + GSSapi + kerberos

I am trying to use ssh supporting GSSAPI with KeyExchange protocol with some servers that authenticate using kerberos. I have installed aur/openssh-gssapi. The problems is after getting the key from ...
9
votes
2answers
14k views

Automatic kerberos ticket initialization on login

I'm using ksshaskpass to add my password protected keys into ssh-agent upon logging into KDE, is there something similar for kerberos?
1
vote
0answers
69 views

Authentication for Both windows and Unix users

We have Active directory to authenticate users for windows machines. We have nis to authenticate linux users. These users are using both windows as well as Linux. They are using two different ...
0
votes
1answer
713 views

Samba does not perform reverse mapping for sssd users

I have configured the users through SSSD native AD support. However when I try to access the share it's mapped as "Unix User\username@domain" instead of "domain\username". My sssd: [sssd] ...
3
votes
1answer
1k views

Kerberos Forwarding in SSSD

So, I'm trying to set up forwarding with Kerberos and seem to have some problems. On some of my servers I'm able to forward after receiving a ticket; however, some I'm not. My system setup is a ...
2
votes
0answers
124 views

Apache: how to access files using the requesting user's credentials?

I have a domain-joined (via samba/sssd) CentOS 7 server, acting as a SFTP server, which has a mountpoint mapped to a Windows' share: SFTP Client -> Linux SFTP Server -> Windows File Server My goal ...