Questions tagged [kerberos]

Kerberos is a network authentication system based on shared key cryptography. It is the underlying authentication system used by current versions of Active Directory and is widely used by large organizations.

Filter by
Sorted by
Tagged with
2
votes
0answers
17 views

Samba 4.11 and des-cbc-md5

Although noted as an weak encryption type, I want to know how to enable des-cbc-md5 on Samba 4.11, in this doc is stated: des-cbc-md5 (disabled by default) des-cbc-md5 can be enabled by ...
2
votes
2answers
68 views

establish connection between Redhat7 and MSSQL database over kerberos [jdbc driver]

i'm working on very annoying issue, namely our java app on redhat 7 is created to connect to mssql, which cannot parse principal stored in keytab generated by our company automats. Principal stored ...
2
votes
0answers
116 views

How to tell Kerberos where to find the root certificate for LDAP with TLS?

I run two Debian servers with MIT Kerberos and OpenLDAP backend. I would like to enforce TLS and encrypt replication. So I created and added certificates… dn: cn=config changetype: modify add: ...
2
votes
0answers
572 views

CIFS mount no longer working

I have several RHEL6 systems with the same configuration. I have had CIFS mounts working for years. However in the past month, it has stopped working on one of my systems and I cannot seem to figure ...
2
votes
0answers
608 views

How to get persistent (permanent) smb mount using kerberos authentication on RHEL7?

Environment: I have joined a few of my RHEL 7.3 boxes with MS AD domain using realmd/sssd. I have allowed only members of a few allowed groups can login to the box. Credentials caching is disabled. ...
2
votes
0answers
4k views

How to use authentication with negiotiation (e.g. Kerberos) to HTTP proxy?

Generally accepted is the use of HTTP_PROXY/HTTPS_PROXY environment variables to specify the use of a proxy server. Authentication can be included in this URL, e.g. HTTP_PROXY=http://user:pass@myproxy....
2
votes
3answers
229 views

PAM Kerberos and RStudio

I am trying to get Kerberos PAM to pull a ticket and not destroy it after an RStudio login on CentOS 7. My rstudio file in /etc/pam.d/ looks like: #%PAM-1.0 auth required pam_krb5....
2
votes
0answers
284 views

Setting up a kerberized HA NFS share

I'm trying to set up a kerberized NFS share from an HA cluster. I've successfully set up a krb-aware NFS share from a single server, I'm using a mostly identical configuration on the cluster. Exports ...
2
votes
0answers
413 views

Uppercase usernames in Kerberos principals upon SSH login with password entry

We've been having trouble with users logging in to our Linux machines and the username part of their Kerberos principal being in uppercase. This is a disaster for the security policies on our Hadoop ...
2
votes
0answers
207 views

openldap integration with MIT kerberos

I am integrating openldap with MIT kerberos and have couple of questions regarding that. I was able to do this integration and kerberos services only starting with ldap_kerberos_container_dn = cn=...
2
votes
0answers
70 views

Unable to login to KDC server without password prompt [duplicate]

I am now configuring KDC client and server. My goal is to login to KDC server from KDC client using user1 without password prompt. However, although I have below configuration, password prompt still ...
2
votes
0answers
326 views

mount.cifs without put user password again

I'm already did the login with user an generate kerberos file: #klist Ticket cache: FILE:/tmp/krb5cc_625342619 Default principal: wecitrixteste@MYDOMAIN.CORPDOMAIN.COM Valid starting Expires ...
2
votes
0answers
124 views

Apache: how to access files using the requesting user's credentials?

I have a domain-joined (via samba/sssd) CentOS 7 server, acting as a SFTP server, which has a mountpoint mapped to a Windows' share: SFTP Client -> Linux SFTP Server -> Windows File Server My goal ...
2
votes
0answers
23 views

How to allow users to register for a single signon account from mit kerberos?

Is there a way to allow users to register for a single sign on account for an mit kerberos server via a web interface of some sort?
2
votes
1answer
8k views

Kerberos/Samba can't join Active Directory [DEBIAN 8]

I have an issue when I try to join my domain. I am able to create the kerberos ticket successfully. root@debian:~# kinit Administrateur@ASP.DOMAIN Password for Administrateur@ASP.DOMAIN: root@debian:...
2
votes
1answer
7k views

Kerberos DNS issue with /etc/hosts

Thank you all for your time and attention. Very simply I'm getting this error when invoking kinit to test kerberos authentication against my AD domain (which is hosted on a Server 2012 box). The ...
2
votes
1answer
893 views

Utilizing Samba Shares Without using Winbind

I am curious if it is possible to use samba shares without using winbind. In our current environment we are using SSSD, Kerberos, and Samba to complete the required tasks such as joining the windows ...
2
votes
1answer
304 views

What role does krb5.conf actually play when joining a Linux machine to AD via Samba/winbind?

I'm working on a project for a standardized Linux image for our organization. This image will be domain joined, and I've written a script to fire on boot that will guide the IST person doing the ...
2
votes
0answers
991 views

tmp/krb5cc_[uid] is not getting purged regularly (kerberos credentials cache)

A user wasn't able to authenticate using Kerberos because it wasn't able to create /tmp/krb5cc_[uid]. This was because /tmp ran out of inode space, as there were innumerable Kerberos credential cache ...
1
vote
4answers
1k views

How to keep users with local sudo rights from having sudo rights on NFS file server?

Imagine this scenario in a LAN: one Linux NFS fileserver (srv) and three Linux clients (A, B, C). There are files / directories on srv with root ownership and no access rights granted to non-root ...
1
vote
1answer
670 views

How to mount cifs with kerberos for a generic user?

I am able to mount a corporate shared directory on my AWS Workspace manually but I need to do this for all users. $ sudo ksu [sudo] password for <Domain>\<User.Name>: Leaving uid as root ...
1
vote
2answers
2k views

Can keytab file location be configured in OpenSSH?

We are running OpenSSH server under Debian jessie. We use Kerberos as one of our authentication methods. The standard place to put the Kerberos keytab file on the OpenSSH server is in /etc/krb5.keytab....
1
vote
1answer
195 views

Can a Linux server that authenticates against an Active Directory accept public/private keys for passwordless login?

I have a Linux server that authenticates users against an Active Directory. Now interactive logins require username and password and automatic login requires a keytab (Kerberos) for passwordless ...
1
vote
2answers
43 views

The easiest way to update package above release RHEL

I have to install the krb5-devel package in a version at least 1.12 on a RHEL 6.6. Unfortunately the RHEL 6.6 repositories contains the package in a version 1.10. What would be the easiest way to ...
1
vote
1answer
375 views

permission for accessing files are denied and some sessions are killed

I ssh to a Linux server which runs kerberos. This is the first time I met Kerberos. After some time of being idle or loging out and loging in, I found some strange things, which I am not sure if are ...
1
vote
2answers
324 views

PAM configuration with Kerberos authentication but without need of local accounts

I have a working Kerberos authentication tested with kinit on Debian Buster. Now I try to use it with PAM for login with Kerberos and installed libpam-krb5 and configured it with pam-auth-update. But ...
1
vote
1answer
162 views

centos and kerberized nfs works fine but only for nfs3

I want to mount a nfs4 kerberized share. I'm on centos7, the kerberos server is Freeipa,the client is centos7. The problem is my configuration is working for nfs3 but not for nfs4. First I put my ...
1
vote
1answer
667 views

PostgreSQL on FreeBSD - 'Kerberos 5 authentication not supported'

I've been trying to get a FreeBSD machine to talk to a networked postgreSQL database. I assumed that the machine had kerberos installed, as it's what I use to log in, and I was told that FreeBSD has ...
1
vote
0answers
581 views

Alternative to autofs to mount CIFS folders in user home folders in multi-user environment

My use case seems very simple. I want to automount CIFS folder CIFS1 and CIFS2 which exist for all users on my fileserver in each user home during login on this multi-user 18.04 Ubuntu machine. So ...
1
vote
0answers
396 views

Debian Stretch: Samba Winbind Offline Logon Not working - kerberos keytab not persistent after reboot?

This is being tried onDebian stretch referred to as 9.6 in /etc/debian_version I'm in a Windows Domain environment with two 2012R2 controllers that have IDMU/Unix Attributes. Other versions of stuff:...
1
vote
0answers
2k views

“incorrect mount option was specified” when mounting krb5p nfs4 partition on Ubuntu

I have a NFS4 share running with krb5p. I have no problems accessing it from CentOS clients, all that is required is: yum install krb5-workstation setup krb5 (edit krb5.conf, setup keytab) systemctl ...
1
vote
0answers
647 views

How to access NFSv4 shared folder with Kerberos authentication without root rights

I'm setting up a NFSv4 shared folder with Kerberos authentication. The issue I'm facing is that when the user on the client machine runs mount /mnt (see the fstab configuration below) he's not able to ...
1
vote
0answers
437 views

Permission denied on NFSv4 shared directory with authentication with SSO (OpenLDAP + Kerberos)

I'm trying to set up Single Sign On (SSO) with Kerberos and LDAP but I have an issue with NFSv4 with Kerberos for authentication and encryption (krb5p) service. My environment: 1 server (named ...
1
vote
0answers
64 views

About connecting to Active Directory from CentOS7

I've searched several videos on Youtube, articles in other Stack Exchange sites, and some blogs.. but I couldn't make this done yet.. My environment is Windows Server 2012 RC and CentOS7. 1. I ...
1
vote
0answers
71 views

Unexpected error when joining computer to AC/DC Samba 4

I present the problem: On a PC with 32-bit Debian Jessie, using Samba 4.1.7 I have a Domain Controller, it has been running for 2 years but since 2 weeks ago it is giving me the following error: When ...
1
vote
0answers
330 views

Renew kerberos ticket in tmux

I have two servers, server 1 and server 2. To login onto each server, I need a valid kerberos ticket, the same ticket is valid for both servers. If I run a tmux session on server 1, with several ...
1
vote
0answers
471 views

pipe password of kinit over ssh

Disclaimer: I'm creating a quick and dirty script for my own personal use, I'm aware that this isn't the correct way to do things. I want to initialize a kinit on a remote host (no keytab available). ...
1
vote
1answer
3k views

AD Users Cannot Login Through GDM/LightDM

I've setup Winbind & Kerberos on my CentOS 7 server to allow network users to login. The network users can login fine through SSH, but not through the display manager. I've experienced the same ...
1
vote
0answers
187 views

How to connect Kerberos with multiple LDAP servers?

My actual task is to make our kerberized Hadoop cluster usable by all our teams. Right now we have a very weird setup in our company: The Hadoop cluster has a dedicated KDC (openSUSE Kerberos with ...
1
vote
0answers
594 views

Server: Using Active Directory Groups For Sudo Fails Unless Name of File in /etc/sudoers Matches The Name Of The AD Group

I work for an organization with many linux servers that we'd like to start authenticating with Active Directory. I have a proof-of-concept server set up on which I use SSSD and Kerberos to ...
1
vote
0answers
398 views

Changing Active Directory password for service account in Linux

I am really new to but I am trying to use Kerberos to authenticate my active directory service account from my own CentOS 7 box, after which I then proceed to run queries in a remote database using ...
1
vote
0answers
105 views

'Merging' Local Server and AD Accounts

I am investigating LDAP-bridge options, but have a hurdle to overcome: pre-existing local accounts. There are a large number of *nix servers (hundreds) with local accounts on them formatted in all ...
1
vote
0answers
484 views

How do I setup a connection to a database over a SSH-Tunnel with kerberos in a gui?

I need to connect to a Mysql database on a server that is only accessible over ssh with a Kerberos ticket. In a console this is easy, I only do: kinit (then enter password) ssh username@server (...
1
vote
0answers
355 views

Kerberos net ads join doesn't respond

I'm trying to join Active Directory in Xubuntu 16.04 in a enterprise business enviroment so I'll change the name of my REALM by MY.EXAMPLE.CORP. My issue is: when I run net ads join -U Administrator ...
1
vote
0answers
72 views

Authentication for Both windows and Unix users

We have Active directory to authenticate users for windows machines. We have nis to authenticate linux users. These users are using both windows as well as Linux. They are using two different ...
1
vote
0answers
3k views

CentOS 6.8 + Samba4 + Kerberos: No credentials cache found

I am trying to release a server using ‍‍CentOS 6.8 + Samba4 (Winbind - LDAP + Kerberos) + NSS. I was able to join the domain, but I still getting this warning/error message: [root@snfs2 ~]# net ads ...
1
vote
1answer
71 views

How can I set kerberos principal in environment automatically on the remote host?

I use both legacy krsh and ssh to login to a variety of boxes for root administration, as do several colleagues of mine. We all keep different history files by use of a variable calculated by running ...
1
vote
1answer
403 views

Can not stop Kerberos on debian 8

I'm trying to install krb5-admin-server and krb5-kdc for a school project, everything is working fine but I can't stop krb5-admin-server nor restart it. Here are the logs I retrieved with cat /var/...
1
vote
0answers
1k views

realmd join AD and Cross Domain Auth

Small issue with realmd, I use realm join with a kerberos token generated before the join, it's working fine on a simple Active Directory Configuration My issue is when realm join must join a domain ...
1
vote
0answers
4k views

Adding CentOS 7 to Active Directory

I am having a hard time adding a CentOS 7 machine to my domain (Active Directory 2012 running in Windows 2008 mode). I am using realmd to join the machine to the domain. Here is what I have checked so ...