Questions tagged [kerberos]

Kerberos is a network authentication system based on shared key cryptography. It is the underlying authentication system used by current versions of Active Directory and is widely used by large organizations.

Filter by
Sorted by
Tagged with
1
vote
1answer
485 views

How can I run unattended processes as authenticated AD/LDAP users?

I'm switching some servers over to Debian 8 and using realmd for Active Directory (LDAP/Kerberos) authentication. This has been working great and allows Domain Users to login to my server, etc. ...
1
vote
2answers
561 views

How can I install kerberised services on debian?

I installed kerberos in my debian environment and made it work with SSH. I also would like to try it with other services but I could not install them on debian. I followed several tutorials e.g. ...
1
vote
1answer
2k views

Kerberos Join Active Directory Failure

I try to join Active Directory and Samba 4 in Ubuntu 12.04.05. When I run host -t SRV _kerberos._udp.test.sg I get the error: Host _kerberos._udp.test.sg not found: 3(NXDOMAIN) meanwhile $# host -...
1
vote
0answers
805 views

kerberos : kinit not picking up updated values in krb5.conf

We are running kinit from our Linux command line and this works well. Before we run kinit we set the KRB5_CONFIG environment variable to point to directory continaing krb5.conf file linuxhost1$ ...
1
vote
1answer
2k views

Can't Login to Debian 7.7 with Kerberos/NIS user

I have a Debian 7.7 system I am trying to configure to use Kerberos and NIS, both served from an Active Directory server. I have kerberos set up such that I can kinit a set of credentials from the AD ...
1
vote
0answers
523 views

How is a username determined and can I hide the domain component in a winbind username?

Someone asked a question on Server Fault about a problem which I'm also having but no one has answered it so I'm posing a slightly different question to try and figure it out myself. I've configured ...
1
vote
1answer
4k views

How does Linux winbindd determine available domain controller?

We are actually in preparation of taking down one of our three domain controller (Win2k3). They are all serving the same domain. Actually we still see connections incoming from Debian (5/6/7) Servers ...
1
vote
0answers
189 views

How to obtain current user environment in pam_script?

I'm running pam_script after pam_krb5 with a session open script. In my script, I need to use the ticket cache generated by krb5 to do something. Well, the script was actually run as root, and ...
1
vote
0answers
150 views

How do I setup kerberos authetication in Fedora 19

I cannnot seem to find documentation on setting up Kerberos authentication on my Fedora 19 workstation. Which files and programs are involved? My Kerberos server is a corporate AD.
1
vote
1answer
218 views

kinit returns error salt type 3 unsupported on FreeBSD 9.1-RELEASE install

When attempting to run kinit to log into a Kerberos V5 realm I get the following error on a default install FreeBSD 9.1-RELEASE kinit: krb5_get_init_creds: salt type 3 not supported Any ideas?
0
votes
1answer
620 views

How nsswitch call sssd for credential?

I'm stuck with Kerberos - sssd - AD. I've tried a lot of things, with lot of googling, in LinuxMint, Ubuntu 16.04 and Debian 9. I have always the same result : kinit username works fine msktutil -u --...
0
votes
2answers
402 views

Connect to NFS with Kerberos automatically on login

I have a server, Ubuntu 16.04, exporting an NFS share with Kerberos security. I have a laptop client, Ubuntu 17.10, that connects to the server. The client is configured to mount the share using ...
0
votes
2answers
509 views

What are the requirements for a Kerberos realm name?

Every example I have seen so far of a valid Kerberos realm name is of the form "example.com". None of the pages I have read give the actual naming rules. What are the naming rules? Must a Kerberos ...
0
votes
1answer
2k views

SSH with Kerberos Auth not working

I'm trying to log in my Linux VM with SSH using kerberos authentication. My Linux VM has successfully joined my AD using realmd / sssd method. I changed my sshd_config settings to : ...
0
votes
1answer
351 views

Cannot mount nfsv4 exports

i tried to setup nfsv4 server and client on centos7.3,both server(ark-centos7-ker ),client(ark-centos-smb4) are joined to AD domain by realm command,AD domain users could log in to centos server run ...
0
votes
1answer
2k views

Why is my kerberos ticket not working?

I'm trying to ssh to another machine but my kinit is not working: $ ssh nik@social-1-r.referens.sys.XXXXXXX.se Permission denied (publickey,gssapi-keyex,gssapi-with-mic). Kerberos is used for ...
0
votes
1answer
193 views

What problems could I have if I use the same keytab for all Linux servers authenticating against Active Directory?

Today I use the same keytab for all Linux servers (hundreds). I'm considering using a different keytab for each machine because I suppose that if I use the same keytab the Active Directory thinks I ...
0
votes
1answer
569 views

How to keep a long-running process run with Kerberos and Andrew file system?

I am running a bash script on a Scientific Linux server. The script has a loop for copying files and running some programs. The process for running the script probably takes a day or two. But I always ...
0
votes
1answer
891 views

Can't add any principals in Kerberos

I recently botched a Kerberos install and have been trying to follow the walkthrough here. However, now I've reached an awkward impasse and cannot add any principals. Using kadmin.local I receive ...
0
votes
1answer
3k views

How do I disable Kereberos preauthentication?

I'm seeing this error message: NEEDED_PREAUTH: admin@THIS.LAN for for kadmin/admin@THIS.LAN, Additional pre-authentication required How do I disable Kerberos pre-authentication? The server and ...
0
votes
0answers
8 views

centOS 7 access denied when logging on kerberized environment

When I am trying to log in to one of my hadoop nodes running centos 7. I am receiving a 'access denied' error. Typically, in these situations, I login as the local admin for the box, go to /tmp and ...
0
votes
0answers
4 views

Kerberos - is it possible to create “wildcard” principle to match many service principles?

For instance, there is user alice as well as services foo, bar and baz. I'd like to know if there is a way to create only one principle in KDC database to authorize alice for three different services. ...
0
votes
0answers
26 views

mount in fstab with krb5 at login

I have a cifs fileshare that I use. My organisation requires that it uses Kerberos so it's mounted with sec=krb5. This is fine, but I'd like it to mount after login automatically without having to ...
0
votes
0answers
12 views

Run httpd as domain account for NFS-mounted storage

I have this VM running CentOS 8 that hosts a web app. I want the files for the web app to be hosted over NFS on a dedicated file server so I don't have to deal with virtual disk sizing (because they ...
0
votes
0answers
19 views

No TGS_REP and AS_REP in Kerberos logs

This is what the logs shows Sep 30 03:55:37 krb5.kerbserv.com krb5kdc[7028](info): AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) 10.10.10.103: ISSUE: authtime 1569830137, etypes {rep=18 tkt=18 ses=18}, ...
0
votes
0answers
20 views

Kerberos ticket successfully received via kvno command but not in a default ccache (KEYRING:session)

To receive Kerberos TGS tickets on Linux I use following configuration: TGT is located in KEYRING:sessions KEYRING:session is linked to KEYRING:user TGS tickets are received via kvno command (...
0
votes
0answers
21 views

LDAP disable local account, and pub/private key on centos

I am currently setting LDAP/krb5 on Centos7. I followed the instruction on: https://wiki.cac.washington.edu/display/LDI/Configuring+Linux+Clients+for+LDI (thanks to Eric) http://staff.washington.edu/...
0
votes
0answers
397 views

Samba winbind: how to authenticate from trusted AD domain (one-way trust)?

Hello linux newbie here. What I am trying to achieve: to be able to login to Linux machine with Active Directory credentials from trusted domain. I have the following setup: +...
0
votes
0answers
31 views

How to make CentOS iterate over principals in .k5login (take password for one of them)

at my work, we use combination of Debian and newly some CentOS 7 machines. We have a group of kerberos+LDAP servers to provide means of user authentication to another machines. Everything is fine ...
0
votes
0answers
147 views

How to Use Single-Sign-On/Custom Auth/Django-login Authentication for Linux PAM?

I have a web application and i want to let all my application-users to access vsftpd server with the same login credentials. At any time, single source of truth for authentication should be my web ...
0
votes
0answers
26 views

Kerberos fallback to app login

I have to mount a SSO to connect to a GLPI application. For some reason NTML don't work, but we managed to get kerberos functionnal. I would like to authenticate against Kerberos, but if that fails, ...
0
votes
1answer
312 views

Kerberos key fails with AutoFS

Our Kubuntu computers are configured to automatically connect to their network drive via AutoFS. When we upgrade machines to Kubuntu 18.04 LTS this AutoFS connection no longer works. It is still ...
0
votes
0answers
231 views

Freeipa client on debian 9 - Cannot find user error

EDIT 1: added solution, pam was faulty i'm trying to set up freeipa client on debian 9 client using this guide: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/...
0
votes
1answer
396 views

kinit using keytab fails while using password succeeds

I'm facing a strange problem configuring KRB5 on Ubuntu 16.04 using Windows 2012 DCs as KDC. Calling kinit with an service AD account succeeds, if the password is provided to kinit's password prompt, ...
0
votes
0answers
799 views

Access Windows share via CIFS and Kerberos: “Key has been revoked”

I'm trying to mount a Windows share on a Linux host (Ubuntu 16.04) using Kerberos / Active Directory authentication. The Linux host has been joined to the AD, and I can access shares on it from the ...
0
votes
1answer
509 views

Samba integration with existing OpenLDAP, MIT Kerberos and Bind9 services

I have a network domain running OpenLDAP, MIT Kerberos and Bind9. Now I want to enable some MS Windows hosts access to a NAS, in such a way that user credentials stay in my LDAP and Kerberos ...
0
votes
1answer
90 views

How does Kerberos know it's me?

I log into my remote server as root (I know it's bad practice). I kinit as my principal. I do whatever I have to do, then exit from the remote server. Next time I ssh in, I klist, and I'm already ...
0
votes
0answers
91 views

AFS not working after Upgrade to Debian 9

We are using Debian 8 and 9 with Gnome 3 / KDE 5, kerberos authentification and an AFS filesystem. Debian 8 works fine, but after Upgrading some PCs to Debian 9 we have the following problem: Gnome ...
0
votes
1answer
485 views

What to do if SetEnvIf regex could not be compiled

In our company we are working with apache vhosts and kerberos. I changed the kerberos.inc file. I added one line: SetEnvIf X-Forwarded-For ^1\.[1-3]\.[0-255]\.[1-254] env_var Now when I'm ...
0
votes
1answer
453 views

Authorized authentication by public key ssh , when active directory disabled account [duplicate]

Good Morning , Why can I still authenticate with a public key via ssh while my account is disabled on active directory? My infrastructure is CentOS and authentication by active directory with ...
0
votes
1answer
726 views

Samba does not perform reverse mapping for sssd users

I have configured the users through SSSD native AD support. However when I try to access the share it's mapped as "Unix User\username@domain" instead of "domain\username". My sssd: [sssd] ...
0
votes
1answer
145 views

Kerberos in Ubuntu system

I would build a kerberos authentication system on Ubuntu based machines. So i have some questions: 1)What do i need to make client-KDC-server? Do i need a domain controller? 2)How man machines do i ...
0
votes
1answer
710 views

FreeTDS missing encryption support to connect to MS SQL

I'm running a Gentoo Linux and I'm trying to connect to MS SQL via pyodbc using freetds. I enabled the debug log in freetds. Now when I try to connect I'm seeing this: 18:13:00.841828 13523 (net.c:...
0
votes
1answer
68 views

OS X Directory Services

I have been reading from Advanced Programming in the UNIX environment (Stevenson and Rago), and I am currently reading about how user data is stored on various systems, including Linux, FreeBSD, and ...
0
votes
1answer
427 views

Kerberos/LDAP login fails - remove Preauth?

Using a Debian system with a Kerberos/LDAP client - login fails on KDE as a user directory isn't being created. SSH is successful (and no directory is created); however, desktop login isn't. I've ...
0
votes
1answer
899 views

Troubleshooting GSS-API error on one client authenticating to Kerberos

When authenticating to kadmin with one client of many, it fails with kadmin: GSS-API (or Kerberos) error while initializing kadmin interface. The Kerberos host is specified with its subnet address. ...
0
votes
0answers
1k views

RSAT : Samba 4 Server not operational

Samba 4 now supports GPO and management through the Active Directory Windows console. But, when I open it after installation, I cannot access the server nor the domain. The message returned is that ...
-1
votes
2answers
703 views

after power outage no permissions to access samba share from windows machines on the same domain

I am running a ClearCase server on RHEL 6.7. We had a power outage last night (for the life of me I do not know why we don't have damn UPS). At any rate, when the machine was brought back up, we are ...
-1
votes
1answer
405 views

Does Tomcat with Kerberos need a keytab file linked with a specific user?

We are trying to setup a tomcat server on RHEL 6.5 to use Kerberos authentication. We have tried to follow this guide, but it seems more appropriate for a Windows implementation. In our environment, ...