Kerberos is a computer network authentication protocol which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner.

learn more… | top users | synonyms

1
vote
0answers
26 views

Smart Card > Kerberos > Putty > Internet

I'm searching for a posibility to bypass the "Firewall". I've tried everything I know more than 2 weeks, so I ask here for a answer. We have no admin rights and the OS is Windows Vista There is an ...
2
votes
0answers
31 views

Login to GNOME (Fedora) using my FreeIPA credentials

I have a FreeIPA Server (Fedora Server 23) and a FreeIPA Client (Fedora Server 23 with GNOME). Everything works excepts one thing: I can't login to Fedora Client with my FreeIPA username and password. ...
0
votes
1answer
64 views

Mount a Samba share using Kerberos ticket

I have a Samba server (which is the domain controller), and a Ubuntu 14.04 Client with a logged user who is authenticated by Kerberos (the client joined to domain with Likewise). The user want to ...
0
votes
0answers
30 views

git under Kerberos: 'fatal: error when closing sha1 file: Connection timed out'

Trying to update a git repo on a remote server with kerberos authentication. running me@remote:/path/to/repo/$ git fetch local:/path/to/repo yields the error fatal: error when closing sha1 file: ...
0
votes
0answers
12 views

No kdb5_util available

I installed kerberos server using this page (https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/installing-kerberos.html) Pretty simple. But now when I'...
0
votes
1answer
62 views

kerberos ticket not renewable

I followed all recommended MIT kerberos configuration settings. I created a principal and when I do kadmin.local getprinc I see the following kadmin.local: getprinc centos@HADOOP.PSM Principal: ...
1
vote
0answers
113 views

How to disable Kerberos authentication for Outlook on Windows 7?

A bit of background: I'm trying to debug an issue with Outlook taking a long time (20s) to connect to Exchange 2013 when being on the same network as Exchange (connected with Ethernet cable) but ...
0
votes
0answers
16 views

NFS Server: Kerberos for Devices?

I'm setting up a Debian NFSv4 server in my home, and I'm planning to connect my WDTV Live Plus and PS3 in addition to my other computers here. I'd love to enable Kerberos to keep everything secure, ...
0
votes
1answer
51 views

Why do I get duplicate Kerberos service tickets with no realm?

Under what circumstances will I obtain apparently-valid service tickets that are duplicates and that don't have an associated realm? That is, does this indicate a mis-configuration somewhere? Does it ...
0
votes
0answers
96 views

Loading kerberos keytab from root cron

When I run a script (see below) to load a kerberos keytab from a users cron it works just fine. Running it from root cron however a password is asked for the keytab and it aborts with: kinit: Generic ...
0
votes
0answers
10 views

Ubuntu Network > Cross device authentication > Single Login Registration

My firm runs an Ubuntu based developer environment. Recently due to the increase of new interns in our firm the firm asked me to setup a machine independent authentication system such that the users ...
1
vote
1answer
79 views

Restricting ssh access to server within a kerberos/ldap infrastructure

I have a MIT-Kerberos / OpenLDAP infrastructure. I want to limit the ssh-access for my users, so that only members of a specific group are allowed to ssh to my servers. When I just had OpenLDAP ...
0
votes
0answers
43 views

Kerberos failure in internet explorer on refresh

I have an apache httpd set up to do kerberos and it works fine in chrome, firefox, and IE11. But when I refresh the page in IE11, the resources fail with 401s, removing style and async content from ...
0
votes
0answers
33 views

Kerberos 5 Tacking on Realm Twice to Principal

I recently updated a Fedora 22 workstation and SSSD logins began to fail. Logs look good until sss_send_pac fails. Oddly the principal user is getting the domain added twice. For example: jgiotta\@...
0
votes
0answers
54 views

Is it possible to skip kerberos kinit & aklog? I want to use tramp/sshfs

I've been given access to a remote system. I've been instructed that I have to execute kinit and then aklog every time I log in. I am not sure what is the reason for it (I have read the kinit is ...
1
vote
1answer
18 views

Kerberised NFSv4 share for Yum repo

I am trying to set up a yum server where the packages are stored on an Kerberised NFSv4 share. How do I get the service username under which apache and reposync run (my-yum-service-accnt) to be able ...
0
votes
0answers
32 views

ssh authentication using kerberos keytab

I've been instructed to ssh into a server using a kerberos ticket. I have a keytab that I extracted using kadmin, but I'm not sure how to use it to authenticate. I've been using ssh for years, but I'...
2
votes
1answer
2k views

'net ads join -U username' failing with an error 'NT_STATUS_IO_TIMEOUT'

I am attempting to provide access to Ubuntu shared directories using Active Directory users and group using Samba. I am following this article to install and configure AD and Unix so that access can ...
1
vote
1answer
80 views

Connecting to MS SQLServer from a Linux box

I am trying to connect to MS SQLServer from an application that I have written (using Qt) which runs on Linux. Here are some details of the setup: The SQLServer box (SQLBox) is part of my domain (...
0
votes
0answers
67 views

why am I getting an error with postgres and kerberos?

I am trying to install a web app that requires a postgres database, with a user and a password. Whenever I try to connect to the database, I get the following error: Cannot connect to database mydb: ...
0
votes
0answers
87 views

Can't get Google Chrome Kerberos authentication via GPO to work

I'm trying to provide Single Sign on into our Team Foundation Server environment throught Chrome, but I can't get it to work. I used the administrative templates for Chrome and enabled the following: ...
0
votes
1answer
84 views

kinit worked but without kinit ssh doesn't work.

Case 1) machine: kinit machine: xxx@production.xxx.com's password: (inputted my password) machine: ssh machineB production.xxx.com Successfully sshd. Case 2) machine: ssh machineB production.xxx....
0
votes
1answer
143 views

How can I install kerberised services on debian?

I installed kerberos in my debian environment and made it work with SSH. I also would like to try it with other services but I could not install them on debian. I followed several tutorials e.g. ...
1
vote
0answers
373 views

Force mount.cifs to use specific kerberos ticket

TL;DR I want to force mount.cifs (or smbclient) to use specific ticket (e.g. cifs/server@DOMAIN2 instead of cifs/server@DOMAIN). Long Story I have two smb servers (both are windows): server-a and ...
2
votes
2answers
2k views

Samba Winbind not working in Debian 8

I am setting up a new samba environment based on Debian Jessie. Installation of PDC was succesfully and Windows clients were able to join. Have a problem at joining the Linux clients. I was following ...
1
vote
2answers
1k views

Starting rpcgssd on CentOS 7

I'm running CentOS 7.0.1406, and have problems with NFSv4, authenticating using krb5p. Neither idmapd nor gssd would start automatically. I could fix the former by doing systemctl enable nfs-idmap. ...
1
vote
1answer
2k views

Is it OK to have kerberos-sec port open to the Internet in Mac OS X?

I’ve just bought my first Mac I want to connect it directly to the Internet in a colocation facility. Running nmap against it shows: Starting Nmap 6.40 ( http://nmap.org ) at 2015-02-18 21:54 GMT ...
0
votes
1answer
395 views

List of setspn service classes and their meanings

I am trying to set up my Java tomcat service to be authenticated using Kerberos (Negotiate SSO) in MS AD. For this it is necessary to create SPN. In the documentation of setspn on http://technet....
1
vote
1answer
2k views

How to manually get a kerberos service ticket?

I've registred a SPN, now I want to try to get a ticket for it. I know there is linux kvno to do that is there an analog on windows?
0
votes
1answer
796 views

“kdb5_util create” fails with an error

krb5-server 1.10.3-33.el6 on CentOS 6.5. I'm following the Red Hat KDC Instructions. Right there at the start, the instructions give me /usr/sbin/kdb5_util create -s. If I run that, I get this: # /...
1
vote
3answers
314 views

Kerberos and LDAP complex relationship

I have problems understanding the relationship between LDAP and Kerberos (Conceptually). I understand LDAP as a directory service, and Kerberos as an authentication service. We also know that LDAP ...
1
vote
1answer
642 views

Kerberos failure emergency: need to filter a Wireshark capture to show only Kerberos and SPNEGO traffic

I am attempting to troubleshoot a serious Kerberos authentication problem on our SBS 2003 domain (none of our Windows 7 or XP workstations can authenticate). We have logged failed Kerberos ...
3
votes
1answer
784 views

Cross realm kerberos authentication with ssh

How can I configure server wide cross realm authentication on an openssh server using kerberos without having to add principles for both realms in the .k5login file?
1
vote
1answer
756 views

Configuring SASL with kerberos

This is my first time configuring SASL, and I am lost. I have a samba 4 as AD controller, and have installed kerberos. kinit is already succesful, but SASL cannot authenticate anything I have tried ...
1
vote
0answers
66 views

What goes on when using kinit with a keytab file

Wish to get more understanding on the use of kinit and keytab file. For example, if I already have a keytab file generated for a service ( the service registered to active directory by ktpass -mapuser ...
1
vote
0answers
117 views

Make ecryptfs work on kerberos secured nfs4-share

I have a working single-signe-on setup using Kerberos and openLDAP. I have setup NFS4 to use this infrastructure to control access to the shared folders. This works perfectly fine. The NFS4 sever ...
1
vote
0answers
1k views

Can't perform Kerberos login

I can't do a Kerberos login. I've tweaked rsyslog to record *.debug to /var/log/debug, whose output is below. If I attempt to log in with ssh, I get: Jun 6 23:13:05 foo-machine sshd[13965]: ...
2
votes
1answer
4k views

LSA (LsaSrv) “The security package Kerberos generated an exception. The exception information is the data.” caused by NPS

I have a Windows server (2008 R2 with SP1) that runs as a domain controller, and uses Network Policy Server to authenticate Wireless 802.1X devices. There are two access points available. Suddenly ...
0
votes
1answer
389 views

nslcd failing to come up in Lubuntu 14.04 Desktop

After installing Kerberos and LDAP via instructions from Ubuntu's Single Sign On instructions, modified a mite to fit my setup, I could manually sudo service nslcd start and then call getent passwd to ...
4
votes
1answer
2k views

How to install/enable ktpass.exe on Windows 7?

How can I install or enable the ktpass.exe utility on a Windows 7 workstation?
0
votes
1answer
451 views

For password protected Samba share on home network, ntlm vs ntlmv2 vs krb5 (kerberos)?

I have a home network with wifi that is password protected. On my home network, I have a file server with a password protected Samba share. The share itself is protected because my network has ...
1
vote
2answers
2k views

Kerberos Server and logs

I'm attempt to set up a Kerberos server, and am running into some sort of issue with the configuration message. Unfortunately, the daemon refuses to tell me what went wrong; it tells me to "see log ...
1
vote
1answer
2k views

Apache / Nginx - Reverse Proxy and Kerberos Constrained Delegation

I am after a solution to replace Microsoft TMG, and i am hoping there is an open source route of acomplishing. Currently using TMG we are reverse proxying Web resources say for example sharepoint, ...
3
votes
1answer
2k views

How can I enable Kerberos / GSSAPI authentication in Pidgin on Linux?

Some XMPP/Jabber servers (e.g. Openfire) support single-sign-on authentication using Kerberos. Pidgin claims to support this, but I was unable to find documentation on how to set it up.
1
vote
1answer
58 views

Is it possible to set an SPN with a path?

I'd like to know, if it is possible to set an SPN with non root url as something like that: setspn -U -A http/www.example.com/someApp/path/ someServiceUser So that different applications running in ...
0
votes
1answer
547 views

Does plink support GSSAPI?

Does plink support GSSAPI? I know putty itself does and enabling GSSAPI works fine with putty, but for some reason it is not working with plink. I was under impression that plink would work the same. ...
1
vote
0answers
433 views

Thousands of Logon/Logoff requests in Windows Event Viewer from a different computer on the same domain

For the past month or so, a computer that is on the same domain as me has been spamming my computer with logon/logoff requests via kerberos. I get ~4,000 requests on my computer a day. This includes ...
1
vote
1answer
445 views

sshfs with gssapi

For my normal login with ssh I have in my ~/.ssh/config the following lines: GSSAPIAuthentication yes GSSAPIDelegateCredentials yes ... so that if I call kinit and get a Kerberos ticket then I ...
0
votes
0answers
2k views

Time Machine over network using incorrect realm for kerberos authentication

Question: how can I influence the kerberos realm that Time Machine, or more specifically NetAuthSysAgent, uses? Time Machine backups over the network are failing on OS X 10.7 / 10.8 clients except ...
11
votes
1answer
1k views

Mount Mac OSX server NFS from Linux <krb5> LDAP?

I'm trying to mount an NFS share from Fedora 16. The server is Mac OS X Server, set up by my coworker. I believe it requires Kerberos/LDAP authentication, so I would start the (probably arduous) ...