Kerberos is a computer network authentication protocol which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner.

learn more… | top users | synonyms

18
votes
2answers
13k views

Does Firefox support wildcards in NTLM / Negotiate URI's for autologin?

Following this question about Windows Domain Authentication with Firefox, does FF support using wildcards in the URI's? I'm not finding anything where it mentions support either way.
12
votes
2answers
2k views

Integrate kerberos and Keychain

It it possible to make kinit ask Keychain for password and not me?
8
votes
1answer
742 views

Mount Mac OSX server NFS from Linux <krb5> LDAP?

I'm trying to mount an NFS share from Fedora 16. The server is Mac OS X Server, set up by my coworker. I believe it requires Kerberos/LDAP authentication, so I would start the (probably arduous) ...
5
votes
2answers
7k views

Can't connect to my server using SSH Kerberos Auth on OSX 10.7

I just upgraded my Mac OS to 10.7 Lion. It has worked well before. But, only kinit working normally now, I can't ssh to my server. After reinstalling the "Mac OS X Kerberos Extras", it didn't get ...
4
votes
2answers
5k views

How does Kerberos' preauthentication increase security?

This FAQ entry (and the RFC itself) states that pre-authentication addresses a weakness in initial implementations of Kerberos that made it vulnerable to offline dictionary attacks. The FAQ state: ...
3
votes
2answers
3k views

Google Chrome on Mac OS X with Kerberos

Is it possible to use Kerberized Websites with Google Chrome on Mac OS X?
2
votes
1answer
2k views

LSA (LsaSrv) “The security package Kerberos generated an exception. The exception information is the data.” caused by NPS

I have a Windows server (2008 R2 with SP1) that runs as a domain controller, and uses Network Policy Server to authenticate Wireless 802.1X devices. There are two access points available. Suddenly ...
2
votes
1answer
1k views

How can I enable Kerberos / GSSAPI authentication in Pidgin on Linux?

Some XMPP/Jabber servers (e.g. Openfire) support single-sign-on authentication using Kerberos. Pidgin claims to support this, but I was unable to find documentation on how to set it up.
2
votes
1answer
259 views

Cross realm kerberos authentication with ssh

How can I configure server wide cross realm authentication on an openssh server using kerberos without having to add principles for both realms in the .k5login file?
2
votes
1answer
746 views

Windows: Obtain Kerberos TGT from another principal

I'm looking for a way to obtain a tgt (ticket granting ticket) from a second kerberos principal. In my job I work with a regular PC (member of AD) from our university's it departement but I also ...
2
votes
2answers
360 views

Samba Winbind not working in Debian 8

I am setting up a new samba environment based on Debian Jessie. Installation of PDC was succesfully and Windows clients were able to join. Have a problem at joining the Linux clients. I was following ...
2
votes
0answers
1k views

How to install/enable ktpass.exe on Windows 7?

How can I install or enable the ktpass.exe utility on a Windows 7 workstation?
2
votes
1answer
627 views

XP MODE: the time on this PC and the current time on the network are different

Some folks were monkeying around with the Time service and Kerberos on our Windows 2003 network domain controllers last night, and today I cannot boot up XP Mode on my Windows 7 desktop. I've rebooted ...
2
votes
0answers
5k views

Likewise on Ubuntu - domain user sometimes disappears from Login Screen

I'm using Likewise to authenticate to a Windows Domain on a laptop running Ubuntu 10.04. Everything seems to be working well, except for one thing. Normally, after the machine boots, I am presented ...
1
vote
3answers
233 views

How am I able to check emails on outlook in my office windows machine without entering password

I have a basic question. At work, I log on to a domain from my work machine using a password. Then, once I am logged-in, I can read mails in outlook without having to enter any password. What I ...
1
vote
1answer
390 views

Default Kerberos realm

I was following the instructions to install Samba from their website, and it said I needed to install the package krb5-user. So I typed: sudo apt-get install krb5-user It started installing, and ...
1
vote
1answer
561 views

Error during configuring kerberos5 using macports

While trying to install libmemcached via MacPorts, I hit the following issue: libmemcached @0.40 +universal ---> Computing dependencies for libmemcached ---> Dependencies to be ...
1
vote
1answer
1k views

Can't chgrp in NFS4 mounts

I'm using Linux in a large multi-user network. Let A be some group which I'm am member of, but which is not my primary group. According to chmod(2) I should be able to chgrp a file to group A. Trying ...
1
vote
1answer
251 views

Configuring SASL with kerberos

This is my first time configuring SASL, and I am lost. I have a samba 4 as AD controller, and have installed kerberos. kinit is already succesful, but SASL cannot authenticate anything I have tried ...
1
vote
2answers
927 views

Kerberos Server and logs

I'm attempt to set up a Kerberos server, and am running into some sort of issue with the configuration message. Unfortunately, the daemon refuses to tell me what went wrong; it tells me to "see log ...
1
vote
1answer
1k views

Apache / Nginx - Reverse Proxy and Kerberos Constrained Delegation

I am after a solution to replace Microsoft TMG, and i am hoping there is an open source route of acomplishing. Currently using TMG we are reverse proxying Web resources say for example sharepoint, ...
1
vote
1answer
38 views

Is it possible to set an SPN with a path?

I'd like to know, if it is possible to set an SPN with non root url as something like that: setspn -U -A http/www.example.com/someApp/path/ someServiceUser So that different applications running in ...
1
vote
1answer
106 views

Why can I see two distinct /tmp dirs?

Problem I am seeing two different /tmp directories. In a plain GNOME terminal ls -lia /tmp gives the following: total 136 5797 drwxrwxrwt 36 root root 780 Oct 5 20:57 . 2 drwxr-xr-x 21 ...
1
vote
1answer
230 views

Kerberos failure emergency: need to filter a Wireshark capture to show only Kerberos and SPNEGO traffic

I am attempting to troubleshoot a serious Kerberos authentication problem on our SBS 2003 domain (none of our Windows 7 or XP workstations can authenticate). We have logged failed Kerberos ...
1
vote
0answers
45 views

What goes on when using kinit with a keytab file

Wish to get more understanding on the use of kinit and keytab file. For example, if I already have a keytab file generated for a service ( the service registered to active directory by ktpass -mapuser ...
1
vote
0answers
75 views

Make ecryptfs work on kerberos secured nfs4-share

I have a working single-signe-on setup using Kerberos and openLDAP. I have setup NFS4 to use this infrastructure to control access to the shared folders. This works perfectly fine. The NFS4 sever ...
1
vote
0answers
518 views

Can't perform Kerberos login

I can't do a Kerberos login. I've tweaked rsyslog to record *.debug to /var/log/debug, whose output is below. If I attempt to log in with ssh, I get: Jun 6 23:13:05 foo-machine sshd[13965]: ...
1
vote
0answers
372 views

Thousands of Logon/Logoff requests in Windows Event Viewer from a different computer on the same domain

For the past month or so, a computer that is on the same domain as me has been spamming my computer with logon/logoff requests via kerberos. I get ~4,000 requests on my computer a day. This includes ...
1
vote
0answers
623 views

Kerberos events are not logged on Windows 7

I tried to configure Windows 7 machine with our web-server running on it to log Kerberos-related events (meaning Windows system Log). I followed these instructions: How to enable Kerberos event ...
1
vote
1answer
539 views

kinit gives me a Kerberos ticket, but no AFS token

I'm trying to setup access to my university's IT environment from my laptop running Ubuntu 12.04, by (mostly) following the IT-department's guides on AFS and Kerberos. I can get AFS working well ...
1
vote
1answer
759 views

Changing remote server date via Powershell

I need to change the date of a server to the next day then run a sql script and then change the server date back. I figured out how to change the server date via powershell Invoke-Command ...
1
vote
0answers
1k views

Macos X 10.6 not refreshing Kerberos TGT key

I observed that MacOS X 10.6, if machine is added to an Active Directory and set to authenticate over LDAP to the Active Directory server requests a Kerberos TGT as expected at each user login. ...
1
vote
2answers
249 views

Starting rpcgssd on CentOS 7

I'm running CentOS 7.0.1406, and have problems with NFSv4, authenticating using krb5p. Neither idmapd nor gssd would start automatically. I could fix the former by doing systemctl enable nfs-idmap. ...
0
votes
1answer
241 views

Is it OK to have kerberos-sec port open to the Internet in Mac OS X?

I’ve just bought my first Mac I want to connect it directly to the Internet in a colocation facility. Running nmap against it shows: Starting Nmap 6.40 ( http://nmap.org ) at 2015-02-18 21:54 GMT ...
0
votes
1answer
75 views

List of setspn service classes and their meanings

I am trying to set up my Java tomcat service to be authenticated using Kerberos (Negotiate SSO) in MS AD. For this it is necessary to create SPN. In the documentation of setspn on ...
0
votes
2answers
112 views

Kerberos and LDAP complex relationship

I have problems understanding the relationship between LDAP and Kerberos (Conceptually). I understand LDAP as a directory service, and Kerberos as an authentication service. We also know that LDAP ...
0
votes
1answer
362 views

Does plink support GSSAPI?

Does plink support GSSAPI? I know putty itself does and enabling GSSAPI works fine with putty, but for some reason it is not working with plink. I was under impression that plink would work the same. ...
0
votes
3answers
3k views

Windows Vista and 7 crossrealm authentication MIT Kerberos

I'm using Windows Server 2008 and Windows Vista and 7 for cross realm authentication using MIT Kerberos 1.6 but when i try to login with a user the KDC answers: (wireshark output) error_code: ...
0
votes
0answers
4 views

kinit worked but without kinit ssh doesn't work.

Case 1) machine: kinit machine: xxx@production.xxx.com's password: (inputted my password) machine: ssh machineB production.xxx.com Successfully sshd. Case 2) machine: ssh machineB ...
0
votes
1answer
8 views

How can I install kerberised services on debian?

I installed kerberos in my debian environment and made it work with SSH. I also would like to try it with other services but I could not install them on debian. I followed several tutorials e.g. ...
0
votes
0answers
67 views

Force mount.cifs to use specific kerberos ticket

TL;DR I want to force mount.cifs (or smbclient) to use specific ticket (e.g. cifs/server@DOMAIN2 instead of cifs/server@DOMAIN). Long Story I have two smb servers (both are windows): server-a and ...
0
votes
0answers
72 views

Cannot connect via SecureCRT using Kerberos on Windows

I am running a Windows 8 64-bit desktop and need to connect via SSH to a work server using Kerberos. I can authenticate successfully against my work's Kerberos system but I cannot get SecureCRT to ...
0
votes
1answer
65 views

How to manually get a kerberos service ticket?

I've registred a SPN, now I want to try to get a ticket for it. I know there is linux kvno to do that is there an analog on windows?
0
votes
1answer
114 views

“kdb5_util create” fails with an error

krb5-server 1.10.3-33.el6 on CentOS 6.5. I'm following the Red Hat KDC Instructions. Right there at the start, the instructions give me /usr/sbin/kdb5_util create -s. If I run that, I get this: # ...
0
votes
0answers
52 views

Authenticating svn+ssh commits from Windows 7 with kerberos token

I am developing on a Windows 7 machine and need to commit my visual studio 2010 projects into the primary repository here at work. I installed AnkhSVN, set it up as my plugin choice for VS, and ...
0
votes
0answers
128 views

Kerberos authentication failure: “SAM Active Directory Response - user unknown”

Everyone on our network is currently unable to access shared resources on our file server (SBS 2003 server with Windows 7 & XP workstations). A Wireshark packet capture revealed the following ...
0
votes
0answers
56 views

Linux Kerberos 5 server services and utilities stopped functioning: hash: could not retrieve header

I have been installing Kerberos 5 server on RHEL6 for some integration work. Installed yesterday and created admin principals which all seemed to work. Today I stopped the services, before trying to ...
0
votes
0answers
114 views

Convert cain & Abel KERBEROS Pre-Auth Hash to John The Ripper format

I got the following KERB5 pre-auth hash from CAIN software: slma.com\keith FA1CA9F0C2384A6FF00BEC993B8182B1030C7480D8F2EFBA6AD9179E7C130EC2EDB256227317C58D313215246E15733011A10402 I am using John ...
0
votes
1answer
263 views

nslcd failing to come up in Lubuntu 14.04 Desktop

After installing Kerberos and LDAP via instructions from Ubuntu's Single Sign On instructions, modified a mite to fit my setup, I could manually sudo service nslcd start and then call getent passwd to ...
0
votes
1answer
215 views

For password protected Samba share on home network, ntlm vs ntlmv2 vs krb5 (kerberos)?

I have a home network with wifi that is password protected. On my home network, I have a file server with a password protected Samba share. The share itself is protected because my network has ...