Questions tagged [kerberos]
Kerberos is a computer network authentication protocol which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner.
168
questions
29
votes
2
answers
23k
views
Does Firefox support wildcards in NTLM / Negotiate URI's for autologin?
Following this question about Windows Domain Authentication with Firefox, does FF support using wildcards in the URI's? I'm not finding anything where it mentions support either way.
25
votes
3
answers
12k
views
Integrate kerberos and Keychain
It it possible to make kinit ask Keychain for password and not me?
13
votes
2
answers
3k
views
Mount Mac OSX server NFS from Linux <krb5> LDAP?
I'm trying to mount an NFS share from Fedora 16. The server is Mac OS X Server, set up by my coworker. I believe it requires Kerberos/LDAP authentication, so I would start the (probably arduous) ...
12
votes
2
answers
16k
views
How does Kerberos' preauthentication increase security?
This FAQ entry (and the RFC itself) states that pre-authentication addresses a weakness in initial implementations of Kerberos that made it vulnerable to offline dictionary attacks.
The FAQ state:
...
10
votes
4
answers
14k
views
Google Chrome on Mac OS X with Kerberos
Is it possible to use Kerberized Websites with Google Chrome on Mac OS X?
9
votes
2
answers
15k
views
How to install/enable ktpass.exe on Windows 7?
How can I install or enable the ktpass.exe utility on a Windows 7 workstation?
8
votes
3
answers
36k
views
Mount a Samba share using Kerberos ticket
I have a Samba server (which is the domain controller), and a Ubuntu 14.04 Client with a logged user who is authenticated by Kerberos (the client joined to domain with Likewise). The user want to ...
6
votes
4
answers
55k
views
How to manually get a kerberos service ticket?
I've registred a SPN, now I want to try to get a ticket for it.
I know there is linux kvno to do that is there an analog on windows?
5
votes
1
answer
4k
views
Cross realm kerberos authentication with ssh
How can I configure server wide cross realm authentication on an openssh server using kerberos without having to add principles for both realms in the .k5login file?
5
votes
2
answers
16k
views
Can't connect to my server using SSH Kerberos Auth on OSX 10.7
I just upgraded my Mac OS to 10.7 Lion. It has worked well before. But, only kinit working normally now, I can't ssh to my server.
After reinstalling the "Mac OS X Kerberos Extras", it didn't get ...
5
votes
2
answers
18k
views
Kerberos Server and logs
I'm attempt to set up a Kerberos server, and am running into some sort of issue with the configuration message. Unfortunately, the daemon refuses to tell me what went wrong; it tells me to "see log ...
4
votes
2
answers
13k
views
Is it OK to have kerberos-sec port open to the Internet in Mac OS X?
I’ve just bought my first Mac I want to connect it directly to the Internet in a colocation facility.
Running nmap against it shows:
Starting Nmap 6.40 ( http://nmap.org ) at 2015-02-18 21:54 GMT
...
3
votes
1
answer
3k
views
How can I enable Kerberos / GSSAPI authentication in Pidgin on Linux?
Some XMPP/Jabber servers (e.g. Openfire) support single-sign-on authentication using Kerberos. Pidgin claims to support this, but I was unable to find documentation on how to set it up.
3
votes
1
answer
1k
views
sshfs with gssapi
For my normal login with ssh I have in my ~/.ssh/config the following lines:
GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes
... so that if I call kinit and get a Kerberos ticket then I ...
3
votes
1
answer
6k
views
mount.cifs: Any way to mount with kerberos using the machine credentials
When a Linux machine joins a domain, a computer account is created in Active Directory.
Can this account be used to mount a network share with cifs and Kerberos?
3
votes
1
answer
19k
views
pam_sss(sshd:account): Access denied for user AD
sssd.conf:
[sssd]
domains = corp.com
config_file_version = 2
services = nss, pam
[domain/corp.com]
ad_domain = corp.lecapam.com
krb5_realm = CORP.COM
realmd_tags = manages-system joined-with-samba
...
3
votes
0
answers
454
views
Why do I get duplicate Kerberos service tickets with no realm?
Under what circumstances will I obtain apparently-valid service tickets that are duplicates and that don't have an associated realm? That is, does this indicate a mis-configuration somewhere? Does it ...
3
votes
2
answers
6k
views
Samba Winbind not working in Debian 8
I am setting up a new samba environment based on Debian Jessie.
Installation of PDC was succesfully and Windows clients were able to join. Have a problem at joining the Linux clients.
I was following ...
2
votes
1
answer
714
views
Can I use Kerberos for EAP without the RADIUS server getting anything but a ticket?
I would like to use Kerberos with FreeRADIUS, but I don't want FreeRADIUS to have access to any passwords (hashed or otherwise), especially because such passwords may not exist if smart card ...
2
votes
1
answer
5k
views
List of setspn service classes and their meanings
I am trying to set up my Java tomcat service to be authenticated using Kerberos (Negotiate SSO) in MS AD. For this it is necessary to create SPN.
In the documentation of setspn on http://technet....
2
votes
1
answer
27k
views
Couldn't join realm: Insufficient permissions to join the domain
I'm getting the following error when I try to join the linux machine to AD:
$ realm join proxmox.local --computer-ou="CN=TEST,CN=Computers,DC=proxmox" --verbose
* Resolving: _ldap._tcp.proxmox.local
...
2
votes
1
answer
10k
views
pam_sss access denied with kerberos authentication ok
I'm trying to use sssd with kerberos authentication and ldap on Ubuntu 18.04 (server and client machine). On Ubuntu client side I installed sssd sssd-tools packages. But when I want to log in to alice,...
2
votes
2
answers
2k
views
What is the difference between headless, service and user Kerberos keytabs
I often work on Kerberised Hadoop clusters, and have to use a variety of keytabs, such as:
hbase.headless.keytab
hbase.service.keytab
devuser.keytab
I'm not entirely clear on exactly what the ...
2
votes
1
answer
9k
views
LSA (LsaSrv) "The security package Kerberos generated an exception. The exception information is the data." caused by NPS
I have a Windows server (2008 R2 with SP1) that runs as a domain controller, and uses Network Policy Server to authenticate Wireless 802.1X devices. There are two access points available.
Suddenly ...
2
votes
1
answer
468
views
Kerberos gets tickets for wrong user
At work, I have two active directory/domain accounts:
username - I log in to my computer with this
adm_username - this user is administrator for some servers that I am responsible for
We have a ...
2
votes
3
answers
2k
views
Unable to set up Outlook with local IMAP (dovecot) host on Mac
I am trying to configure Outlook 365 (version 16.22.1) on Mac High Sierra (10.13.6). The Mac is a domain member on a Windows Active Directory domain. Our office has a self-hosted IMAP mail server ...
2
votes
1
answer
2k
views
Configuring SASL with kerberos
This is my first time configuring SASL, and I am lost.
I have a samba 4 as AD controller, and have installed kerberos.
kinit is already succesful, but SASL cannot authenticate anything
I have tried ...
2
votes
1
answer
3k
views
Windows: Obtain Kerberos TGT from another principal
I'm looking for a way to obtain a tgt (ticket granting ticket) from a second kerberos principal.
In my job I work with a regular PC (member of AD) from our university's it departement but I also ...
2
votes
0
answers
1k
views
How to mount Windows share using Kerberos with custom keytab automatically?
I have to mount a Samba share using Kerberos on a SLES 12 system automatically from boot on. The problem is, that the Kerberos ticket does not get automatically requested when trying to mount the ...
2
votes
0
answers
457
views
Opera web browser kerberos authentication with delegation support
I'm using a LAN web site which relies on impersonation to be able to connect to a SQL Server machine (located on another machine in the domain). I'm not able to get it to authenticate properly using ...
2
votes
1
answer
795
views
Linux Active Directory login failed because of password
I have a Linux machine that has a connection to the AD. kinit command works correct (it has no output when I run it). But when I try to login to this Linux, I get "Access denied" error.
Dec 20 16:33:...
2
votes
1
answer
10k
views
Kafkatool.exe failed create new KafkaAdminClient SASL_PLAINTEXT
I have created a kerberized Kafka cluster. It is working fine and I can produce and consume messages. Now I want to use the kafkatool2 software, and I am running the program through cmd by this ...
2
votes
1
answer
1k
views
Generation of SSHFP Records in FreeIPA
MY SETUP
I have a cluster of machines running Centos 7.3, and I am using Kerberos / LDAP for authentication. Kerberos / LDAP are as packaged in FreeIPA 4.4.0.
All hosts have an address on 192.168.1....
2
votes
0
answers
443
views
Printing to smb with kerberos auth?
I want to set up a printer via linux samba client to a Windows printserver.
I managed to do it specifying this connection string:
smb://user:pass@printserver/printer
Is there a way to do auth ...
2
votes
1
answer
2k
views
How to request (not renew) Kerberos Ticket every 5 days on Ubuntu
I have set up a ubuntu 16.04 machine and integrated it into a windows active directory domain environment using this guide: https://www.unixmen.com/how-to-join-an-ubuntu-desktop-into-an-active-...
2
votes
0
answers
350
views
Smart Card > Kerberos > Putty > Internet
I'm searching for a posibility to bypass the "Firewall".
I've tried everything I know more than 2 weeks, so I ask here for a answer.
We have no admin rights and the OS is Windows Vista
There is an ...
2
votes
0
answers
661
views
Login to GNOME (Fedora) using my FreeIPA credentials
I have a FreeIPA Server (Fedora Server 23) and a FreeIPA Client (Fedora Server 23 with GNOME). Everything works excepts one thing: I can't login to Fedora Client with my FreeIPA username and password. ...
2
votes
1
answer
10k
views
'net ads join -U username' failing with an error 'NT_STATUS_IO_TIMEOUT'
I am attempting to provide access to Ubuntu shared directories using Active Directory users and group using Samba. I am following this article to install and configure AD and Unix so that access can ...
2
votes
0
answers
2k
views
Force mount.cifs to use specific kerberos ticket
TL;DR I want to force mount.cifs (or smbclient) to use specific ticket (e.g. cifs/server@DOMAIN2 instead of cifs/server@DOMAIN).
Long Story
I have two smb servers (both are windows): server-a and ...
2
votes
1
answer
1k
views
XP MODE: the time on this PC and the current time on the network are different
Some folks were monkeying around with the Time service and Kerberos on our Windows 2003 network domain controllers last night, and today I cannot boot up XP Mode on my Windows 7 desktop. I've rebooted ...
2
votes
0
answers
7k
views
Likewise on Ubuntu - domain user sometimes disappears from Login Screen
I'm using Likewise to authenticate to a Windows Domain on a laptop running Ubuntu 10.04. Everything seems to be working well, except for one thing.
Normally, after the machine boots, I am presented ...
1
vote
3
answers
267
views
How am I able to check emails on outlook in my office windows machine without entering password
I have a basic question. At work, I log on to a domain from my work machine using a password. Then, once I am logged-in, I can read mails in outlook without having to enter any password. What I ...
1
vote
2
answers
4k
views
Firefox and Chromium don't do Kerberos negotiation, cURL does?
I can successfully run kinit to get following klist output:
Ticket cache: FILE:/tmp/krb5cc_1001
Default principal: [email protected]
Valid starting Expires Service principal
01.03....
1
vote
1
answer
700
views
Default Kerberos realm
I was following the instructions to install Samba from their website, and it said I needed to install the package krb5-user. So I typed:
sudo apt-get install krb5-user
It started installing, and ...
1
vote
1
answer
4k
views
Apache reverse proxy not passing custom headers to the target server
I have configured Apache as reverse proxy to my PostGraphile service. My idea is to use Apache to do kerberos authentication and then make PostGraphile service available to authenticated users.
I ...
1
vote
1
answer
227
views
Exporting and importing Active Directory users
We need to export all the users (~20000) to newly installed Active Directory 2016 server from our existing Active Directory 2012 server, the problem is that we have not user passwords, and I wonder if ...
1
vote
3
answers
2k
views
Kerberos and LDAP complex relationship
I have problems understanding the relationship between LDAP and Kerberos (Conceptually).
I understand LDAP as a directory service, and Kerberos as an authentication service.
We also know that LDAP ...
1
vote
1
answer
2k
views
Can't chgrp in NFS4 mounts
I'm using Linux in a large multi-user network. Let A be some group which I'm am member of, but which is not my primary group. According to chmod(2) I should be able to chgrp a file to group A. Trying ...
1
vote
2
answers
310
views
SSH config for remote servers using kerberos
I connect to my remote server using:
ssh -At [email protected] ssh -At [email protected]
The following only asks me for a password one time. I do not have any authentication file on my computer, ...
1
vote
1
answer
1k
views
Curl with GSS-API on Alpine Docker
I am trying to get curl installed in a Dockerfile with the GSS-API, SPNEGO, or GSS-Negotiate features installed so I can use the --negotiate flag. How can I configure curl to be installed with that ...