Questions tagged [kerberos]

Kerberos is a computer network authentication protocol which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner.

Filter by
Sorted by
Tagged with
29 votes
2 answers
23k views

Does Firefox support wildcards in NTLM / Negotiate URI's for autologin?

Following this question about Windows Domain Authentication with Firefox, does FF support using wildcards in the URI's? I'm not finding anything where it mentions support either way.
squillman's user avatar
  • 7,756
25 votes
3 answers
12k views

Integrate kerberos and Keychain

It it possible to make kinit ask Keychain for password and not me?
tig's user avatar
  • 4,734
13 votes
2 answers
3k views

Mount Mac OSX server NFS from Linux <krb5> LDAP?

I'm trying to mount an NFS share from Fedora 16. The server is Mac OS X Server, set up by my coworker. I believe it requires Kerberos/LDAP authentication, so I would start the (probably arduous) ...
Chinasaur's user avatar
  • 231
12 votes
2 answers
16k views

How does Kerberos' preauthentication increase security?

This FAQ entry (and the RFC itself) states that pre-authentication addresses a weakness in initial implementations of Kerberos that made it vulnerable to offline dictionary attacks. The FAQ state: ...
Aidan Steele's user avatar
10 votes
4 answers
14k views

Google Chrome on Mac OS X with Kerberos

Is it possible to use Kerberized Websites with Google Chrome on Mac OS X?
loomi's user avatar
  • 505
9 votes
2 answers
15k views

How to install/enable ktpass.exe on Windows 7?

How can I install or enable the ktpass.exe utility on a Windows 7 workstation?
RyanHennig's user avatar
8 votes
3 answers
36k views

Mount a Samba share using Kerberos ticket

I have a Samba server (which is the domain controller), and a Ubuntu 14.04 Client with a logged user who is authenticated by Kerberos (the client joined to domain with Likewise). The user want to ...
mbalint987's user avatar
6 votes
4 answers
55k views

How to manually get a kerberos service ticket?

I've registred a SPN, now I want to try to get a ticket for it. I know there is linux kvno to do that is there an analog on windows?
MaxNevermind's user avatar
5 votes
1 answer
4k views

Cross realm kerberos authentication with ssh

How can I configure server wide cross realm authentication on an openssh server using kerberos without having to add principles for both realms in the .k5login file?
Iain Conochie's user avatar
5 votes
2 answers
16k views

Can't connect to my server using SSH Kerberos Auth on OSX 10.7

I just upgraded my Mac OS to 10.7 Lion. It has worked well before. But, only kinit working normally now, I can't ssh to my server. After reinstalling the "Mac OS X Kerberos Extras", it didn't get ...
user avatar
5 votes
2 answers
18k views

Kerberos Server and logs

I'm attempt to set up a Kerberos server, and am running into some sort of issue with the configuration message. Unfortunately, the daemon refuses to tell me what went wrong; it tells me to "see log ...
Thanatos's user avatar
  • 2,492
4 votes
2 answers
13k views

Is it OK to have kerberos-sec port open to the Internet in Mac OS X?

I’ve just bought my first Mac I want to connect it directly to the Internet in a colocation facility. Running nmap against it shows: Starting Nmap 6.40 ( http://nmap.org ) at 2015-02-18 21:54 GMT ...
fadedbee's user avatar
  • 195
3 votes
1 answer
3k views

How can I enable Kerberos / GSSAPI authentication in Pidgin on Linux?

Some XMPP/Jabber servers (e.g. Openfire) support single-sign-on authentication using Kerberos. Pidgin claims to support this, but I was unable to find documentation on how to set it up.
ngroot's user avatar
  • 171
3 votes
1 answer
1k views

sshfs with gssapi

For my normal login with ssh I have in my ~/.ssh/config the following lines: GSSAPIAuthentication yes GSSAPIDelegateCredentials yes ... so that if I call kinit and get a Kerberos ticket then I ...
Asen Christov's user avatar
3 votes
1 answer
6k views

mount.cifs: Any way to mount with kerberos using the machine credentials

When a Linux machine joins a domain, a computer account is created in Active Directory. Can this account be used to mount a network share with cifs and Kerberos?
bbigras's user avatar
  • 461
3 votes
1 answer
19k views

pam_sss(sshd:account): Access denied for user AD

sssd.conf: [sssd] domains = corp.com config_file_version = 2 services = nss, pam [domain/corp.com] ad_domain = corp.lecapam.com krb5_realm = CORP.COM realmd_tags = manages-system joined-with-samba ...
scripter's user avatar
3 votes
0 answers
454 views

Why do I get duplicate Kerberos service tickets with no realm?

Under what circumstances will I obtain apparently-valid service tickets that are duplicates and that don't have an associated realm? That is, does this indicate a mis-configuration somewhere? Does it ...
neirbowj's user avatar
  • 564
3 votes
2 answers
6k views

Samba Winbind not working in Debian 8

I am setting up a new samba environment based on Debian Jessie. Installation of PDC was succesfully and Windows clients were able to join. Have a problem at joining the Linux clients. I was following ...
Luki's user avatar
  • 31
2 votes
1 answer
714 views

Can I use Kerberos for EAP without the RADIUS server getting anything but a ticket?

I would like to use Kerberos with FreeRADIUS, but I don't want FreeRADIUS to have access to any passwords (hashed or otherwise), especially because such passwords may not exist if smart card ...
Demi's user avatar
  • 818
2 votes
1 answer
5k views

List of setspn service classes and their meanings

I am trying to set up my Java tomcat service to be authenticated using Kerberos (Negotiate SSO) in MS AD. For this it is necessary to create SPN. In the documentation of setspn on http://technet....
kulatamicuda's user avatar
2 votes
1 answer
27k views

Couldn't join realm: Insufficient permissions to join the domain

I'm getting the following error when I try to join the linux machine to AD: $ realm join proxmox.local --computer-ou="CN=TEST,CN=Computers,DC=proxmox" --verbose * Resolving: _ldap._tcp.proxmox.local ...
NEO's user avatar
  • 121
2 votes
1 answer
10k views

pam_sss access denied with kerberos authentication ok

I'm trying to use sssd with kerberos authentication and ldap on Ubuntu 18.04 (server and client machine). On Ubuntu client side I installed sssd sssd-tools packages. But when I want to log in to alice,...
Charles's user avatar
  • 33
2 votes
2 answers
2k views

What is the difference between headless, service and user Kerberos keytabs

I often work on Kerberised Hadoop clusters, and have to use a variety of keytabs, such as: hbase.headless.keytab hbase.service.keytab devuser.keytab I'm not entirely clear on exactly what the ...
Ben Watson's user avatar
2 votes
1 answer
9k views

LSA (LsaSrv) "The security package Kerberos generated an exception. The exception information is the data." caused by NPS

I have a Windows server (2008 R2 with SP1) that runs as a domain controller, and uses Network Policy Server to authenticate Wireless 802.1X devices. There are two access points available. Suddenly ...
Adambean's user avatar
  • 965
2 votes
1 answer
468 views

Kerberos gets tickets for wrong user

At work, I have two active directory/domain accounts: username - I log in to my computer with this adm_username - this user is administrator for some servers that I am responsible for We have a ...
codeape's user avatar
  • 726
2 votes
3 answers
2k views

Unable to set up Outlook with local IMAP (dovecot) host on Mac

I am trying to configure Outlook 365 (version 16.22.1) on Mac High Sierra (10.13.6). The Mac is a domain member on a Windows Active Directory domain. Our office has a self-hosted IMAP mail server ...
Mark Foley's user avatar
2 votes
1 answer
2k views

Configuring SASL with kerberos

This is my first time configuring SASL, and I am lost. I have a samba 4 as AD controller, and have installed kerberos. kinit is already succesful, but SASL cannot authenticate anything I have tried ...
prd's user avatar
  • 176
2 votes
1 answer
3k views

Windows: Obtain Kerberos TGT from another principal

I'm looking for a way to obtain a tgt (ticket granting ticket) from a second kerberos principal. In my job I work with a regular PC (member of AD) from our university's it departement but I also ...
CHfish's user avatar
  • 428
2 votes
0 answers
1k views

How to mount Windows share using Kerberos with custom keytab automatically?

I have to mount a Samba share using Kerberos on a SLES 12 system automatically from boot on. The problem is, that the Kerberos ticket does not get automatically requested when trying to mount the ...
Ventor's user avatar
  • 21
2 votes
0 answers
457 views

Opera web browser kerberos authentication with delegation support

I'm using a LAN web site which relies on impersonation to be able to connect to a SQL Server machine (located on another machine in the domain). I'm not able to get it to authenticate properly using ...
ggo's user avatar
  • 123
2 votes
1 answer
795 views

Linux Active Directory login failed because of password

I have a Linux machine that has a connection to the AD. kinit command works correct (it has no output when I run it). But when I try to login to this Linux, I get "Access denied" error. Dec 20 16:33:...
Jo Shepherd's user avatar
2 votes
1 answer
10k views

Kafkatool.exe failed create new KafkaAdminClient SASL_PLAINTEXT

I have created a kerberized Kafka cluster. It is working fine and I can produce and consume messages. Now I want to use the kafkatool2 software, and I am running the program through cmd by this ...
A.Kazemi's user avatar
2 votes
1 answer
1k views

Generation of SSHFP Records in FreeIPA

MY SETUP I have a cluster of machines running Centos 7.3, and I am using Kerberos / LDAP for authentication. Kerberos / LDAP are as packaged in FreeIPA 4.4.0. All hosts have an address on 192.168.1....
Dave's user avatar
  • 1,019
2 votes
0 answers
443 views

Printing to smb with kerberos auth?

I want to set up a printer via linux samba client to a Windows printserver. I managed to do it specifying this connection string: smb://user:pass@printserver/printer Is there a way to do auth ...
Andrey Regentov's user avatar
2 votes
1 answer
2k views

How to request (not renew) Kerberos Ticket every 5 days on Ubuntu

I have set up a ubuntu 16.04 machine and integrated it into a windows active directory domain environment using this guide: https://www.unixmen.com/how-to-join-an-ubuntu-desktop-into-an-active-...
dynamight's user avatar
2 votes
0 answers
350 views

Smart Card > Kerberos > Putty > Internet

I'm searching for a posibility to bypass the "Firewall". I've tried everything I know more than 2 weeks, so I ask here for a answer. We have no admin rights and the OS is Windows Vista There is an ...
Denis's user avatar
  • 39
2 votes
0 answers
661 views

Login to GNOME (Fedora) using my FreeIPA credentials

I have a FreeIPA Server (Fedora Server 23) and a FreeIPA Client (Fedora Server 23 with GNOME). Everything works excepts one thing: I can't login to Fedora Client with my FreeIPA username and password. ...
mbalint987's user avatar
2 votes
1 answer
10k views

'net ads join -U username' failing with an error 'NT_STATUS_IO_TIMEOUT'

I am attempting to provide access to Ubuntu shared directories using Active Directory users and group using Samba. I am following this article to install and configure AD and Unix so that access can ...
Amit Baswa's user avatar
2 votes
0 answers
2k views

Force mount.cifs to use specific kerberos ticket

TL;DR I want to force mount.cifs (or smbclient) to use specific ticket (e.g. cifs/server@DOMAIN2 instead of cifs/server@DOMAIN). Long Story I have two smb servers (both are windows): server-a and ...
joozek's user avatar
  • 121
2 votes
1 answer
1k views

XP MODE: the time on this PC and the current time on the network are different

Some folks were monkeying around with the Time service and Kerberos on our Windows 2003 network domain controllers last night, and today I cannot boot up XP Mode on my Windows 7 desktop. I've rebooted ...
Mr Blint's user avatar
2 votes
0 answers
7k views

Likewise on Ubuntu - domain user sometimes disappears from Login Screen

I'm using Likewise to authenticate to a Windows Domain on a laptop running Ubuntu 10.04. Everything seems to be working well, except for one thing. Normally, after the machine boots, I am presented ...
davidA's user avatar
  • 372
1 vote
3 answers
267 views

How am I able to check emails on outlook in my office windows machine without entering password

I have a basic question. At work, I log on to a domain from my work machine using a password. Then, once I am logged-in, I can read mails in outlook without having to enter any password. What I ...
p2pnode's user avatar
  • 1,367
1 vote
2 answers
4k views

Firefox and Chromium don't do Kerberos negotiation, cURL does?

I can successfully run kinit to get following klist output: Ticket cache: FILE:/tmp/krb5cc_1001 Default principal: [email protected] Valid starting Expires Service principal 01.03....
Kerim Güney's user avatar
1 vote
1 answer
700 views

Default Kerberos realm

I was following the instructions to install Samba from their website, and it said I needed to install the package krb5-user. So I typed: sudo apt-get install krb5-user It started installing, and ...
tony_sid's user avatar
  • 14.3k
1 vote
1 answer
4k views

Apache reverse proxy not passing custom headers to the target server

I have configured Apache as reverse proxy to my PostGraphile service. My idea is to use Apache to do kerberos authentication and then make PostGraphile service available to authenticated users. I ...
Greg0ry's user avatar
  • 228
1 vote
1 answer
227 views

Exporting and importing Active Directory users

We need to export all the users (~20000) to newly installed Active Directory 2016 server from our existing Active Directory 2012 server, the problem is that we have not user passwords, and I wonder if ...
Edik Mkoyan's user avatar
1 vote
3 answers
2k views

Kerberos and LDAP complex relationship

I have problems understanding the relationship between LDAP and Kerberos (Conceptually). I understand LDAP as a directory service, and Kerberos as an authentication service. We also know that LDAP ...
adrin's user avatar
  • 429
1 vote
1 answer
2k views

Can't chgrp in NFS4 mounts

I'm using Linux in a large multi-user network. Let A be some group which I'm am member of, but which is not my primary group. According to chmod(2) I should be able to chgrp a file to group A. Trying ...
Philipp's user avatar
  • 271
1 vote
2 answers
310 views

SSH config for remote servers using kerberos

I connect to my remote server using: ssh -At [email protected] ssh -At [email protected] The following only asks me for a password one time. I do not have any authentication file on my computer, ...
Peyman's user avatar
  • 353
1 vote
1 answer
1k views

Curl with GSS-API on Alpine Docker

I am trying to get curl installed in a Dockerfile with the GSS-API, SPNEGO, or GSS-Negotiate features installed so I can use the --negotiate flag. How can I configure curl to be installed with that ...
Alex W's user avatar
  • 1,976