Kerberos is a computer network authentication protocol which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner.

learn more… | top users | synonyms

17
votes
2answers
10k views

Does Firefox support wildcards in NTLM / Negotiate URI's for autologin?

Following this question about Windows Domain Authentication with Firefox, does FF support using wildcards in the URI's? I'm not finding anything where it mentions support either way.
8
votes
1answer
311 views

Mount Mac OSX server NFS from Linux <krb5> LDAP?

I'm trying to mount an NFS share from Fedora 16. The server is Mac OS X Server, set up by my coworker. I believe it requires Kerberos/LDAP authentication, so I would start the (probably arduous) ...
7
votes
2answers
1k views

Integrate kerberos and Keychain

It it possible to make kinit ask Keychain for password and not me?
5
votes
2answers
5k views

Can't connect to my server using SSH Kerberos Auth on OSX 10.7

I just upgraded my Mac OS to 10.7 Lion. It has worked well before. But, only kinit working normally now, I can't ssh to my server. After reinstalling the "Mac OS X Kerberos Extras", it didn't get ...
3
votes
2answers
3k views

How does Kerberos' preauthentication increase security?

This FAQ entry (and the RFC itself) states that pre-authentication addresses a weakness in initial implementations of Kerberos that made it vulnerable to offline dictionary attacks. The FAQ state: ...
2
votes
2answers
1k views

Google Chrome on Mac OS X with Kerberos

Is it possible to use Kerberized Websites with Google Chrome on Mac OS X?
2
votes
1answer
309 views

How can I enable Kerberos / GSSAPI authentication in Pidgin on Linux?

Some XMPP/Jabber servers (e.g. Openfire) support single-sign-on authentication using Kerberos. Pidgin claims to support this, but I was unable to find documentation on how to set it up.
2
votes
1answer
204 views

Windows: Obtain Kerberos TGT from another principal

I'm looking for a way to obtain a tgt (ticket granting ticket) from a second kerberos principal. In my job I work with a regular PC (member of AD) from our university's it departement but I also ...
2
votes
1answer
480 views

XP MODE: the time on this PC and the current time on the network are different

Some folks were monkeying around with the Time service and Kerberos on our Windows 2003 network domain controllers last night, and today I cannot boot up XP Mode on my Windows 7 desktop. I've rebooted ...
2
votes
0answers
4k views

Likewise on Ubuntu - domain user sometimes disappears from Login Screen

I'm using Likewise to authenticate to a Windows Domain on a laptop running Ubuntu 10.04. Everything seems to be working well, except for one thing. Normally, after the machine boots, I am presented ...
1
vote
3answers
225 views

How am I able to check emails on outlook in my office windows machine without entering password

I have a basic question. At work, I log on to a domain from my work machine using a password. Then, once I am logged-in, I can read mails in outlook without having to enter any password. What I ...
1
vote
1answer
345 views

Default Kerberos realm

I was following the instructions to install Samba from their website, and it said I needed to install the package krb5-user. So I typed: sudo apt-get install krb5-user It started installing, and ...
1
vote
1answer
875 views

Can't chgrp in NFS4 mounts

I'm using Linux in a large multi-user network. Let A be some group which I'm am member of, but which is not my primary group. According to chmod(2) I should be able to chgrp a file to group A. Trying ...
1
vote
2answers
43 views

Kerberos Server and logs

I'm attempt to set up a Kerberos server, and am running into some sort of issue with the configuration message. Unfortunately, the daemon refuses to tell me what went wrong; it tells me to "see log ...
1
vote
1answer
451 views

Apache / Nginx - Reverse Proxy and Kerberos Constrained Delegation

I am after a solution to replace Microsoft TMG, and i am hoping there is an open source route of acomplishing. Currently using TMG we are reverse proxying Web resources say for example sharepoint, ...
1
vote
1answer
32 views

Is it possible to set an SPN with a path?

I'd like to know, if it is possible to set an SPN with non root url as something like that: setspn -U -A http/www.example.com/someApp/path/ someServiceUser So that different applications running in ...
1
vote
1answer
87 views

Why can I see two distinct /tmp dirs?

Problem I am seeing two different /tmp directories. In a plain GNOME terminal ls -lia /tmp gives the following: total 136 5797 drwxrwxrwt 36 root root 780 Oct 5 20:57 . 2 drwxr-xr-x 21 ...
1
vote
0answers
184 views

Thousands of Logon/Logoff requests in Windows Event Viewer from a different computer on the same domain

For the past month or so, a computer that is on the same domain as me has been spamming my computer with logon/logoff requests via kerberos. I get ~4,000 requests on my computer a day. This includes ...
1
vote
0answers
398 views

Kerberos events are not logged on Windows 7

I tried to configure Windows 7 machine with our web-server running on it to log Kerberos-related events (meaning Windows system Log). I followed these instructions: How to enable Kerberos event ...
1
vote
1answer
270 views

kinit gives me a Kerberos ticket, but no AFS token

I'm trying to setup access to my university's IT environment from my laptop running Ubuntu 12.04, by (mostly) following the IT-department's guides on AFS and Kerberos. I can get AFS working well ...
1
vote
1answer
436 views

Changing remote server date via Powershell

I need to change the date of a server to the next day then run a sql script and then change the server date back. I figured out how to change the server date via powershell Invoke-Command ...
1
vote
0answers
1k views

Macos X 10.6 not refreshing Kerberos TGT key

I observed that MacOS X 10.6, if machine is added to an Active Directory and set to authenticate over LDAP to the Active Directory server requests a Kerberos TGT as expected at each user login. ...
0
votes
1answer
153 views

Does plink support GSSAPI?

Does plink support GSSAPI? I know putty itself does and enabling GSSAPI works fine with putty, but for some reason it is not working with plink. I was under impression that plink would work the same. ...
0
votes
1answer
454 views

Error during configuring kerberos5 using macports

While trying to install libmemcached via MacPorts, I hit the following issue: libmemcached @0.40 +universal ---> Computing dependencies for libmemcached ---> Dependencies to be ...
0
votes
3answers
3k views

Windows Vista and 7 crossrealm authentication MIT Kerberos

I'm using Windows Server 2008 and Windows Vista and 7 for cross realm authentication using MIT Kerberos 1.6 but when i try to login with a user the KDC answers: (wireshark output) error_code: ...
0
votes
0answers
10 views

Keberos clock skrew, although the clocks are synchronized

We have an issue during a backup (run every night). This backup is managed by Veeam Backup&Replication : copy 7 virtual machines from one VMware ESXi host. This host is linked to a vCenter server. ...
0
votes
0answers
5 views

Where are Kerberos TGTs are saved in windows filesystem?

Title says it all. Where are kerberos ticket granting tickets are saved? Ty!
0
votes
0answers
26 views

Impersonating windows server using client from outside the domain

Let me describe a situation: I am sitting on a Mac in a remote office and I remotely administer few different small Active Directory domains. My boss ask me to collect some client machine ...
0
votes
0answers
15 views

Capture user input to “kinit” - Works on OS X, but not Linux via “script”

I have a script that was written on OS X and utilizes the "script" command. With the -k flag it will log keys sent to the program, but that option is not available in the linux version of "script". My ...
0
votes
0answers
41 views

How to install/enable ktpass.exe on Windows 7?

How can I install or enable the ktpass.exe utility on a Windows 7 workstation?
0
votes
1answer
35 views

For password protected Samba share on home network, ntlm vs ntlmv2 vs krb5 (kerberos)?

I have a home network with wifi that is password protected. On my home network, I have a file server with a password protected Samba share. The share itself is protected because my network has ...
0
votes
0answers
13 views

How to make kerberos5 client use a specified KDC first, then try DNS?

Our DNS for KDC is rotating globally and I cannot control that. Sometimes, there are kerberos related account issue, that the only solution on clients is to wait a few days for the data to sync ...
0
votes
0answers
132 views

Script to interactively join WPA2-Enterprise network without joining domain

I'm working in a Windows domain environment, using Active Directory, Radius, and a linux Squid proxy server. I'm trying to hook up a Windows 8 tablet to this system, but due to company policy I can't ...
0
votes
0answers
42 views

Prevent joining remote domain while using VPN

To be able to work remotely at my company, i have to open a VPN connection to take over my machine at the remote site. Everything works like a charm. The thing is that when i open up the VPN ...
0
votes
0answers
31 views

Seting up Linux client server authentication?

What services and applications are generally used when setting up client server authentication? I'm looking for any information that could help me in this. From my understanding, Samba and LDAP is ...
0
votes
1answer
126 views

sshfs with gssapi

For my normal login with ssh I have in my ~/.ssh/config the following lines: GSSAPIAuthentication yes GSSAPIDelegateCredentials yes ... so that if I call kinit and get a Kerberos ticket then I ...
0
votes
1answer
150 views

Kerberos? Still Confused

I come here asking a simple (yet confusing) question. I have extracted the folowing from cain & able: PRIVATE.ELMBROOKSCHOOLS.ORG\17grossa ...
0
votes
1answer
906 views

Time Machine over network using incorrect realm for kerberos authentication

Question: how can I influence the kerberos realm that Time Machine, or more specifically NetAuthSysAgent, uses? Time Machine backups over the network are failing on OS X 10.7 / 10.8 clients except ...
0
votes
2answers
587 views

Active directory Kerberos OSX problems

I'll try to keep this short, but informative. I'm currently unable to bind OSX lion (10.7.4) machines to our AD. OSX kerberos (heimdal) is unable to locate the KDC service. However i can bind ...
0
votes
0answers
163 views

Samba file shares - ownership of folder accessible for 1 group verified by MS active direcctory

I have a machine set up to share a folder /srv/sambashare, here's an exerpt of the config file: [share] path = /srv/sambashare writable = yes The permissions of that folder are set at 700 ...
0
votes
1answer
516 views

get kerberos ticket for autologin on linux

I tried to configure an automatically login for a user with kerberos. I tried using 'mingetty --autologin USERNAME', but gives me a session without a kerberos ticket (which i require to access some ...
0
votes
1answer
724 views

Mac OS X 10.6 Kerberos authentication for network shares

I'm on a kerberos network, and I want to add someone's network kerberos username to one of my shared folders on my mac. On windows, assuming you were on the same domain, you could just type in the ...
0
votes
1answer
1k views

Directly printing to remote CUPS/IPP server on Snow Leopard

I need to use Kerberos authentication when printing from my OSX machine, however, the machine itself does not have a service account in active directory, so the KDC will not issue a delegation ticket ...