Questions tagged [kerberos]
Kerberos is a computer network authentication protocol which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner.
165
questions
1
vote
0
answers
30
views
Custom RPC Kerberos authentication working on Samba but dont Windows
I have implemented an RPC client in C# which uses GSS/SPNEGO authentication. I am trying to connect to the standard/Active Directory services (DRSAPI, SAMR etc...) on the server. The authentication ...
- 11
0
votes
1
answer
11
views
How to config trust between two realms in one KDC?
I'm using one KDC to manage two realms in two different databases (like krb5kdc -p 2001 -r REALM1 -p 2002 -r REALM2), how can I config them to trust each other? I know the steps when it's in two ...
0
votes
0
answers
50
views
Monitoring Windows machines from Linux with winrm / CIM / WMI using active directory accounts
It's all in the title :)
I have to monitor windows clients/servers.
Currently I use relay windows servers to monitor the remote clients with powershell scripts.
I wish to change that and to use linux ...
- 1
0
votes
0
answers
72
views
How mount multiple cifs shares with diferents kerberos tickets
I want to mount two resources on linux using kerberos authentication. The user who performs the mounts in both cases is root. But I want to mount resource1 using a kerberos ticket from user1 and ...
- 1
-1
votes
1
answer
34
views
Passing windows AD machine authorization to linux VM?
after trying for multiple hours to get this (not even necessary, but I somehow got lost in "the zone" and was committed) working without a single clue about the whole AD infrastructure, I'm ...
- 3
0
votes
1
answer
111
views
How to configure that the user principal added to Kerberos cannot access a specific host principal of realms
I installed Kerberos on CentOS 7 via yum command.
yum install krb5-server krb5-libs krb5-workstation pam_krb5 -y
My situation is as below:
There is 1 KDC.
It has 2 Service Servers.
The KDC's krb5....
- 1
0
votes
0
answers
136
views
How do I disable Edge/Chrome from using Kerberos on a Mac?
Is there a flag in Edge/Chrome where I can tell it to ignore Kerberos tickets?
- 4,908
0
votes
1
answer
535
views
krb5 kinit error after upgrade to ubuntu 20
I have an Ubuntu 18.04 computer where I connected (as client) to an AFS filesystem via openafs and kinit (krb5), hosted by my company (based on MIT Kerberos). This works well, here the log:
KRB5_TRACE=...
- 128
2
votes
0
answers
740
views
How to mount Windows share using Kerberos with custom keytab automatically?
I have to mount a Samba share using Kerberos on a SLES 12 system automatically from boot on. The problem is, that the Kerberos ticket does not get automatically requested when trying to mount the ...
- 21
0
votes
0
answers
51
views
Security Events generated for Linux clients don't contain Usernames
This is my third question regarding the ongoing problem I'm facing with "Linux to AD SSO". I've been trying to understand what the problem was and still not sure I know exactly the cause.
...
- 103
0
votes
1
answer
146
views
How domain joined Linux clients send Security Events to the AD (KDC)
Have been trying to solve an issue for two weeks with no success. So I will break it into smaller questions in hope to understand the process and find a solution.
We have a Windows AD domain with some ...
- 103
0
votes
1
answer
149
views
Linux mount to FSx using AD user disconnects after interval; initial mount works but message HOST IS DOWN occurs after some time
When I run the mount command I’m able to connect/ls to the share until, what appears to be the ticket renewal, timing occurs. Then I get host is down.
I have looked through all the suggested similar ...
0
votes
0
answers
85
views
Secondary Kerberos KDC not starting
I have configured Kerberos using a LDAP backend with this guide: https://ubuntu.com/server/docs/service-kerberos-with-openldap-backend
However, my secondary KDC is not starting; journalctl reports:
...
- 1
0
votes
2
answers
410
views
Why does Pass-the-ticket work?
So, I've been informing myself about how Kerberos works and what attacks can be launched/defended against. One vulnerability I have read about is the "Pass-the-ticket" attack, when for ...
- 21
0
votes
0
answers
1k
views
PowerShell remoting using Kerberos
I need to ditch basic authentication and start using another way to execute my powershell scripts.
The problem is I cannot make it work. I am noob at this, so I don't have clear idea where to go next.
...
-1
votes
1
answer
1k
views
How to get Postfix and Dovecot working with an existing Kerberos realm?
I now have a Kerberos realm like MYDOMAIN.CH, an admin server and a principal of root/admin, as well as the realm master password and the root/admin principal password. Now I want to get Kerberos ...
1
vote
2
answers
3k
views
Firefox and Chromium don't do Kerberos negotiation, cURL does?
I can successfully run kinit to get following klist output:
Ticket cache: FILE:/tmp/krb5cc_1001
Default principal: [email protected]
Valid starting Expires Service principal
01.03....
- 138
0
votes
1
answer
871
views
fully passwordless nfs through kerberos
I have a small network that includes a NAS. on which I provisioned, with some effort, a Kerberos server. The Kerberos server allows Linux hosts on the network to create secure NFS mounts. Service keys ...
- 215
0
votes
1
answer
67
views
Is there a .k5login equivalent on Windows?
Having obtained a Kerberos ticket, I can switch identities on Linux and BSD machines with su (or ksu), because the target account lists my main principal in its ~/.k5login.
Can the same authorization ...
- 634
1
vote
0
answers
4k
views
How to configure PuTTY to use Windows Kerberos ticket?
Our network uses Active Directory (duh) and all end-user accounts are in AD (not local). I'm trying to configure PuTTY to use the ticket I obtain automatically, when logging into my Windows ...
- 634
0
votes
1
answer
71
views
How can the Apache KARAF built-in Krb5LoginModule (JAAS) be application-specific?
I have an environment containing an Active Directory, a Windows client and an Apache KARAF with the built-in SSH server and a realm using the Krb5LoginModule (JAAS).
What I'm trying to do is to ...
- 1
1
vote
1
answer
1k
views
Curl with GSS-API on Alpine Docker
I am trying to get curl installed in a Dockerfile with the GSS-API, SPNEGO, or GSS-Negotiate features installed so I can use the --negotiate flag. How can I configure curl to be installed with that ...
- 1,896
0
votes
1
answer
859
views
How do you uninstall kerberos from Bash? or Change server name?
I setup the wrong server name and admin name. I sthere a way to change it? instead of uninstalling it? Thanks
Jeremy Alvin
1
vote
1
answer
549
views
Kerberos for machines with multiple domain names
I have several *nix routers that have multiple IP addresses. They are running WireGuard and BGP to announce two address ranges under two different ASNs. For example: a machine called pis1.us.nodes.<...
- 25
3
votes
1
answer
4k
views
mount.cifs: Any way to mount with kerberos using the machine credentials
When a Linux machine joins a domain, a computer account is created in Active Directory.
Can this account be used to mount a network share with cifs and Kerberos?
- 401
1
vote
1
answer
359
views
sssd only authenticates against first domain in domains list unless domain specified in login
I am currently moving from using pam_krb5 to pam_sss as pam_krb5 is no longer available at CentOS/RHEL 8
We currently use two AD domains each with unique user names. In the old pam configuration we ...
1
vote
0
answers
155
views
How to use HiPAM authorization with OpenSSH?
My client is implementing HiPAM (or Hitachi ID) for production systems.
One requests temporary access to machines in a certain group, and can, upon approval, access them either via an ssh-client ...
- 634
0
votes
0
answers
41
views
execute program as computer account
Given a joined Windows 8 or 10 system, how does one run some script with the
credentials of the computer account? Without installing any third
party tools, just a vanilla Windows install.
The purpose ...
- 195
1
vote
1
answer
297
views
Kerberos gets tickets for wrong user
At work, I have two active directory/domain accounts:
username - I log in to my computer with this
adm_username - this user is administrator for some servers that I am responsible for
We have a ...
- 706
0
votes
0
answers
2k
views
AD: No TGT after logon
I’m investigating a domain where logon does not seem to produce a TGT.
After logon with a test account, klist tgt outputs this:
Current LogonId is 0:0x71647be1
Error calling API ...
- 195
0
votes
0
answers
196
views
Join a Linux (ubuntu 18.04) Instance to AWS Directory Service (Directory type: Microsoft AD)
I followed the document https://docs.aws.amazon.com/directoryservice/latest/admin-guide/join_linux_instance.html
Everything was working fine, but suddenly started to fails.
I decided clean all and ...
- 101
1
vote
1
answer
1k
views
How to figure out my Kerberos principal on Windows?
On a Unix system with Kerberos configured, I'd use klist...
How does one query his Kerberos principal(s) on Windows?
(Using the Active Directory, not MIT implementation.)
- 634
0
votes
1
answer
125
views
How to prevent BYO devices connecting to AD domain
My client has a computer lab several with Windows 10 PCs connected via ethernet to the company's active directory domain. each individual at the company has their own credentials with which to login.
...
- 2,651
1
vote
0
answers
1k
views
notepad.exe connects to tcp/389
I have recently began noticing several computers in my corporate network exhibiting some unexpected behavior when opening .txt and .rtf documents from a UNC path hosted on my DC using notepad.exe.
In ...
- 11
0
votes
1
answer
2k
views
Get kerberos ticket as file
I am trying to get a kerberos ticket as a file. The kerberos server is FreeIPA.
When I login using kinit USERNAME on the computer, It logs in just fine. When I view the ticket using klist, it shows ...
- 722
0
votes
1
answer
1k
views
Why samba don't ask user and password when user and password are same on both side?
I create a samba share like this
[test]
path = /data/test
valid users = test
read only = no
writable=yes
browsable=yes
then add user test and password test, if the computer use the same user and ...
- 103
2
votes
0
answers
392
views
Opera web browser kerberos authentication with delegation support
I'm using a LAN web site which relies on impersonation to be able to connect to a SQL Server machine (located on another machine in the domain). I'm not able to get it to authenticate properly using ...
- 123
2
votes
1
answer
24k
views
Couldn't join realm: Insufficient permissions to join the domain
I'm getting the following error when I try to join the linux machine to AD:
$ realm join proxmox.local --computer-ou="CN=TEST,CN=Computers,DC=proxmox" --verbose
* Resolving: _ldap._tcp.proxmox.local
...
- 121
0
votes
1
answer
173
views
Active directory authentication and LDAP
i am studying Active Directory directory services (AD) and all connected things (LDAP, kerberos, ...). I don't fully understand, how LDAP objects and AD interact between each other. So can you comment ...
1
vote
0
answers
168
views
Client or server has a null key while getting initial credentials when trying to authenticate to ApacheDS Kerberos
I am running an instance of ApacheDS, and use it for Kerberos authentication. According to the documentation, the server should automatically generate krb5Key attributes on each LDAP entry for a user ...
- 321
2
votes
1
answer
511
views
Linux Active Directory login failed because of password
I have a Linux machine that has a connection to the AD. kinit command works correct (it has no output when I run it). But when I try to login to this Linux, I get "Access denied" error.
Dec 20 16:33:...
- 795
1
vote
0
answers
54
views
What happens if you enter the incorrect password too often for ktpass command
I need help with the Kerberos ktpass functionality in regards to incorrectly entering the password multiple times:
What happens if we automate the ktpass command to run in a Linux bash shell "for" ...
0
votes
1
answer
913
views
Unable to authenticate with AD after IP change
I have a linux environment with a single AD server. It looks like the previous sys admin setup ldap with kerberos and sssd. Recently we went through an IP change, changing the IP on the AD and all the ...
- 1
1
vote
1
answer
1k
views
SSH user not getting authenticated through kerberos
I have setup kerberos in my ubuntu machine and I am able to get tickets for users via kinit from my other Fedora Linux client machine.
But getting below error in sshd debug logs, no idea what it means:...
- 121
0
votes
1
answer
2k
views
Ansible using Kerberos fails on Windows host if Basic authentication is not enabled
I'm trying to configure a Windows Server 2019 host with Ansible, using Kerberos as the transport protocol for WinRM. I had initially run the ConfigureRemotingForAnsible.ps1 script on this host while ...
- 1
0
votes
1
answer
614
views
InitializeSecurityContext failed with SEC_E_DOWNGRADE_DETECTED
I have a question. There's a client and server apps. Client connects to server using kerberos authentication, the client need to retrieve a token from the server - it invokes InitializeSecurityContext ...
- 103
1
vote
1
answer
59
views
Kerberos v5: SPN as a client in AS_REQ
Is it possible to use service principal name, e.g. HTTP/[email protected] (not user principal name) as a client in AS_REQ to MS Active Directory to get TGT?
What principal type should be in ...
- 11
1
vote
1
answer
3k
views
Apache reverse proxy not passing custom headers to the target server
I have configured Apache as reverse proxy to my PostGraphile service. My idea is to use Apache to do kerberos authentication and then make PostGraphile service available to authenticated users.
I ...
- 228
1
vote
1
answer
559
views
How to enable trust between two KDC's with same kerberos realm and same domain names?
I have two linux clusters in different DC's with same domain name and same realm but the KDC's are different. How can i enable trust between these two KDC's ??
- 11
1
vote
0
answers
30
views
SAMB permissions cant add groups though windows
I'm pretty new to Samba and I've been having troubles allowing domain users to access shares. I've linked my samba server (centos 7) as a domain member to my AD.command # realm list shows the proper ...
- 111