Questions tagged [kerberos]

Kerberos is a computer network authentication protocol which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner.

Filter by
Sorted by
Tagged with
0 votes
0 answers
36 views

PowerShell remoting using Kerberos

I need to ditch basic authentication and start using another way to execute my powershell scripts. The problem is I cannot make it work. I am noob at this, so I don't have clear idea where to go next. ...
user avatar
-1 votes
1 answer
119 views

How to get Postfix and Dovecot working with an existing Kerberos realm?

I now have a Kerberos realm like MYDOMAIN.CH, an admin server and a principal of root/admin, as well as the realm master password and the root/admin principal password. Now I want to get Kerberos ...
user avatar
1 vote
1 answer
350 views

Firefox and Chromium don't do Kerberos negotiation, cURL does?

I can successfully run kinit to get following klist output: Ticket cache: FILE:/tmp/krb5cc_1001 Default principal: ramus@KERIM.IO Valid starting Expires Service principal 01.03....
user avatar
0 votes
0 answers
12 views

Kerberos stopped logging

Yesterday my krb5kdc.log and kadmind.log stopped logging. Kerberos is still running though. I noticed the krb5kdc.log is now sitting at a huge 3.5GB and I'd like to clean it but since this is a ...
user avatar
0 votes
1 answer
200 views

fully passwordless nfs through kerberos

I have a small network that includes a NAS. on which I provisioned, with some effort, a Kerberos server. The Kerberos server allows Linux hosts on the network to create secure NFS mounts. Service keys ...
user avatar
  • 192
0 votes
0 answers
48 views

WinRM File copier plugin : only appends, never overwrites?

I am unable to change the behavior of the WinRM File Copier in Rundeck, it is a Python based plugin, launched from a Linux Rundeck server that is connected to an Active Directory server. When it ...
user avatar
0 votes
1 answer
29 views

Is there a .k5login equivalent on Windows?

Having obtained a Kerberos ticket, I can switch identities on Linux and BSD machines with su (or ksu), because the target account lists my main principal in its ~/.k5login. Can the same authorization ...
user avatar
1 vote
0 answers
675 views

How to configure PuTTY to use Windows Kerberos ticket?

Our network uses Active Directory (duh) and all end-user accounts are in AD (not local). I'm trying to configure PuTTY to use the ticket I obtain automatically, when logging into my Windows ...
user avatar
0 votes
1 answer
30 views

How can the Apache KARAF built-in Krb5LoginModule (JAAS) be application-specific?

I have an environment containing an Active Directory, a Windows client and an Apache KARAF with the built-in SSH server and a realm using the Krb5LoginModule (JAAS). What I'm trying to do is to ...
user avatar
0 votes
0 answers
127 views

How does Kubernetes work with traditional Kerberos setups?

I'd like to give our users the possibility to use Kubernetes on our cluster. However, all of our data resides on a CephFS mount and the users' home folders are mounted via NFS. How do people solve ...
user avatar
  • 163
0 votes
1 answer
317 views

Curl with GSS-API on Alpine Docker

I am trying to get curl installed in a Dockerfile with the GSS-API, SPNEGO, or GSS-Negotiate features installed so I can use the --negotiate flag. How can I configure curl to be installed with that ...
user avatar
  • 1,666
0 votes
1 answer
257 views

How do you uninstall kerberos from Bash? or Change server name?

I setup the wrong server name and admin name. I sthere a way to change it? instead of uninstalling it? Thanks
user avatar
1 vote
1 answer
176 views

Kerberos for machines with multiple domain names

I have several *nix routers that have multiple IP addresses. They are running WireGuard and BGP to announce two address ranges under two different ASNs. For example: a machine called pis1.us.nodes.<...
user avatar
3 votes
1 answer
1k views

mount.cifs: Any way to mount with kerberos using the machine credentials

When a Linux machine joins a domain, a computer account is created in Active Directory. Can this account be used to mount a network share with cifs and Kerberos?
user avatar
  • 351
1 vote
1 answer
140 views

sssd only authenticates against first domain in domains list unless domain specified in login

I am currently moving from using pam_krb5 to pam_sss as pam_krb5 is no longer available at CentOS/RHEL 8 We currently use two AD domains each with unique user names. In the old pam configuration we ...
user avatar
1 vote
0 answers
58 views

How to use HiPAM authorization with OpenSSH?

My client is implementing HiPAM (or Hitachi ID) for production systems. One requests temporary access to machines in a certain group, and can, upon approval, access them either via an ssh-client ...
user avatar
0 votes
0 answers
31 views

execute program as computer account

Given a joined Windows 8 or 10 system, how does one run some script with the credentials of the computer account? Without installing any third party tools, just a vanilla Windows install. The purpose ...
user avatar
  • 195
1 vote
1 answer
69 views

Kerberos gets tickets for wrong user

At work, I have two active directory/domain accounts: username - I log in to my computer with this adm_username - this user is administrator for some servers that I am responsible for We have a ...
user avatar
  • 686
0 votes
0 answers
786 views

AD: No TGT after logon

I’m investigating a domain where logon does not seem to produce a TGT. After logon with a test account, klist tgt outputs this: Current LogonId is 0:0x71647be1 Error calling API ...
user avatar
  • 195
0 votes
0 answers
47 views

Join a Linux (ubuntu 18.04) Instance to AWS Directory Service (Directory type: Microsoft AD)

I followed the document https://docs.aws.amazon.com/directoryservice/latest/admin-guide/join_linux_instance.html Everything was working fine, but suddenly started to fails. I decided clean all and ...
user avatar
  • 101
1 vote
1 answer
559 views

How to figure out my Kerberos principal on Windows?

On a Unix system with Kerberos configured, I'd use klist... How does one query his Kerberos principal(s) on Windows? (Using the Active Directory, not MIT implementation.)
user avatar
0 votes
1 answer
91 views

How to prevent BYO devices connecting to AD domain

My client has a computer lab several with Windows 10 PCs connected via ethernet to the company's active directory domain. each individual at the company has their own credentials with which to login. ...
user avatar
  • 2,511
1 vote
0 answers
587 views

notepad.exe connects to tcp/389

I have recently began noticing several computers in my corporate network exhibiting some unexpected behavior when opening .txt and .rtf documents from a UNC path hosted on my DC using notepad.exe. In ...
user avatar
  • 11
0 votes
1 answer
733 views

Get kerberos ticket as file

I am trying to get a kerberos ticket as a file. The kerberos server is FreeIPA. When I login using kinit USERNAME on the computer, It logs in just fine. When I view the ticket using klist, it shows ...
user avatar
  • 630
0 votes
1 answer
651 views

Why samba don't ask user and password when user and password are same on both side?

I create a samba share like this [test] path = /data/test valid users = test read only = no writable=yes browsable=yes then add user test and password test, if the computer use the same user and ...
user avatar
  • 103
2 votes
0 answers
275 views

Opera web browser kerberos authentication with delegation support

I'm using a LAN web site which relies on impersonation to be able to connect to a SQL Server machine (located on another machine in the domain). I'm not able to get it to authenticate properly using ...
user avatar
  • 123
1 vote
1 answer
14k views

Couldn't join realm: Insufficient permissions to join the domain

I'm getting the following error when I try to join the linux machine to AD: $ realm join proxmox.local --computer-ou="CN=TEST,CN=Computers,DC=proxmox" --verbose * Resolving: _ldap._tcp.proxmox.local ...
user avatar
  • 111
0 votes
1 answer
90 views

Active directory authentication and LDAP

i am studying Active Directory directory services (AD) and all connected things (LDAP, kerberos, ...). I don't fully understand, how LDAP objects and AD interact between each other. So can you comment ...
user avatar
1 vote
0 answers
83 views

Client or server has a null key while getting initial credentials when trying to authenticate to ApacheDS Kerberos

I am running an instance of ApacheDS, and use it for Kerberos authentication. According to the documentation, the server should automatically generate krb5Key attributes on each LDAP entry for a user ...
user avatar
2 votes
1 answer
136 views

Linux Active Directory login failed because of password

I have a Linux machine that has a connection to the AD. kinit command works correct (it has no output when I run it). But when I try to login to this Linux, I get "Access denied" error. Dec 20 16:33:...
user avatar
1 vote
0 answers
45 views

What happens if you enter the incorrect password too often for ktpass command

I need help with the Kerberos ktpass functionality in regards to incorrectly entering the password multiple times: What happens if we automate the ktpass command to run in a Linux bash shell "for" ...
user avatar
0 votes
1 answer
574 views

Unable to authenticate with AD after IP change

I have a linux environment with a single AD server. It looks like the previous sys admin setup ldap with kerberos and sssd. Recently we went through an IP change, changing the IP on the AD and all the ...
user avatar
1 vote
1 answer
885 views

SSH user not getting authenticated through kerberos

I have setup kerberos in my ubuntu machine and I am able to get tickets for users via kinit from my other Fedora Linux client machine. But getting below error in sshd debug logs, no idea what it means:...
user avatar
  • 121
0 votes
1 answer
1k views

Ansible using Kerberos fails on Windows host if Basic authentication is not enabled

I'm trying to configure a Windows Server 2019 host with Ansible, using Kerberos as the transport protocol for WinRM. I had initially run the ConfigureRemotingForAnsible.ps1 script on this host while ...
user avatar
0 votes
1 answer
218 views

InitializeSecurityContext failed with SEC_E_DOWNGRADE_DETECTED

I have a question. There's a client and server apps. Client connects to server using kerberos authentication, the client need to retrieve a token from the server - it invokes InitializeSecurityContext ...
user avatar
  • 103
1 vote
1 answer
40 views

Kerberos v5: SPN as a client in AS_REQ

Is it possible to use service principal name, e.g. HTTP/something.com@REALM.COM (not user principal name) as a client in AS_REQ to MS Active Directory to get TGT? What principal type should be in ...
user avatar
1 vote
1 answer
2k views

Apache reverse proxy not passing custom headers to the target server

I have configured Apache as reverse proxy to my PostGraphile service. My idea is to use Apache to do kerberos authentication and then make PostGraphile service available to authenticated users. I ...
user avatar
  • 208
1 vote
1 answer
341 views

How to enable trust between two KDC's with same kerberos realm and same domain names?

I have two linux clusters in different DC's with same domain name and same realm but the KDC's are different. How can i enable trust between these two KDC's ??
user avatar
1 vote
0 answers
19 views

SAMB permissions cant add groups though windows

I'm pretty new to Samba and I've been having troubles allowing domain users to access shares. I've linked my samba server (centos 7) as a domain member to my AD.command # realm list shows the proper ...
user avatar
1 vote
0 answers
489 views

zeppelin Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)

When I use zeppelin0.8.1 to connect hive with kerberos, it doesn't work, the following problem occurs. ERROR [2019-07-25 03:46:19,513] ({pool-2-thread-2} JDBCInterpreter.java[open]:197) - zeppelin ...
user avatar
-2 votes
1 answer
163 views

kerberos error while creating database

kerberos error while creating database Loading random data Initializing database '/var/lib/krb5kadc/principal' for realm 'HADOOP.COM', master key name 'K/M@HADOOP.COM' You will be prompted for the ...
user avatar
1 vote
1 answer
423 views

how should I remove krb5libs in kerberos?

I am not able to remove krb5libs I have the following error while removing krb5lib. yum remove krb5-libs Error: Trying to remove "systemd", which is protected Error: Trying to remove "yum", which ...
user avatar
1 vote
0 answers
66 views

VMWare vm jumps to different times when it is idle for a while and causes Kerberos authentication to fail

I have an issue and trying to get to the root cause of it. Setup: I have a cluster of virtual machines, one of them being a Kerberos KDC and another one being a Java-based webserver that ...
user avatar
  • 11
0 votes
0 answers
761 views

Cannot contact any KDC for realm 'MYDOMAIN.COM' while getting initial credentials

I'm using AzureDevOps and have project with DockerCompose file. While building it locally within working network it looks good. But when I run build (Docker Compose task with Build services action) in ...
user avatar
1 vote
2 answers
3k views

Cannot authenticate with Kerberos with PuTTY, but can with WinSCP

I've been using PuTTY with Kerberos authentication to connect to a server for work, but accidentally overwrote my settings with a blank template (not sure why the Save and Load buttons are right next ...
user avatar
  • 11
0 votes
1 answer
961 views

Windows 10 extremly slow when logged into Kerberos account

Since Windows 10 we have a problem with Windows-based clients in our FreeIPA linux domain. We use ksetup to allow authentication over Kerberos so that, after setting up local accounts, users can use ...
user avatar
  • 101
1 vote
1 answer
6k views

Kafkatool.exe failed create new KafkaAdminClient SASL_PLAINTEXT

I have created a kerberized Kafka cluster. It is working fine and I can produce and consume messages. Now I want to use the kafkatool2 software, and I am running the program through cmd by this ...
user avatar
3 votes
1 answer
11k views

pam_sss(sshd:account): Access denied for user AD

sssd.conf: [sssd] domains = corp.com config_file_version = 2 services = nss, pam [domain/corp.com] ad_domain = corp.lecapam.com krb5_realm = CORP.COM realmd_tags = manages-system joined-with-samba ...
user avatar
2 votes
3 answers
871 views

Unable to set up Outlook with local IMAP (dovecot) host on Mac

I am trying to configure Outlook 365 (version 16.22.1) on Mac High Sierra (10.13.6). The Mac is a domain member on a Windows Active Directory domain. Our office has a self-hosted IMAP mail server ...
user avatar
0 votes
2 answers
7k views

How to install Kerberos client on Windows

I had installed KDC server on RHEL and also installed the Kerberos client on Ubuntu. Able to perform the ssh login from client to server through Kerberos.(without password). Now, I want to use same ...
user avatar
  • 11