24

kinit on Mac OS X now (since 10.9, possibly earlier) has built-in support for saving the password to the keychain via the --keychain argument, accomplishing the same thing as paul's answer. Authenticate using kinit --keychain; the password will be saved upon successful authentication: kinit --keychain # or kinit --keychain bob@MY.REAL.COM Subsequent kinit ...


9

If you are signing in with a windows domain user a Kerberos ticket is already requested. You can test it by executing klist. To reuse this ticket you have to add user and cruid option to your mount order. This way you do not have to enter any credentials again. sudo mount -t cifs -o user=$USER,cruid=$USER,sec=krb5 //domain/path /home/path To mount the ...


8

When given an account name (provided by SSH) and a principal name, the Kerberos library uses the krb5_kuserok() function to allow or deny access. By default, krb5_kuserok() allows access if the principal name is listed in ~/.k5userok. If that file doesn't exist, it checks whether the krb5_aname_to_localname() function returns the same account name. Now, by ...


7

With MacOS 10.11 (El Capitan) (maybe even 10.10 not sure about this) you run the following commands in your Terminal: $ defaults write com.google.Chrome AuthServerWhitelist "*.example.com" $ defaults write com.google.Chrome AuthNegotiateDelegateWhitelist "*.example.com" Then you restart (if it is running) Google Chrome and et voila it should accept the ...


6

Unfortunately the answer is that keytabs for Kerberos cannot be generated on Windows 7. It must be generated using the ktpass utility on a Windows Server OS. The Keytab must be generated on either a member server or a domain controller of the Active Directory domain using the ktpass.exe command. Use the Windows Server built-in utility ktpass.exe to ...


4

There is no explicit "use Kerberos" option in the settings for an account. If a server lists GSSAPI as one of its supported mechanisms, the logged-in user has valid Kerberos credentials in their cache, and the appropriate SASL GSSAPI libraries are installed on the client machine, then it will use Kerberos for authentication. The installation of the SASL ...


4

/var/log/auth.log. I would never have looked there. Here's how I found it: Noticed there was a sendto in the output of strace that started with a date/time, like a log might have. Isolated it: # strace krb5kdc -n 2>&1 | grep sendto sendto(3, "<35>Feb 13 17:43:41 krb5kdc[2400"..., 115, MSG_NOSIGNAL, NULL, 0) = 115 Search for the call to ...


4

In Linux you can use "kinit" to verify specified SPN. This tool creates a Kerberos AS-ticket and stores it in a cache. Because of security reasons, this cache is meant to be used by operating system components. To have kinit in Windows I install latest Java JDK (http://www.oracle.com/technetwork/java/javase/downloads/index.html). Syntax: kinit <SPN>. ...


4

It seems that kerberos-sec on port 88 is an authentication method connected to AFP (Apple Filing Protocol) or SMB (Samba) file sharing. If you wish to disable it, you can as per the instructions on this site. This should work for Mac OS X 10.6.8 and below: sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.kdcmond.plist For Mac OS X 10.7 (...


4

There's no such list, because for example you, as a software developer may create a new service, register it in ActiveDirectory under sPN: KULATAMICUDA/myservice@MY.DOMAIN, write your client, which looks for sPN KULATAMICUDA/myservice@MY.DOMAIN in ActiveDirectory in order to log into it. In case of prefix HTTP, all web browsers construct SPNs in such a way, ...


4

No, unfortunately not. It's not a limitation in FreeRADIUS as much as there's no EAP method which supports Kerberos natively. The only way to do kerberos login with RADIUS is to use an EAP method that provides the credentials in the clear, and then use those to decrypt the TGT on the RADIUS server. I've been lamenting this fact for the past 10 years, as ...


3

First, try -o vers=1. The kernel's SMB2 client has only very recently gained Kerberos support – in Ubuntu 14.04, only the 4.4.x kernel will have it. Second, check if the request-key and cifs.upcall binaries are installed and that the latter is mentioned in /etc/request-key.conf (or /etc/request-key.d/): create cifs.spnego * * /usr/bin/cifs.upcall %k ...


3

I had used the File Share feature earlier and turned it off, but somehow the port was still open. So I just went there again, checked and unchecked it and after running nmap it was closed! System Preferences > Sharing > File Share: set it to off


3

You shouldn't need to manually import or export anything, as Active Directory natively supports replication – you can add a new DC to the existing domain, and later shut down the old DC. Join the new server to the old domain. Do not "create" the domain on it. Install Active Directory Domain Services, and promote the new server to a domain controller. ...


2

I created a fresh WS 2008 R2 SP1 system from DVD, joined the domain, applied group policy, restarted and installed NPS and RRAS. A test from a remote host proves NPS and Kerberos.dll were working correctly at this point. I then installed KB2871997 on its own and the lsass crashed upon VPN connection, so it's pretty clear this is a bug in KB2871997. ...


2

Traditionally, Kerberos has used reverse-DNS to canonicalize the principal name. That is, after resolving targethost.example.com to an IP address, it tries to resolve the address back to the "canonical" name, and uses that for the principal. If your targethost was resolved via /etc/hosts, then the first name in the corresponding line will be used as the "...


2

Oh, it's been a long time. Let's see what I can remember. Yes, it can definitely be confusing because you can use Kerberos to authenticate for LDAP, and you can also have Kerberos use LDAP as a backend. Although they are not the same thing, it's often hard to differentiate which one is being talked about when you try to search for it. I can only talk ...


2

Years late, but for the Internet searchers: In CentOS 7 as of now (and probably for a while now, really), there is an option in sssd.conf: use_fully_qualified_names (bool) Use the full name and domain (as formatted by the domain's full_name_format) as the user's login name reported to NSS. I was struggling with the duplicated domain name in my ...


2

Logging out destroys your ticket . you need to somehow: Find it Copy it point your kerberos libs to it keep renewing it (optional). For 1 klist will help : first line says ticket cache: 2 depends on 1, if it is FILE:/tmp/krb5_XXXXXXX of DIR:/SOME/PATH all you have to do is copy it: cp /tmp/krb5_XXXXXXX /tmp/krb5_tmux_XXXXXXX) Make sure that only you ...


2

As per my understanding, hbase.headless.keytab = Will never expire, hbase.service.keytab = valid for certain time period, devuser.keytab = valid for only 24 hours. Let me know if you found better answer .


2

I think you're mixing up authentication and authorization. As you can see from the logs, the authentication phase succeeds (meaning that the credentials were successfully verified)... Jul 19 14:30:39 virtualBox gdm-password]: pam_sss(gdm-password:auth): authentication success; logname= uid=0 euid=0 tty=/dev/tty1 ruser= rhost= user=alice ...but the ...


2

For systemd --user units, that's where the time starts. The entire --user manager starts late in the boot process – it is a system service (user@.service) which is started by systemd-logind, which itself always starts during late boot. To order the service against earlier units (like remote-fs.target), you need to convert this to a system service. Then your ...


2

After experimenting I finally landed at solution that meets my needs however I must admit I have no idea why is this working the way it seems to be working. If I add following to my configuration I can pass information I need within Authorization header. RewriteEngine On RewriteCond %{LA-U:REMOTE_USER} (.+) RewriteRule .* - [E=RU:%1] RequestHeader add ...


2

One would use also klist. Your principal name is in the "Client:" field of every ticket. H:\> klist Current LogonId is 0:0x494539 Cached Tickets: (2) #0> Client: fred @ AD.EXAMPLE.COM Server: krbtgt/AD.EXAMPLE.COM @ AD.EXAMPLE.COM KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96 Ticket Flags 0x40e00000 -> ...


1

Turned out that the Service Principal had a maximum renewal life of 0 days. Maybe I created that before making the conf changes..! So this is the culprit krbtgt/HADOOP.PSM@HADOOP.PSM When I modified the service principal like below, it worked..! modprinc -maxlife 1days -maxrenewlife 7days +allow_renewable krbtgt/HADOOP.PSM@HADOOP.PSM


1

I think you're looking for the AllowGroups option in the sshd_config file: AllowGroups This keyword can be followed by a list of group name patterns, separated by spaces. If specified, login is allowed only for users whose primary group or supplementary group list matches one of the patterns. Only group names are valid; a numerical ...


1

These services are no longer packaged in Debian Jessie, nor maintained by MIT Kerberos developers, nor in any way recommended to be used. Heimdal has recently removed their versions as well. (The kerberized telnetd, for example, only supported DES.) (That said, you can still find the MIT services' source code at https://github.com/krb5/krb5-appl.) I ...


1

I had the exact same error message on Fedora 20, and found this (currently) open Redhat bug: RFE: allow systemctl enable work on symlinked units Just like you, I could service start rpcgssd, but not chkconfig rpcgssd on or systemctl enable rpcgssd. However, my rpcgssd.service file (in /usr/lib/systemd/system) was a symlink to /usr/lib/systemd/nfs-secure....


1

Kerberos tickets can be generated using ktpass aswell. On windows prompt (Assumed KDC is installed) ktpass -out <file>.keytab -mapuser <username>@REALM-IN-CAPS -pass <of-user> -crypto all -ptype KRB5_NT_PRINCIPAL -princ spn-of-user@REALM-IN-CAPS This will generate *.keytab in current working directory.


1

Your intuition is on track in both cases. Let's take both your questions one by one. Here, the kerberos service is the authentication system. The client will receive an encrypted ticket from the kerberos server (upon successful authentication of course), and will then present this to the server to show they are authenticated. Here, the ldap service is the ...


Only top voted, non community-wiki answers of a minimum length are eligible