Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [kerberos]

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.

As many vendors have their own implementation of Kerberos, configuration details for each implementation is likely to vary. Here are some links that may help those troubleshooting Kerberos on commonly used paltforms.

1136 questions
0
votes
1 answer

Linux daemon accounts and kerberos

there is something I can't grasp about security in Linux. I have a piece of software, it's running as a service on user X, it needs RW for directory Y owned by user Z and group C (both which is in LDAP) (this is running on a separate VM - and vm is…
ColdIce
  • 3
  • 2
0
votes
1 answer

Authenticate with Kerberos to a CIFS share provided by OpenSolaris

I have an OpenSolaris server (running snv_128a) which I have (a) joined to an Active Directory domain and (b) configured to export some filesystems via CIFS: # sharemgr show -vp default nfs=() zfs zfs/rpool/export/public nfs=() smb=() …
larsks
  • 41,276
  • 13
  • 117
  • 170
0
votes
1 answer

gssd: What is ?

rpc.gssd's man says: rpc.gssd searches in the following order for a principal to use. The first matching credential is used. For the search, and are replaced with the local system's hostname and Kerberos realm. …
intelfx
  • 151
  • 1
  • 1
  • 11
0
votes
0 answers

Mount CIFS/SMB file share with S4U2Proxy?

Is there any way to mount a CIFS/SMB file share by authenticating with S4U2Proxy? I need a middleware service to mount a file share and it has a Kerberos ticket from the user who logged into it. I've gotten as far as having a proxy ticket for the…
Chris
  • 101
  • 3
0
votes
1 answer

SSSD AD Integration - Clarification on Computer to join AD

Objective Clarify Computer, Not User, when integrating a Linux box with a Windows Domain. Background Having confusion because most SSSD AD information focuses on User Authentication, however apparently in a Windows Domain, the computer to which the…
mon
  • 225
  • 3
  • 9
0
votes
2 answers

What does it mean to "add" a principal to a keytab file in Kerberos?

In this documentatation they mention that you can use the ktadd command that "add a principal to an existing keytab". Does adding a principal mean that the principal now has access to that host (in which ktadd was run) or that the host (in which…
Jorge Silva
  • 123
  • 1
  • 7
0
votes
1 answer

NFS w/Kerberos - Network change broke auth?

So, I've recently changed my network setup a bit, and for reasons I'm still trying to suss out replacing the old router with a new PFSense box appears to have broken the authentication within the network somehow. The network setup uses a Kerberos…
Adam Luchjenbroers
  • 218
  • 1
  • 2
  • 10
0
votes
0 answers

Apache Single Sign On Working on 1 of 2 Portals

I use a helpdesk system in our intranet that I've configured for Single-Sign-On via LDAP/Active Directory. The helpdesk server itself lives on an Ubuntu 16.04 Server box running on Apache, Server version: Apache/2.4.18 (Ubuntu) Server built: …
Pietro Aretino
  • 1
0
votes
0 answers

Kerberos Double Hop Delegation from IIS to SQL server (using django)

I need to pass the credentials (Integrated Windows Authentication) from a django website on IIS onto a backend SQL server so that it runs under the proper user context. This is how my setup looks so far: Running SQL Server on sql_sever.domain.com…
notarobot
  • 41
  • 6
0
votes
1 answer

Is "/var/kerberos/krb5kdc/kadm5.acl" the only way to specify administrators in kerberos?

The documentation for RHEL explains how to make users administrators through the /var/kerberos/krb5kdc/kadm5.acl file, but does not specify if this is the only way to do this. Are there any other ways to specify principals with administrative…
Jorge Silva
  • 123
  • 1
  • 7
0
votes
0 answers

Samba ADS: Cannot contact any KDC for requested realm

I followed this Setting up Samba as an Active Directory Domain Controller - wiki and all seems fine (kinit,klist,net ads user,net ads group work). Adding users without password also works, but if I set any password, it fails: net ads user add tester…
lepe
  • 468
  • 1
  • 6
  • 23
0
votes
2 answers

ktpass command "WARNING: The Key version used by Windows (277) is too big.."

I'm trying to create the keytab for a service account, it worked just fine few days ago, when I came back and run it I've gotten an warning message and I want to know what is the cause and how to solve it: ktpass -princ http/contoso1.com@abc.com…
Ender
  • 604
  • 3
  • 9
  • 13
0
votes
0 answers

Apache Kerberos SSO without login prompt

I've successfull implemented SSO with Kerberos an a apache webserver. Whenever a user opens the webpage, he is prompted to enter his credentials (username@REALM & password). Is there a possibility to log him in directly, without the login…
Jonas Hüsser
  • 1
  • 2
0
votes
1 answer

Linux password via kerberos unable to reset

When I try to reset a ldap user password from client machine I am getting the following error $ passwd Changing password for user demo. Current Password: New password: Retype new password: passwd: Authentication token manipulation error From…
Dino Daniel
  • 1
0
votes
1 answer

Using same password for kerberos and openldap

We have a working structure for our hadop where openldap was used for authentication with below structure,along with ranger and knox. openldap root:- dn: dc=abchadoop,dc=com,dc=za Subtree inside openldap like below:- dn:…
anwaar_hell
  • 101
  • 2
1 2 3
…
75 76