Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [kerberos]

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.

As many vendors have their own implementation of Kerberos, configuration details for each implementation is likely to vary. Here are some links that may help those troubleshooting Kerberos on commonly used paltforms.

1136 questions
0
votes
1 answer

Linux ksu (kerberized super user) command fails to use cached service (host) tickets

Questions at the end About my environment I have tried in two different environments: (i) Linux Ubuntu 16.04LTS server enrolled in Active Directory (Microsoft) Domain and (ii) Linux Ubuntu 16.04LTS server enrolled in a FreeIPA Realm. Krb5 binary…
Fabiano Tarlao
  • 161
  • 8
0
votes
0 answers

Kerberos authentication on Windows Server 2003 through router/firewall

Given is the following network setup: ┌192.168.1.10 Windows Server (WAN) │ └192.168.1.100 Router (WAN) 192.168.0.1 Router (LAN) │ └192.168.0.x Windows Client (LAN) WAN area: 192.168.1.x. LAN area: 192.168.0.x. Those…
user3297416
  • 443
  • 4
  • 5
0
votes
1 answer

Can I create keytab for authentication of user in unix server

I have a service which needs to authenticate against another service using Kerberos. Normal credentials expire rather quickly - can I create a keytab or something for the service to get the ticket without password? I don't have admin for Kerberos…
Maciej Piechotka
  • 667
  • 1
  • 6
  • 14
0
votes
1 answer

extracting service principal from AD to keytab

Working with Samba 4 as a Windows “domain member”, I’d like to automate deployment of keytabs. Specifically, I’d like the equivalent of adding service principals to the appropriate tables. E. g. # kadmin -k /etc/squid/proxy.keytab -w secret -p…
phg
  • 81
  • 1
  • 9
0
votes
0 answers

Old DC (Server 2008) Logging Event 4776

On one of our old DC's we are seeing event 4776 logged twice about every 10 min. This server was demoted a year or so ago, so I don't even know why Kerberos requests are going to it. I've gone through the DNS for the domain and all Kerberos entries…
MSCF
  • 135
  • 1
  • 3
  • 11
0
votes
1 answer

How to mount a Kerberized NFS filesystem in CoreOS?

I'm trying to define a systemd mount using cloud-config.yml so that CoreOS mounts a kerberized file system at startup. The filesystem provider has handed me the krb5.conf and krb5.keytab which I write to /etc folder using write_files section of…
Daniel Cerecedo
  • 171
  • 1
  • 5
0
votes
1 answer

How does ssh login work with KDC client and server?

I would like to get some help to clear my thoughts for kerberos authentiction. I am confused with kerberos authentication flow. I have three node in my system. (PS) Physical server (neither krb5-workstation nor krb5-lib are installed) (KC) KDC…
Yu Watanabe
  • 606
  • 2
  • 8
  • 18
0
votes
0 answers

Service returning Kerberos error but only when using FQDN

I have an issue that was brought to me by another in our office. He is troubleshooting a service our software uses with customers environments that try's to make a connection to SQLServer2 by use of a service on a specified port. It first calls to…
Eddie Studer
  • 391
  • 1
  • 3
  • 11
0
votes
1 answer

Custom 401 error page served by Apache for firefox by not IE or Chrome Kerberos Authorization

I have a Intranet site that is using Kerberos Authentication. I am having issues when the user is not allowed access In Firefox the ErrorDocument 401 set in .htaccess works but in IE/EDGE/CHROME you get a browser error (See Below) Chrome: This…
Matt_J
  • 1
0
votes
1 answer

What is the purpose of the 'keyblock' part of the Kerberos credential cache

The documentation of MIT Kerberos explains here how the credential cache file is formatted. It basically consists of: a header information about the REALM and the user a keyblock information about the expiration of the ticket authdata the tickets…
arne.z
  • 357
  • 6
  • 24
0
votes
1 answer

CentOS 6 AD Authentication with SSSD: Why obtain host based ticket after domain join

Following two documents from Red Hat explains the process of adding servers to AD domain. RHEL versions are different but steps are applicable to both. Page 17 of:…
BBDG
  • 147
  • 1
  • 2
  • 7
0
votes
1 answer

Can an MIT Kerberos be configured to trust AD while still having its own realm and resources?

Can Kerberos be setup in a *nix environment such that authentication happens against an LDAP store other than AD but still trust the AD domain? Use case is that we have AD in use, there's no Kerberos for *nix, we don't want to register *nix hosts…
PerennialN00b
  • 63
  • 1
  • 6
0
votes
1 answer

Active Directory Kerberos over VPN

I'm setting up an AD domain to authenticate my endpoints and users. The thing is my company frowns upon physical servers, so I've set up the domain on AWS. I am connecting to it via a VPN tunnel. Authentication, password sync etc works just fine,…
adam_of_mac
  • 1
  • 2
0
votes
1 answer

How to use klist to show kerberos principal instance URL?

When I type klist, it only shows the primary username and realm: > klist -a Ticket cache: FILE:... Default principal: primary@REALM.NAME.COM Valid starting Expires Service principal 04/30/2017 21:03:00 05/01/2017 07:03:00 …
tribbloid
  • 101
  • 1
  • 2
0
votes
1 answer

Elegant way to find and list inactive kerberos users

following setup: I am running a kerberos (MIT) and ldap (OpenLDAP) server for single sign on etc. Everything works fine but i have a question regarding inactive users. I need to find kerberos principals, where the last successful login is beyond a…
Arefdimi
1 2 3
…
75 76