Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [kerberos]

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.

As many vendors have their own implementation of Kerberos, configuration details for each implementation is likely to vary. Here are some links that may help those troubleshooting Kerberos on commonly used paltforms.

1136 questions
6
votes
4 answers

0x19 KDC_ERR_PREAUTH_REQUIRED in my event log

So I have a server, and every time a user or service account logs on to the machine, an error event is generated in the System log: A Kerberos Error Message was received: on logon session DOMAIN\serviceaccount Client Time: Server Time:…
Ryan Ries
  • 55,011
  • 9
  • 138
  • 197
6
votes
1 answer

Time taken for authentication to work again after changing system time

One of our domain controllers clock drifted way out of sync with the rest of the network (thanks to me forgetting to turn off VMWare's time synchronisation), which caused a whole bunch of servers to lose their ability to authenticate, given that…
Mark Henderson
  • 68,316
  • 31
  • 175
  • 255
6
votes
2 answers

help using setspn and ktpass

I'm trying to set up the SPNs and create a keytab file for tomcat kerberos spnego Single sign on. the server running tomcat7 is ubuntu-ad1.wad.eng.hytrst.com the KDC is kerberos.wad.eng.hytrust.com the domain is WAD.ENG.HYTRUST.COM im using my ad…
Arthur Ulfeldt
  • 3,219
  • 9
  • 31
  • 40
6
votes
3 answers

How to setup apache redirect or custom 401 document on Kerberos SSO login failure

I have a working Kerberos SSO setup, I use apache and jboss with mod_jk. Apache is protecting (by kerberos) the auto-login.htm page with the following configuration: AuthType Kerberos AuthName …
Pierre Pretorius
5
votes
1 answer

How to set Openssh and Mit kerberos (from windows to linux server)?

I need to connect through openssh from windows to a linux server using a kerberos ticket. I got the bin file from: https://github.com/NoMoreFood/openssh-portable/releases/tag/v7.9-sspi Through my company login UI, I obtain the ticket using MIT…
dax90
  • 101
  • 1
  • 4
5
votes
1 answer

How to prevent browser password prompts when no Active Directory single-sign-on?

We have single-sign-on working on an internal website, with Apache and mod_auth_kerb ... except users without the relevant browser config are getting password prompts instead of an error page. Users who have tweaked their web browser config to allow…
Smylers
  • 156
  • 6
5
votes
1 answer

NFS Share with Kerberos Authentication

I am using Windows Storage Server as a file server and now have the need to setup NFS sharing for linux client machines On my test Ubuntu desktop, I installed Kerberos Client and also setup the keytab using the kutil command The klist command shows…
Lucky Chingi
  • 101
  • 7
5
votes
1 answer

How to force kerberos to use in memory credential cache?

MIT Kerberos supports multiple types of credential cache to store tickets . For example, if I want to use a persistent keyring per-user in kernel memory I can add the following to krb5.conf. [libdefaults] default_ccache_name =…
rlf
  • 335
  • 2
  • 9
5
votes
2 answers

How to enable logging for Kerberos on Windows 2012 R21

How do I enable AND view logs for Kerberos requests on Windows server 2012? I have IIS 8.5 Running on Windows server 2012 R2. I want to see success and failure messages related to Kerberos (like you can on other/earlier versions of windows). I've…
cab0
  • 151
  • 1
  • 1
  • 4
5
votes
1 answer

SSH works with expired Kerberos Password

I have setup SSH - single sign on using kerberos V5. When a user password has expired , it returns 'Warning: password has expired.' and allows the user to login! I even made changes in the /etc/pam.d/password-auth such that pam_krb5.so comes above…
Chandira Mouli
  • 51
  • 3
5
votes
1 answer

Forward Kerberos Authentication on Ansible

I have an ansible control machine (host-A) that need to talk with host-C, an Windows machine that doesn't have local users (It's an Active Directory). host-A doesn't have network access to host-C, but the communication it's possible using…
Bernardo Vale
  • 151
  • 5
5
votes
1 answer

Windows - Kerberos SSO from outside the domain

I've tried to figure it out myself, but to no avail. Google offers many tutorials but I couldn't find any for the below case. We have an external cooperating employee with VPN access to our LAN and he needs to access some of our web applications.…
sam_pan_mariusz
  • 2,053
  • 1
  • 12
  • 15
5
votes
4 answers

Kerberos with OpenLDAP backend: Password Sync HowTo

The basic setup is an OpenLDAP server. The users are provisioned and the passwords are set. Now we decided to add an MIT KDC for being able to use Kerberos. We configured the MIT KDC to utilize the LDAP as a backend for the KDC database. We create…
Condla
  • 51
  • 1
  • 4
5
votes
0 answers

Why is it common in the startup world for ssh keys to be used for authetication instead of kerberos?

My first few jobs as a linux admin had be working under some very senior admins. In all of these cases kerberos was setup for users to request a security token and gain access to company servers for a set amount of time. Now as I have started…
Jacob Taleb
  • 51
  • 4
5
votes
2 answers

Privileges when doing sudo to another domain user

Suppose I have a corporate domain mydomain using MS Active Directory. In the domain I have the users myuser and youruser. Now, on one specific Ubuntu machine mymachine, myuser has sudo rights, and does sudo su youruser (or sudo -u youruser sh).…
JHH
  • 173
  • 1
  • 6
1 2 3
…
75 76