Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [kerberos]

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.

As many vendors have their own implementation of Kerberos, configuration details for each implementation is likely to vary. Here are some links that may help those troubleshooting Kerberos on commonly used paltforms.

1136 questions
0
votes
1 answer

Access Denied when mounting Kerberised NFS v4 Share

I want to mount an NFS4 share, but with Kerberos security enabled. This is my setup: Debian Server (dns fqdn: nfsv4test.subnet.example.org) Debian Client (dns fqdn: nfsv4client.subnet.example.org) Windows ADC, acts also as KDC My realm is…
Standard
  • 53
  • 5
0
votes
0 answers

NFS4 + Kerberos and ownership of mounted share

I have the following setup: NFS4 server on Debian Buster, Kerberos server on the same machine, no LDAP or AD. The hostname is bohr.digital. List of…
QkiZ
  • 475
  • 2
  • 7
  • 18
0
votes
0 answers

Squid does not write into access.log with kerberos authentication

I finally managed to get squid with kerberos authentication and LDAP group checking to work. I am using squid 4.1, kerberos v5 and Linux Mint Cinnamon 20.1. Everything works fine, but I got a little problem: As soon as I am using Kerberos as…
Shouma
  • 21
  • 2
0
votes
1 answer

Does Windows SSO work with ADFS 2016 for OIDC Web Application?

Our web application uses OpenID-Connect (OIDC) Implicit Flow for user login with ADFS 2016. Login generally works, however users get login screen for user name and password. Does Windows-Login / SSO (kerberos?) work with such setup so users don't…
Vilmantas Baranauskas
  • 101
  • 1
0
votes
0 answers

Microsoft AD/Kerberos and non-Windows clients (RHEL and Cisco)

I currently manage a small network with mostly Win Server 2016 hosts in a standard Active Directory domain, plus a couple RHEL 7 boxes. We will be going to Win Server 2019 and RHEL 8 in the medium future. Switches and routers are Cisco. Someone up…
SKaye
  • 1
  • 1
0
votes
0 answers

Ubuntu Kerberos Parent Domain Auth Fails

We have an Ubuntu 18.4 server joined to the child domain. I'm able to ssh to the server with child domain account but not with parent domain account. Here is my krb5.conf [libdefaults] default_realm = DOMAIN.LOCAL ticket_lifetime =…
AAABL
  • 3
  • 3
0
votes
1 answer

Ubuntu SSSD Auth Error with child/sub AD Domain

Need help authenticating linux (Ubuntu) server that is joined to child domain. I can see the server name on the Domain Controller and able to run authentication test successfully however I am not able to login with my domain account. Seems like a…
AAABL
  • 3
  • 3
0
votes
0 answers

how to get the auth statistics of kerberos server (MIT kerberos krb5kdc)

I am looking for a way to show Kerberos authentication statistics like how many auth success/failed/duration on krb5kdc. for success/failure I can get it from the syslog, but for the duration (the time taken to service the request successfully),…
chocripple
  • 2,039
  • 14
  • 9
0
votes
0 answers

Linux server joined to child AD domain unable to authenticate users from parent domain

I have an Ubuntu 20.04 server that I have successfully joined to my domain using realm, US.EXAMPLE.COM. The way our AD is structured is that all machines are joined to the child domain for their region and all users are setup in the parent domain,…
dan9k1
  • 1
0
votes
1 answer

Ubuntu 18.04 multi-AD-User mount share in /home

I have an Ubuntu 18.04 server which is joined to our windows domain. I have set up so users can log in to the server using their AD creds which is working great. I also set up script that mounts a windows share automatically at login. sudo mount -t…
TL_Arwen
  • 69
  • 6
0
votes
0 answers

Apache HTTPD Kerberos, silently redirect if no auth offered

I've configured Apache HTTPD as a reverse proxy (for SSL) for my Artifactory instance, and I'm now trying to get HTTP SSO working on it. Using the below configuration, I am successfully automatically signed in from my machine. However, when I run…
tj94
  • 79
  • 4
0
votes
1 answer

Powershell Remote PSSession Failing - Domain Administrator Account - Error 0x80090322

I am troubleshooting an issue I have with a PRTG sensor not collecting Windows Update information from one of our servers. It is using WinRM and a remote PowerShell command to do that. Server 1 - Issue Server Server 2 - Working Server When I try to…
Logan
  • 1
  • 1
  • 1
0
votes
0 answers

Windows Server 2012 R2, Kerberos: Should the SPN "host/localhost" exist?

I noticed that the eventlog "Microsoft-Windows-Security-Kerberos" is filled with the same entry around every minute (sometimes three times per minute, sometimes only after two or three minutes): Event ID: 100 Description (roughly translated from…
Larsen
  • 305
  • 2
  • 14
0
votes
2 answers

Set network.auth.use-sspi in Firefox with Group Policy

I have downloaded the Group Policy templates and copied them to the appropriate location. In gpedit.msc I have set: Computer Configuration > Administrative Templates > Mozilla > Firefox > Authentication > SPNEGO to include the required domain names…
Jon
  • 1
  • 2
0
votes
1 answer

Kerberos kinit with keytab not working with certain encryption methods -- PER USER

I have two users, say userA and userB. userA can use a keytab with aes but not rc4 and userB can use a keytab with rc4 but not aes. This is the snippet that makes the keytab, tests it, and puts it into place: #!/bin/sh PRINCIPAL="xxxxx" #…
rrauenza
  • 533
  • 3
  • 15
1 2 3
…
75 76