Questions tagged [kerberos]

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.

As many vendors have their own implementation of Kerberos, configuration details for each implementation is likely to vary. Here are some links that may help those troubleshooting Kerberos on commonly used paltforms.

1136 questions
5
votes
0 answers

Samba authentication and LDAP

I have an OpenLDAP server that I use for authentication and authorization for various services. All users are of object type inetOrgPerson and my groups are groupOfNames. Now I want to configure Samba to authenticate against LDAP as well (with group…
Chris
  • 193
  • 1
  • 6
5
votes
3 answers

Check Primary Authentication Protocol for Active Directory (NTLM or Kerberos?)

How can I check, from a client machine (in Global Group)(also is local admin), whether the domain controller is authenticating my login request to the domain using NTLM or Kerberos? I know that Kerberos is enabled by default, but the domain Admin…
Andrew Watson
  • 53
  • 1
  • 1
  • 3
5
votes
2 answers

March 10th Patch Tuesday appears to cause SQL Server client connection problems

Since applying the full set of patches on a Win 7.1 Pro desktop and a Windows 2012 R2 Datacenter Azure server running SQL 2014, SQL Management Studio (2008 and 2014 versions) won't connect to the SQL 2014 Azure server. The client connection attempt…
Spike
  • 51
  • 1
  • 3
5
votes
2 answers

Why does a SPN on a different host cause a server to lose its trust? How should I fix it?

I have a brand new server image that loses its trust as soon as it's joined to the domain. I suspect it's because of the duplicate SPN I discovered using the LDAP version of this Powershell script Powershell script #Set Search cls $search =…
makerofthings7
  • 8,821
  • 28
  • 115
  • 196
5
votes
3 answers

In a Windows PKI, what is a Workstation Authentication CA Template used for? What happens if it expires?

Many workstations have an expiring computer certificate that was issued using the Workstation Authentication CA template. The CA of this template expires in 2 days. I've deployed a new CA, with an extended date, and have successfully enrolled many…
makerofthings7
  • 8,821
  • 28
  • 115
  • 196
5
votes
2 answers

IIS 7.5 web application failing with NT Authority\Anonymous Logon

I am finding various google results, but none seem to fix my problem. I am setting up a new WINDOWS 2008 R2 box at work that is to communicate with an existing SQL 2012 box via web tools running in IIS 7.5 within our intranet. We are to use windows…
5
votes
1 answer

Cross-Realm trust verify failed with 'netdom' command

Question 1: Am having my ActiveDirectory in Windowsserver 2012 machine - its domain name is AD-DEMO.LOCAL Kerberos admin-server is in another Ubuntu machine - its realm KERBEROS.COM Added trust in 'Active Directory Domains and…
5
votes
6 answers

Kerberos Configuration Manager for SQL Server error "unable to access user principal information from the system"

When I launch the Kerberos Configuration Manager for SQL Server and try to connect to the local machine it's on, I am getting the error "Kerberos Configuration Manager for SQL Server error "unable to access user principal information from the…
Geoff Dawdy
  • 213
  • 1
  • 2
  • 9
5
votes
7 answers

kinit: Cannot contact any KDC for realm 'UBUNTU' while getting initial credentials

I am installing Kerberos5-1.12.1 on ubuntu machine with these instructions. Whenever i am trying to do : kinit user1 I am facing an error: kinit: Cannot contact any KDC for realm 'UBUNTU' while getting initial credentials Below are my krb5.conf…
user3279174
  • 59
  • 1
  • 1
  • 2
5
votes
1 answer

Does IIS NTLM/Kerberos authentication still work with an offline domain controller?

We have multiple IIS instances spread across remote regional branches. Each IIS instance (v.7.5) is running the same application and authenticates its users with Integrated Authentication (NTLM in the providers list). A few branches get frequently…
Starbuck3000
  • 101
  • 1
  • 4
5
votes
4 answers

How to re-join an AD2003 domain with Samba after deleting the machine account?

During some troubleshooting I deleted the machine account for a Linux server running samba from our AD 2003 domain. We are using Kerberos for authentication, and after I deleted the machine account I tried to join the domain again using net ads join…
Guss
  • 2,520
  • 5
  • 32
  • 55
5
votes
3 answers

Kerberos - Adding a SPN to a Domain User

When adding a new SPN into the Kerberos domain, you have the option of mapping the SPN to a user. In general, I join the domain through Integrated Windows Authentication, and this creates a new computer account for the service, but now, I would like…
5
votes
2 answers

If an IIS hosted site is secured using Kerberos, can Linux machines connect to it?

I'm running into a problem configuring my IIS 7.0 website in a test environment with Kerberos. I have a trial version of Windows Server 2008 R2 with AD DS, AD RMS, DHCP, DNS & IIS roles installed. I have gone into the IIS security settings for the…
5
votes
1 answer

Does Windows (Active Directory) kerberos use DNS for Realm mapping?

Will Windows clients use DNS to map hosts to specific kerberos realms? Specifically, do they use _kerberos.host.example.com IN TXT OTHERREALM.COM records?
84104
  • 12,698
  • 6
  • 43
  • 75
5
votes
4 answers

Locking a user's account locally when kerberos is enabled

I'm trying to set up Chef-managed accounts for a group of machines with the following characteristics: If there is no local account, login is blocked. If there is a local account with SSH keys, use those for authentication is possible. If there is…
Stephen C
  • 541
  • 4
  • 18