Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [kerberos]

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.

As many vendors have their own implementation of Kerberos, configuration details for each implementation is likely to vary. Here are some links that may help those troubleshooting Kerberos on commonly used paltforms.

1168 questions
8
votes
4 answers

Running a Windows service under a domain user account

If I run a Windows service on some host under a domain user account, and the password for this account changes at some later point, will the service now fail to start, until you update the password? If not, how are the credentials for the domain…
BeeOnRope
  • 573
  • 3
  • 6
  • 12
7
votes
3 answers

ldapsearch and kerberos authentication

I can successfully connect and search to an Active Directory domain controller using ldapsearch. I am using the -x option, to specify a username/password authentication (password being specified by -W and username by -D). I currently need to dump…
philippe
  • 2,303
  • 4
  • 32
  • 53
7
votes
1 answer

Set up a Windows 10 Client for a Linux KDC Realm

I set up a KDC Server and created a Realm EXAMPLE.COM. Here is my krb5.conf file: [libdefaults] renew_lifetime = 7d forwardable = true default_realm = EXAMPLE.COM ticket_lifetime = 24h dns_lookup_realm = false dns_lookup_kdc = false …
D. Müller
  • 251
  • 1
  • 2
  • 8
7
votes
1 answer

Does ActiveDirectory support Kerberos user principle instances?

User principle instance has format username/instance@REALM and separate password. According to some sources it's possible to create such principles in MIT Kerberos. Does ActiveDirectory support this Kerberos feature?
olmstad
  • 197
  • 1
  • 6
7
votes
2 answers

creating an SPN from a linux build server

I'm setting up a process which would automatically create the SPNs for newly exposed service URLs. I am aware of how to create an SPN with Windows using the setspn -A command with the right priviliges. As my build server is running on Linux, I…
Balint Pato
  • 173
  • 1
  • 1
  • 5
7
votes
1 answer

Is it possible to use Kerberos over TLS through sssd?

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with Kerberos and identifying the user with LDAP (all through sssd.) I…
2rs2ts
  • 325
  • 3
  • 11
7
votes
1 answer

Creating keytabs and service principal names

I'm trying to set up a keytab for a Java server to support Kerberos authentication on a Windows network. I'm struggling to get it working even at the level of the command line tools, haven't even got as far as the server setup yet! My plan just…
user21693
  • 171
  • 1
  • 2
  • 4
7
votes
1 answer

Does Active Directory's Kerberos implementation support per-user ticket lifetime settings?

With MIT Kerberos, the kadmin utility supports the creation of principals that have an explicit maximum ticket lifetime and renewal lifetime (-maxlife and -maxrenewlife arguments for add_principal) which may be different than the realm's default…
Ryan Bolger
  • 16,755
  • 4
  • 42
  • 64
7
votes
1 answer

Can't change password of FreeIPA admin - "Current password's minimum life has not expired"

We have a FreeIPA-based system, admin's password has expired and needs to be changed but the standard password changing procedure over SSH fails: sashka@cellar ~ ssh admin@ipa.xxxxxxxxxx.com admin@ipa.xxxxxxxxxx.com's password: Password expired.…
Alex
  • 7,939
  • 6
  • 38
  • 52
7
votes
2 answers

NetApp erroring with: STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT

Since a sitewide upgrade to Windows 7 on desktop, I've started having a problem with virus checking. Specifically - when doing a rename operation on a (filer hosted) CIFS share. The virus checker seems to be triggering a set of messages on the…
Sobrique
  • 3,747
  • 2
  • 15
  • 36
7
votes
4 answers

0x19 KDC_ERR_PREAUTH_REQUIRED in my event log

So I have a server, and every time a user or service account logs on to the machine, an error event is generated in the System log: A Kerberos Error Message was received: on logon session DOMAIN\serviceaccount Client Time: Server Time:…
Ryan Ries
  • 55,481
  • 10
  • 142
  • 199
7
votes
2 answers

ActiveDirectory Kerberos keytab unusable from Linux

I am configuring Kerberos authentication for Alfresco CIFS protocol fully implemented in Java (JLAN project). That is not the first time, I used to set it up right in a single shot. In the same network, with an ActiveDirectory Windows 2008R2 and the…
Yves Martin
  • 879
  • 3
  • 8
  • 21
7
votes
1 answer

Best practice for authenticating DMZ against AD in LAN

We have few customer facing servers in DMZ that also have user accounts , all accounts are in shadow password file. I am trying to consolidate user logons and thinking about letting LAN users to authenticate against Active Directory.Services…
Sergei
  • 1,226
  • 16
  • 25
7
votes
2 answers

debian: cannot change password

As the root user, I can change the password: hussie:/home/claudiu# passwd Enter new password: Retype new password: passwd: password updated successfully As a non-root user I cannot: claudiu@hussie:~$ passwd Current Kerberos password: passwd: User…
Claudiu
  • 1,207
  • 5
  • 21
  • 28
7
votes
1 answer

Renewing kerberos ticket without user intervention

We have found the most excellent program that that will allow our OSX machines to print through our Windows Print servers. (ksmbprint from http://deploystudio.com/) The program allows for smb printing with to the servers through kerberos…
eric.s
  • 429
  • 1
  • 3
  • 12
1 2 3
…
77 78