Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [kerberos]

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.

As many vendors have their own implementation of Kerberos, configuration details for each implementation is likely to vary. Here are some links that may help those troubleshooting Kerberos on commonly used paltforms.

1168 questions
7
votes
2 answers

Does kerbtray.exe not exist for windows server 2008

I can not find a valid kerbtray.exe for windows server 2008. I can only find for 2000 and 2003. Does it not exist or it is just replaced with something else?
Atle
  • 73
  • 1
  • 1
  • 7
7
votes
1 answer

Relative security of SAML vs Kerberos

Does anyone have any info/links on the relative security of SAML vs Kerberos. I believe I grasp the differences between the two, and what they mean for my particular application, but to decide between the two, knowing which is more secure, if…
Robert Gowland
  • 193
  • 1
  • 2
  • 8
6
votes
1 answer

How to force kerberos to use in memory credential cache?

MIT Kerberos supports multiple types of credential cache to store tickets . For example, if I want to use a persistent keyring per-user in kernel memory I can add the following to krb5.conf. [libdefaults] default_ccache_name =…
rlf
  • 365
  • 2
  • 9
6
votes
3 answers

MIT Kerberos keeps asking for password when authenticating to OpenSSH

I am trying to setup a simple Kerberos environment which consists of a Kerberos server (KDC), a client machine and a server machine running an OpenSSH daemon. The client is supposed to be authenticated through Kerberos when establishing an SSH…
arne.z
  • 357
  • 1
  • 6
  • 24
6
votes
1 answer

Joining AD domain with Windows 10 using smart card

My Windows "domain-centric" company has abruptly decided to make the switch from Windows 7 to Windows 10, and it has become my job to make their prepared image join our domain with our smart card/token based authentication system. This was an issue…
Y. Park
  • 61
  • 1
  • 1
  • 4
6
votes
3 answers

Do Linux servers using AD/Kerberos for authentication/authorization need computer accounts?

I am confused about whether Linux servers using Active Directory (AD) and Kerberos need computer accounts created? Does the Linux server as a machine need to join an AD domain and in doing so have a computer account to have…
Padge
  • 85
  • 1
  • 5
6
votes
2 answers

Kerberos service login only possible for 30 minutes after running ktpass.exe

I'm trying to Kerberize an Apache-server, and allow the created server principal to sign on to the Active Directory. I've followed one of the numerous tutorials available online, and it seems to work fine. I'm on the Linux side of the project, and…
Saustrup
  • 1,183
  • 1
  • 8
  • 12
6
votes
1 answer

Seamless SSO with Kerberos, IE, Firefox, LDAP Active Directory

Alias /students /var/www/students KrbServiceName HTTP KrbMethodNegotiate On KrbMethodK5Passwd On KrbSaveCredentials off KrbAuthRealms DOMAIN.LOCAL Krb5KeyTab /etc/httpd/keytab KrbAuthoritative off AuthType…
Brad
  • 235
  • 1
  • 4
  • 8
6
votes
3 answers

OpenSSH two factor authentication combined with Kerberos / public key

I'm trying to implement two-factor authentication for OpenSSH. The environment is Centos 7 (kernel: 3.10.0-229.1.2.el7.x86_64) with OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013. We have Active Directory (LDAP) + Kerberos deployed. The…
dgyuri92
  • 71
  • 1
  • 4
6
votes
1 answer

How can one enable DES-encrypted keys on an Apple KDC?

We are running a KDC on OS X 10.10 Yosemite, to which we have added a service principal for remotely accessing a (legacy) host: $ kadmin add -r host/a.b.c.d@REALM Since the host only supports des-cbc-crc key encryption, we then tried…
eggyal
  • 402
  • 5
  • 16
6
votes
7 answers

kinit: Cannot contact any KDC for realm 'UBUNTU' while getting initial credentials

I am installing Kerberos5-1.12.1 on ubuntu machine with these instructions. Whenever i am trying to do : kinit user1 I am facing an error: kinit: Cannot contact any KDC for realm 'UBUNTU' while getting initial credentials Below are my krb5.conf…
user3279174
  • 69
  • 1
  • 1
  • 2
6
votes
3 answers

nfs4 and kerberos: Wrong principal in request

My client/servers are both running Ubuntu 14.04 and kerberos user authentication works as intended. regular nfs4 mounts also work fine. All machines are running heimdal libraries. I haven't been able to get kerberized nfs4 working though. When…
cebalrai
  • 161
  • 2
  • 2
  • 9
6
votes
4 answers

SQL Server running under a domain account cannot register its SPN

I am trying to configure a fresh install of SQL Server to run under a domain account. However, I get intermittent errors when trying to connect to the server using another domain account, and I still see The SQL Server Network Interface library…
jimbobmcgee
  • 2,675
  • 4
  • 27
  • 43
6
votes
4 answers

kinit & pam_sss: Cannot find KDC for requested realm while getting initial credentials

I have a very similar problem as described in this thread on CentOS 6.3 authenticating against a 2008R2 AD DC. Here is my krb5.conf, I know for a fact that XXXXXXX.LOCAL is the true domain name: [logging] default = FILE:/var/log/krb5libs.log kdc =…
Sauraus
  • 75
  • 1
  • 1
  • 7
6
votes
3 answers

Ubuntu 12.04, Windows 2012 Active Directory Integration, Kerberos won't resolve service principals

after having checked the whole internet literally, I hope that I might get help here. I am trying to accomplish integration of ubuntu 12.04 servers into a Windows 2012 active directory with nfs and single sign on. setup: srv02 Windows…
Michael
  • 61
  • 1
  • 5
1 2 3
…
77 78