Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [kerberos]

Kerberos is a computer network authentication protocol, which allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. Its designers aimed primarily at a client–server model, and it provides mutual authentication — both the user and the server verify each other's identity.

As many vendors have their own implementation of Kerberos, configuration details for each implementation is likely to vary. Here are some links that may help those troubleshooting Kerberos on commonly used paltforms.

1168 questions
0
votes
2 answers

Add member to kerberos domain programatically

I want to have an embedded device join a Linux based AD/DC domain. I have kerberos libraries (no executables) on the embedded device. I have an application on the embedded device that can successfully authenticate and access services on the domain…
Richard Schmitt
  • 1
  • 3
0
votes
1 answer

Linux, Basic password authentication against 2 different AD without joining domain

We have AIX and Linux servers running with basic password authentication against a Windows AD using Kerberos, so it are local users with a username identical to their sAMAccountName in the AD and all that is done is the password check. Both OS's use…
akm
  • 1
  • 3
0
votes
0 answers

Failing to decrypt kerberos AP_REP with wireshark

I'm trying to decrypt kerberos traffic with wireshark for the learning purposes. My process of following: First I retrive keytab for the test user with kadmin kadmin.local: ktadd -k vdzh-fin.keytab vdzharkov@VDZHARKOV.NOVALOCAL Entry for…
vudex
  • 1
  • 1
0
votes
1 answer

Kerberos auth from non-domain joined machines using custom UPN suffix

I am trying to access resources inside an Active Directory domain from a non-domain joined Windows 10 machine. The domain is ad.example.com, but there is also the alternative UPN suffix example.com. When I access, for example, a file share using a…
St0rmi
  • 1
  • 2
0
votes
0 answers

Impact of KrbTgtFullPAC Signature (CVE-2022-37967) patches

I am a bit concerned about the Windows November 2022 patches that introduced signing of the PAC-Field in Kerberostickets. There is a RegKey(“KrbtgtFullPacSignature”) that, if set to auditmode, accept and log all unsigned tickets. Since January, we…
404_username_not_found
  • 3
  • 2
0
votes
1 answer

Kerberos settings in GPO never seem to apply in spite of the GPO otherwise working

Server 2019 Domain Environment. Issue is related to the DCs themselves. I've a self-created GPO on my DC OU that sets a bunch of things, several of which are Kerberos settings: Curiously, while other things in the GPO seems to set on the DCs in…
The ITea Guy
  • 321
  • 1
  • 6
  • 16
0
votes
1 answer

SSSD is not creating a krb5.conf file after realm join, not able to `id` domain users, why?

The main problem is after I join the domain, I cannot id a domain user. Be aware I am not rebooting the host, do I need to? I would think I wouldn't need to. After doing some basic troubleshooting I realized that after I join the domain, I would…
Dave
  • 229
  • 2
  • 10
0
votes
0 answers

Does Kerberos OOB Patch Change RC4-HMAC Settings on DC

I have a very specific question before we deploy the November 2022 OOB patch to resolve the Kerberos deal on our DCs. 1st - I ran a klist command on a Windows box and it returns about 16 server entries. Among them I notice the KerbTicket Type is…
DesignerMind
  • 101
  • 1
0
votes
1 answer

Same FQDN for different IP depending on connection

I run a Kerberos / LDAP user authentication on Debian, which works nicely for decades. I now would like to use notebooks, which may connect by wire or by WiFi. I'm stuck thinking how to set up this infrastructure, and I refuse to believe that there…
Lars Hanke
  • 285
  • 3
  • 16
0
votes
0 answers

Active Directory: How to allow a foreign server to authenticate with a delegated ticket

It is a complex setup, which I want to explain first (if you dont care, just scroll to 5) ) : 1) Company has multiple Active Directory Forests, which are: user.local --> here are all user accounts stored server.local -> here are all servers are…
TheFamousSpy
  • 1
  • 2
0
votes
1 answer

Kerberos has (partly?) no support for AES256 on Ubuntu 22.04

I have an issue trying to do a kinit on ubuntu 22.04 with a user that has the "This account supports Kerberos AES 256 bit encryption" checkmark set. I can kinit without issues to a user that does not have this checkmark set just fine, and weirdly…
Catscrash
  • 1
  • 1
0
votes
0 answers

Apache - authorize users either by client certificate or by ldap group membership

I use Apache as a reverse proxy to check the authorization of incoming requests. Until now only Kerberos was provided as authentication method for "/" and client certificates for "/api". See code below. Now I need to have both methods (either, or)…
derBobby
  • 1
  • 1
0
votes
0 answers

Insufficient system resources exist to complete the requested service - CVE-2022-37966

Problem After enabling KrbtgtFullPacSignature (value 3) according to KB5020805 the entire domain becomes unreachable, at the login screen the following message is shown: “Insufficient system resources exist to complete the requested service“ and we…
Salve
  • 85
  • 1
  • 6
0
votes
0 answers

Azure P2S killing Kerberos Connection

EDIT: I can confirm that doing the registry change as mentioned here and here does in fact Band-Aid the issue. But why? Why do I need this work around just because I am using a laptop on the VPN when I dont need it on VMs in the…
alexander7567
  • 541
  • 2
  • 6
  • 18
0
votes
1 answer

PAM deems Kerberos password as expired

I run Kerberos / LDAP authentication in a small network for years. Kerberos is held in LDAP, which in turn is replicated to another site. Machines at the second site authenticate to the replica, the old site authenticates to the original server.…
Lars Hanke
  • 285
  • 3
  • 16
1 2 3
…
77 78