Problems with kerberos and forest domain

Tags

aix

Operating Systems AIX Problems with kerberos and forest domain

11-13-2013

Registered User

49, 0

Join Date: Oct 2007

Last Activity: 30 January 2014, 8:28 PM EST

Posts: 49

Thanks Given: 1

Thanked 0 Times in 0 Posts

Problems with kerberos and forest domain

Hi,

I have a simple Apache setup that works fine when I create a keytab on a domain level authentication works fine. When I create a keytab at the forest level authentication does not work. I get the following error message. Does anyone know what I am doing wrong here? I validated there is the SPN is unique on the AD side.

Code:

[Wed Nov 13 10:55:49 2013] [debug] src/mod_auth_kerb.c(1707): [client x] Client didn't delegate us their credential
[Wed Nov 13 10:55:49 2013] [debug] src/mod_auth_kerb.c(1735): [client x] Warning: received token seems to be NTLM, which isn't supported by the Kerberos module. Check your IE configuration.

3junior

View Public Profile for 3junior

Find all posts by 3junior

Previous Thread | Next Thread

7 More Discussions You Might Find Interesting

1. OS X (Apple)

OSX and Kerberos

Our Network Security folks have mandated that we "Kerberize" our systems to allow them to perform an authenticated scan. This consists of instructions to change /etc/pam.d/sshd from: # sshd: auth account password session auth optional pam_krb5.so use_kcminit auth optional ...

2. AIX

Problems with Kerberos and realms

I'm fairly new to UNIX-land, and one of my first assigned tasks was to try to set up Kerberos authentication on an unused partition. Hopefully everything makes sense, but please let me know if any clarification is needed with any of it. AIX 7.1, and while I found various docs on the subject, a...

3. Windows & DOS: Issues & Discussions

How to: Linux BOX in Windows Domain (w/out joining the domain)

Dear Expert, i have linux box that is running in the windows domain, BUT did not being a member of the domain. as I am not the System Administrator so I have no control on the server in the network, such as modify dns entry , add the linux box in AD and domain record and so on that relevant. ...

4. Programming

Kerberos Authentication c/c++

I am in the process of developing a application that needs to be able to authenticate users details with a kerberos server, which is proving to be rather difficult. There seems to be a lack of good information on how to do this using the MIT kerberos api. Can anyone point me in the right...

5. AIX

SSH and Kerberos

I have 2 servers (lft1 and lft3) running AIX 5.3 ML 5. Both are installed with krb5.client.rte 1.4.0.4 and openssh.base.server 4.3.0.5300. I have configured some of the users on both servers to authenticate against our Windows 2003 Active Directory. From my PC, I can use telnet to login...

6. Solaris

kerberos security

i m new 2 unix world can some body explain me abt kerberos pls explain in detail..!

7. Cybersecurity

Kerberos security

I have installed Kerberos security in my UNIX system but I need to disable because of an application conflict with Kerberos. So Anybody ca tell me how can I disable it? Thank you

LEARN ABOUT SUSE

ktutil

KTUTIL(1)						      General Commands Manual							 KTUTIL(1)

NAME

       ktutil - Kerberos keytab file maintenance utility

SYNOPSIS

       ktutil

DESCRIPTION

       The  ktutil  command  invokes  a subshell from which an administrator can read, write, or edit entries in a Kerberos V5 keytab or V4 srvtab
       file.

COMMANDS

       list   Displays the current keylist.  Alias: l.

       read_kt keytab
	      Read the Kerberos V5 keytab file keytab into the current keylist.  Alias: rkt

       read_st srvtab
	      Read the Kerberos V4 srvtab file srvtab into the current keylist.  Alias: rst.

       write_kt keytab
	      Write the current keylist into the Kerberos V5 keytab file keytab.  Alias: wkt.

       write_st srvtab
	      Write the current keylist into the Kerberos V4 srvtab file srvtab.  Alias: wst.

       clear_list
	      Clear the current keylist.  Alias: clear.

       delete_entry slot
	      Delete the entry in slot number slot from the current keylist.  Alias: delent.

       add_entry (-key | -password) -p principal -k kvno -e enctype
	      Add principal to keylist using key or password.  Alias: addent.

       list_requests
	      Displays a listing of available commands.  Aliases: lr, ?.

       quit   Quits ktutil.  Aliases: exit, q.

REMARKS

       Changes to the keytab are appended to the keytab file (i.e., the keytab file is never overwritten).  To directly modify a keytab, save  the
       changes to a temporary file and then overwrite the keytab file of interest.

       Example:
	      ktutil> rkt /etc/krb5.keytab
	      (modifications to keytab)
	      ktutil> wkt /tmp/krb5.newtab
	      ktutil> q
	      # mv /tmp/krb5.newtab /etc/krb5.keytab

SEE ALSO

       kadmin(8), kdb5_util(8)

																	 KTUTIL(1)

AIX