search for: configure_kerbero

You can specify which principal you want in your keytab with samba-tool, check the manual. You can check which principal is in your keytab using klist: klist -k or klist -ke /path/to/keytab 2016-06-27 9:09 GMT+02:00 Rowland penny <rpenny at samba.org>: > On 27/06/16 04:27, Mark Foley wrote: > >> I am running Samba 4.1.23 as an AD/DC. It has been running file for more >>

...ce in working this through with me. Although my purpose was for Dovecot to authenticate mail clients, the configuration settings needed were on the Samba side. I hope these instructions can eventually make it into: https://wiki.samba.org/index.php/Setup_a_Samba_Active_Directory_Domain_Controller#Configure_Kerberos as those instruction contain nothing about the required `samba-tool spn add` and samba-tool domain exportkeytab` settings, without which it is impossible to get Dovecot (and presumably other local authenticators needing GSSAPI/Kerberos) to authenticate. You need kerberos as the Samba built-in ke...

...though my purpose was for Dovecot to authenticate > > mail clients, the configuration settings needed were on the Samba side. I hope these > > instructions can eventually make it into: > > > > https://wiki.samba.org/index.php/Setup_a_Samba_Active_Directory_Domain_Controller#Configure_Kerberos > > > > as those instruction contain nothing about the required `samba-tool spn add` and samba-tool domain > > exportkeytab` settings, without which it is impossible to get Dovecot (and presumably other > > local authenticators needing GSSAPI/Kerberos) to authenticate. >...

...if I need that file or not, but the Dovecot people say I do. I now have those files (krb5.keytab and krb5.conf) in /etc. Now, the problem is I cannot do your suggested `klist` command, nor the `kinit` as described in https://wiki.samba.org/index.php/Setup_a_Samba_Active_Directory_Domain_Controller#Configure_Kerberos I don't seem to have these commands. Do these come with the Samba4 installation or are they supposed to already be on the system, or to be downloaded separately? --Mark -----Original Message----- > From: mathias dufresne <infractory at gmail.com> > Date: Mon, 27 Jun 2016 11:18:3...

I'm installing sernet samba4 packages with active directory support on RHEL 6. Is it required that I install kerebros packages seperately? Kerebros does t seem to be an Install require . I wasn't sure if sernet had somehow rolled sernet with kerebros??.?. Any help greatly appreciated. Greg

...;> these on any Windows DC server (at least). > > I believe I am good on 1,2 and 4. I downloaded and installed kerberos and tested it with kinit > > and klist according to the instructions at > > https://wiki.samba.org/index.php/Setup_a_Samba_Active_Directory_Domain_Controller#Configure_Kerberos > > > > As to the the keytab (#5) I did the following: > > > > $ samba-tool domain exportkeytab /etc/krb5.keytab > > > > which created the file. I made this owned and readable by group dovecot, per instructions at > > http://wiki2.dovecot.org/Authenticati...

...through with me. Although my purpose was for Dovecot to authenticate > mail clients, the configuration settings needed were on the Samba side. I hope these > instructions can eventually make it into: > > https://wiki.samba.org/index.php/Setup_a_Samba_Active_Directory_Domain_Controller#Configure_Kerberos > > as those instruction contain nothing about the required `samba-tool spn add` and samba-tool domain > exportkeytab` settings, without which it is impossible to get Dovecot (and presumably other > local authenticators needing GSSAPI/Kerberos) to authenticate. > > You need kerbe...

...through with me. Although my purpose was for Dovecot to authenticate > mail clients, the configuration settings needed were on the Samba side. I hope these > instructions can eventually make it into: > > https://wiki.samba.org/index.php/Setup_a_Samba_Active_Directory_Domain_Controller#Configure_Kerberos > > as those instruction contain nothing about the required `samba-tool spn add` and samba-tool domain > exportkeytab` settings, without which it is impossible to get Dovecot (and presumably other > local authenticators needing GSSAPI/Kerberos) to authenticate. The problem is that Sam...

...rpose was for Dovecot to authenticate >>> mail clients, the configuration settings needed were on the Samba side. I hope these >>> instructions can eventually make it into: >>> >>> https://wiki.samba.org/index.php/Setup_a_Samba_Active_Directory_Domain_Controller#Configure_Kerberos >>> >>> as those instruction contain nothing about the required `samba-tool spn add` and samba-tool domain >>> exportkeytab` settings, without which it is impossible to get Dovecot (and presumably other >>> local authenticators needing GSSAPI/Kerberos) to authen...

...server (at least). > > > > I believe I am good on 1,2 and 4. I downloaded and installed kerberos and tested it with kinit > > > > and klist according to the instructions at > > > > https://wiki.samba.org/index.php/Setup_a_Samba_Active_Directory_Domain_Controller#Configure_Kerberos > > > > > > > > As to the the keytab (#5) I did the following: > > > > > > > > $ samba-tool domain exportkeytab /etc/krb5.keytab > > > > > > > > which created the file. I made this owned and readable by group dovecot, per ins...

...ver (at least). >>>>> I believe I am good on 1,2 and 4. I downloaded and installed kerberos and tested it with kinit >>>>> and klist according to the instructions at >>>>> https://wiki.samba.org/index.php/Setup_a_Samba_Active_Directory_Domain_Controller#Configure_Kerberos >>>>> >>>>> As to the the keytab (#5) I did the following: >>>>> >>>>> $ samba-tool domain exportkeytab /etc/krb5.keytab >>>>> >>>>> which created the file. I made this owned and readable by group dovecot...

Am 01.07.2016 um 23:52 schrieb Achim Gottinger: > Here is an simpler way to create an user with the imap principal and > the dovecot keymap > > ~# samba-tool user create dovecot > [Assign password] > ~# samba-tool spn add imap/server.domain.local dovecot > ~# samba-tool domain exportkeytab --principal dovecot at DOMAIN.LOCAL > dovecot.keytab If above line is replaced by

...though my purpose was for Dovecot to authenticate > > mail clients, the configuration settings needed were on the Samba side. I hope these > > instructions can eventually make it into: > > > > https://wiki.samba.org/index.php/Setup_a_Samba_Active_Directory_Domain_Controller#Configure_Kerberos > > > > as those instruction contain nothing about the required `samba-tool spn add` and samba-tool domain > > exportkeytab` settings, without which it is impossible to get Dovecot (and presumably other > > local authenticators needing GSSAPI/Kerberos) to authenticate. >...

...t to authenticate > >>> mail clients, the configuration settings needed were on the Samba side. I hope these > >>> instructions can eventually make it into: > >>> > >>> https://wiki.samba.org/index.php/Setup_a_Samba_Active_Directory_Domain_Controller#Configure_Kerberos > >>> > >>> as those instruction contain nothing about the required `samba-tool spn add` and samba-tool domain > >>> exportkeytab` settings, without which it is impossible to get Dovecot (and presumably other > >>> local authenticators needing GSSAPI...

On 27.06.2016 07:31, Mark Foley wrote: > Thanks for the reply. When you say it [NTLM] "should" work, I understand you to be implying > you've not actually tried NTLM yourself, right? I've never gotten a response from someone > saying they have or are actually using it. Your subsequent messages about NTLM v[1|2] may be > the problem, but email clients I've tried

Hi, On 27-06-2016 08:58, Mark Foley wrote: > So, I'm apparently lacking in the kerberos stuff. Here's the problem -- Samba4 uses Heimdal > Kerberos and when I provisioned my domain apparently none of these needed kerberos files were > set up. I can, however, kerberos authenticate from domain workstations both WIN7 and Linux. You don't need any Samba4 stuff, to get it

...gt; > > > I believe I am good on 1,2 and 4. I downloaded and installed > kerberos and tested it with kinit > > > > > and klist according to the instructions at > > > > > > https://wiki.samba.org/index.php/Setup_a_Samba_Active_Directory_Domain_Controller#Configure_Kerberos > > > > > > > > > > As to the the keytab (#5) I did the following: > > > > > > > > > > $ samba-tool domain exportkeytab /etc/krb5.keytab > > > > > > > > > > which created the file. I made this owned and read...

Hi, ? I have just provisioned a new samba setup with 2 DCs running ISC DHCPd in failover and I?m trying to get it to play nice with samba internal DNS but I?m having some issues. 1) I?m using on commit, etc triggers in the dhcpd config to call a script that calls samba-tool to add, delete or update DNS. This script works fine when I call it from the command line as the dhcpd user but when called