similar to: Guest access with Kerberos does not work

https://bugzilla.mindrot.org/show_bug.cgi?id=928 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |djm at mindrot.org Blocks| |1481 --- Comment #4 from Damien Miller

http://bugzilla.mindrot.org/show_bug.cgi?id=928 Summary: Kerberos/GSSAPI authentication does not work with multihomed hosts Product: Portable OpenSSH Version: -current Platform: Other URL: http://marc.theaimsgroup.com/?l=openssh-unix- dev&m=108008882620573 OS/Version: All

(was: "Re: Pending OpenSSH release, call for testing", topic drift at its finest :-) Markus Moeller wrote: > Douglas, > > OK three possible settings(hostname,connection IP,GSS_C_NO_NAME) are fine for me too. Does GSS_C_NO_NAME relate to this bug (addressless tickets)? http://bugzilla.mindrot.org/show_bug.cgi?id=488 BTW, I opened a bug the the multihomed thing a couple of

I have compiled samba 3.0.6 with MIT 1.3.1 Kerberos and I can successfully use smbclient with Kerberos against a 2000/2003 Windows share. When I try the same with smbmount I get the warning: "Warning: kerberos support will only work for samba servers". I am wondering why smbmount doesn't work against 2000/2003 fileshares with Kerberos, although smbclient works fine and smbmount

Darren, We have systems which are multihomed for virtualisation, but run only one sshd. You can connect to any IP-address and should be authenticated with gssapi/kerberos. So the client will ask for a principal host/virt-ip-X and the server has to have an entry for this in the keytab and has to select the right key by determining the hostname from the connection IP-address. There is no other way

Hi All. I'm looking for some help to merge an outstanding Kerberos credential cache change from OpenBSD into Portable. I don't know enough about Kerberos to figure out how that change should be applied for the non-Heimdal(?) code path. The outstanding diff is attached. Any volunteers? -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4

Hello! If i try a net ads join i get a kerberos error , but my kerberos works fine, i can do a kinit,klist and so on. the error i get is the following. [2005/09/01 08:02:16, 0] libads/kerberos.c:ads_kinit_password(146) kerberos_kinit_password root@MY.DOMAIN.COM failed: Cannot resolve network address for KDC in requested realm [2005/09/01 08:02:16, 0] utils/net_ads.c:ads_startup(191)

I have a setup with a w2k3 AD and Samba 3.0.15pre2 as fileservers on Linux. I created two AD computer objects and used ktpass to create the Keberos keys. The keytab has the following entries host/linux.test.com@TEST.COM mapped to a computer account linux-host$ for general Kerberos services (ftp,ssh,..) cifs/linux.test.com@TEST.COM mapped to a computer account linux-cifs$ for Windows 2003/XP

http://bugzilla.mindrot.org/show_bug.cgi?id=1326 Summary: Allow non-public-key credentials in authorized_keys file (Kerberos, etc.) Product: Portable OpenSSH Version: 4.4p1 Platform: All OS/Version: Linux Status: NEW Severity: enhancement Priority: P2 Component: Kerberos support

Hai Amos, Thank you for your very clear responce.. few small questions.. Is there a way to setup the proxy for the following. 1) use negotiate kerberos for auth, ( which is working already for all domain joined machines ) 2) use a fall back that works, for now basic ldap works for non windows machines, and domain joined machines. 3) use any other fallback way for authentication users on windows

... sorry wrong list.. but you can read it and learn from it.. :-)) Greetz, Louis >-----Oorspronkelijk bericht----- >Van: samba [mailto:samba-bounces at lists.samba.org] Namens >L.P.H. van Belle >Verzonden: dinsdag 18 augustus 2015 9:45 >Aan: samba at lists.samba.org >Onderwerp: Re: [Samba] [squid-users] debian Jessie squid with >auth (kerberos/ntlm/basic) ERROR

Hello List, I have successfully integrated samba to an Active Directory Domain, and it is authenticating against the ADS, but only while the Kerberos ticket is valid. After that period it seems to take only the user/group list from its (winbind) cache. By now i can get a kerberos ticket with "kinit Administrator" or any other username that has administrative rights on ADS and all is

Am 14.10.20 um 16:19 schrieb Rowland penny via samba: > On 14/10/2020 15:07, Markus Jansen via samba wrote: >> Am 14.10.20 um 08:31 schrieb Nico Kadel-Garcia via samba: >>> On Tue, Oct 13, 2020 at 10:30 AM Rowland penny via samba >>> <samba at lists.samba.org> wrote: >>>> On 13/10/2020 15:01, Markus Jansen via samba wrote: >>>>> Thank you

On 14/10/2020 15:07, Markus Jansen via samba wrote: > Am 14.10.20 um 08:31 schrieb Nico Kadel-Garcia via samba: >> On Tue, Oct 13, 2020 at 10:30 AM Rowland penny via samba >> <samba at lists.samba.org> wrote: >>> On 13/10/2020 15:01, Markus Jansen via samba wrote: >>>> Thank you very much for your hints. >>>> >>>> I got rid of SSSD

I took Markus Friedl's advice and set up a KbdintDevice for Kerberos password authentication/expiry. It took me a bit to wrap my head around privsep, but I think it's working properly (code stolen shamelessly from FBSD's PAM implementation :->). The hardest part was working out how to get the interaction between krb5_get_init_creds_password() (along with the prompter) to work

Thank you very much for your hints. I got rid of SSSD and managed to get a successful kerberos authentication via wbinfo -K and the UPN. But accessing via SMB (using MAC OS' smbutil or Finder) still fails with "FAILED with error NT_STATUS_NO_SUCH_USER". As I'm using CentOS 8, I used authselect to configure winbind integration to PAM (do I really need this for SMB?) and enabled

(I hope this message is appropriate for these lists. If not, please tell me and I won't do it again.) Hi All. There will be a new release of OpenSSH in a couple of weeks. This release contains Kerberos and GSSAPI related changes that we would like to get some feedback about (and hopefully address any issues with) before the release. I encourage anyone with an interest in

On Tue, Oct 13, 2020 at 10:30 AM Rowland penny via samba <samba at lists.samba.org> wrote: > > On 13/10/2020 15:01, Markus Jansen via samba wrote: > > Thank you very much for your hints. > > > > I got rid of SSSD and managed to get a successful kerberos > > authentication via wbinfo -K and the UPN. > > > > But accessing via SMB (using MAC OS'

Hi, Does Samba have a tool which can list the MS PAC content of a Kerberos cache ? Thank you Markus

On 05/10/2020 16:14, Markus Jansen via samba wrote: > Dear all, > > i'm investigating the issue that I can't authenticate against a Samba (as Active-Directory Member) using the userPrincipalName (UPN). (Using Samba and sAMAccountName works fine.) > > After some research I'm quite sure that winbind is limited to the sAMAccountName and can't use UPN. So I deciced to