similar to: Heimdal or MIT kerberos comparison

I have a freshly installed FreeBSD 6.0-BETA1 system, which comes with Heimdal & OpenSSH w/GSSAPI enabled (version 4.1p1 FreeBSD-20050605) Most of the servers I connect to have OpenSSH w/GSSAPI enabled but they use MIT Kerberos (1,3.x and 1.4.x) Now, I can use ticket authentication between all systems where the libraries are all the same (Heimdal or MIT), but trying to use, for example,

Dear All, Would like some know the answer on the above question. What is the different between compiling using internal heimdal library vs mit-krb5. I'm on gentoo and thus like other distro having issue on the system-wide mit-krb and removing it is not that convenient (But still possible) I've try to compile samba 4.1.2 with internal heimdal library to work as a Domain controller But

I have some problem whit Kerberos. OS: FreeBSD 5.3 Domain: W2k3 native mode. 1)I am Installing Heimdal 0.6.1 over port. Config /etc/krb5.conf %/usr/local/bin/kinit ivan ivan@NKMK.RU's Password: kinit: krb5_get_init_creds: Response too big for UDP, retry with TCP 2)Compile and install Heimdal 0.6.4 over source %/usr/local/bin/kinit ivan ivan@NKMK.RU's Password: kinit:

My college is kerberized, and so in many situations authentication is both faster and more secure using kerberos tickets. Sadly I have run into a problem. The Heimdal included in FreeBSD seems to be incompatible with my school's servers running MIT kerberos when authenticating over gssapi. For example ssh in verbose mode returns: debug2: we sent a gssapi-with-mic packet, wait for reply

Hi! I already asked a similar question before, but it keeps popping up in different contexts and forms, and the more I use samba myself, the more often it comes to me too, especially in context of using various security tokens for auth. And the more I think about all this, the more sane it looks to me. The thing is: mit-krb5 has much better user-level support than heimdal. But samba does not

hello I'm having the following problem: On a share I have a user with read-only access to word files. Another user has read-write access to these files. When the user with read-only access opens a word file and then the user with read-write access to these files opens the file, the read-write user has only read-only access. If the read-write user opens the word file first, then he has

Hi, I'm running OpenSSH 3.8 & 3.9, compiled against Heimdal 0.6.3 for it's GSSAPI & AFS integration. A couple weeks ago, we upgraded our MIT KDC from (ugh) Kerberos 5 1.0.6 to the lastest and greatest 1.3.5. However, it seems that as part of the upgrade, our GSSAPI credentials passing in OpenSSH stopped working. Actually, didn't completely stop... You can still do a

I have a Windows 2000 Active Directory domain and I need to create a group policy to assign an msi install to a computer. This has always worked fine on a Windows share, but now the install fails after moving to a Samba file server. I'm guessing it's some sort of permissions issue. Does anyone know how to make this work? James Dinkel Network Engineer Butler County of Kansas

I have previously gotten samba 3.0.4 to work with the MIT implementation, now with 3.0.7, the configure is looking for -lgssapi and not finding it. I can get the AD to issue me a kerberos ticket, samba is just complaining about not geing able to find the gssapi library. Does anyone have a tried-and-true approach using the ports system? Thanks, Graham

Here's the situation: We have users who are members of groups and those groups are sometimes members of a 2nd level of groups. If a folder has permissions assigned to a 2nd level group, then the user can not access the share. Doing a "getent group | grep user | grep 2nd_level_group" also returns nothing. Samba seems to not be recognizing that a user is a member of a group under

We are running a fileserver (Samba version 3.0.10-1.4E.9) on CentOS 4.4. No AD, clients are Windows XP and OS X. Linux acl's are used for access to directories and files. Each top-level folder belongs to a primary group with mode 2770. The acl's restrict access to lower level directories. We need to pass the acl's down the directory tree or else users may have unexpected access to

Rather then implementing kafs in MIT Kerberos, I would like to suggest an alternative which has advantages to all parties. The OpenSSH sshd needs to do two things: (1) sets a PAG in the kernel, (2) obtains an AFS token storing it in the kernel. It can use the Kerberos credentials either obtained via GSSAPI delegation, PAM or other kerberos login code in the sshd. The above two

On Mon, 2023-03-20 at 10:39 +0200, Alexander Bokovoy wrote: > Indeed. For the record, current set of tests not supported by > > --with-system-mitkrb5 build: > > > > ---------------------------------------- > > $ cat selftest/skip_mit_kdc > > # We do not support RODC yet > > .*rodc > > .*RODC > > ^samba4.ntvfs.cifs.ntlm.base.unlink >

On Sun, 2023-03-19 at 09:29 +0200, Alexander Bokovoy via samba- technical wrote: > Hi, > > > I would be against a blended build against both MIT Kerberos and > Heimdal > Kerberos in a distribution. It is not going to bring you anything > good, > support wise. > > Andreas and I have submitted a talk to SambaXP about MIT > Kerberos/Heimdal Kerberos-based Samba AD

I'm trying to decide on a linux distro to use for our enterprise Samba server. I like that there is a deb repo for Debian from samba.org, but I'm more comfortable with CentOS (Redhat). I just want to be sure I have a well supported Samba server and I need at least the 3.0.20 version so I can use the "inherit owner" property. I also want automatic updates for bugfixes and

my thought is that the people that are complaining that the buttons and look of programs running in wine are the same ones that allow Microsoft to keep working on their GUI and not focusing on the kernel of their operating systems (anyone remember the talking paperclip in MSoffice?) They're worried about how pretty everythign is and not how it performs. hence the reason that Vista and xp never

Hello Linus Torvalds, Paul Davis, The state of most desktop and office applications under Linux seem quite healthy. People are working hard making the Linux desktop work. Yet, I am very sorry, but I cannot describe the deployment and maintaince of 3D graphics and sound API's as well as drivers as anything other than woeful. My hope is an enviroment where both open-source and commcial

Trying to follow Chapter 9.3.3 of S3BE to create a SuSE 8.2 Active Directory domain member server. 9.3.3 says heimdal >= .6 is required. I installed the Sernet packages and saw 0.6.2 source is included. Running ./configure after unpacking the heimdal source completes OK, but running make results in the following errors: creating libss.la /usr/bin/sed: can't read

Could somebody please confirm that they are actually using 8.1-R with heimdal as a KDC successfully? A little confirmation would help me greatly. Thanks, Jason C. Wells

On Mon, Oct 24, 2005 at 03:35:41PM -0400, William Jojo wrote: > > Has anyone been able to get Heimdal 0.7.1 with Samba 3.0.20b to compile successfully without commenting out the __cplusplus stuff in include/includes.h? If I comment it out, it's fine on FC3. The Heimdal people are using "private" as a structure member name, so I know it's a Heimdal problem :-). I think you