similar to: GSS-SPNEGO with dovecot and Outlook without Samba

I cooked this up while trying to figure out why thunderbird on Windows w/ SSPI was not working, but it turned out thunderbird does not use it, so I haven't been able to test it yet. I'm presenting it for discussion only, unless someone else can try it :) Modern versions of MIT kerberos support GSS-SPNEGO natively, but are only willing to negotiate for kerberos tickets and not NTLM

On 16 Apr 2015 14:29, "Johnny Hughes" <johnny at centos.org> wrote: > > On 04/16/2015 06:33 AM, Mike wrote: > > Hi Johnny, > > > > Thank you for your response. I thought to choose the sernet package > > because of the following stated in Samba Readme: > > > > Samba packages shipped in some distributions like e. g. Fedora, RHEL may >

On Thu, Apr 16, 2015 at 6:03 PM, James Hogarth <james.hogarth at gmail.com> wrote: > This was required for kerberos secured updates prior to el7.1 and el6.6 ... > > The problem in the underlying kerberos libraries was resolved so that > kerberos based updates worked with gss again and spnego doesn't need to be > compiled in. >

On 04/16/2015 06:33 AM, Mike wrote: > Hi Johnny, > > Thank you for your response. I thought to choose the sernet package > because of the following stated in Samba Readme: > > Samba packages shipped in some distributions like e. g. Fedora, RHEL may > not be able to be used as Samba AD DC, because the distribution relies on > MIT Kerberos which isn't supported by

Hi Johnny, Thank you for your response. I thought to choose the sernet package because of the following stated in Samba Readme: Samba packages shipped in some distributions like e. g. Fedora, RHEL may not be able to be used as Samba AD DC, because the distribution relies on MIT Kerberos which isn't supported by Samba yet. In this case build Samba yourself or use the packages from SerNet or

Hi folks, I've been sifting through various threads on GSSAPI and NTLM support, and I'm wondering if anyone out there can confirm or deny GSSAPI IMAP auth support in Microsoft Outlook 2016 (Windows)? Perhaps there's some magic registry key to change IMAP auth from PLAIN to GSSAPI? We're trying to do single sign-on + e-mail for Windows domain users; Thunderbird GSSAPI works

Gang, I've been trying to build rc29 under Solaris 10 using either "--with-gssapi" or Kerberos 5 ticket usage. I'm trying to figure out how to set up fetchmail on another S10 box to do IMAP fetches from dovecot without having to enter a password. No matter what configure option I try, I get Building with GSSAPI support ........ : no at the end of the configure. I searched

Hai, ? Im know this might not be the place to ask, but im doing it anyway..? ;-) ? Im testing an debian Jessie server with squid3 ( 3.4.8 ) Its running Debian Samba 4.1.13 with winbind. ? Im having troubles, to get the squid auth working. So my question is is someone here using kerberos authentication on squid. ( 3.4.x ) Or someone who is using the gss-spnego helper protocol. ? Im using this

Dear SAMBA experts, I'm looking to emulate the behavior of some older Windows servers, mainly old Win2k/XP machines. On newer clients (possibly XP-SP2 and above), the SMB server will send a GSS-API message at the end of the Negotiate Protocol Response packet detailing the supported Security Service Providers by OIDs in a negTokenInit structure. However, older servers did not send this message

On 04/16/2015 12:53 AM, Mike wrote: > CentOS 7.1503 installed. > Installed Samba 4 from sernet: Version 4.1.17-SerNet-RedHat-11.el7 (to be > configured). > > The samba wiki Readme First page states, "Some distributions like . . . Red > Hat Enterprise Linux (and clones), ship BIND9 packages with disabled > GSS-SPNEGO option, which is required for signed DNS updates when

On 17 Apr 2015 00:42, "Mike" <1100100 at gmail.com> wrote: > > On Thu, Apr 16, 2015 at 6:03 PM, James Hogarth <james.hogarth at gmail.com> > wrote: > > > This was required for kerberos secured updates prior to el7.1 and el6.6 ... > > > > The problem in the underlying kerberos libraries was resolved so that > > kerberos based updates worked

CentOS 7.1503 installed. Installed Samba 4 from sernet: Version 4.1.17-SerNet-RedHat-11.el7 (to be configured). The samba wiki Readme First page states, "Some distributions like . . . Red Hat Enterprise Linux (and clones), ship BIND9 packages with disabled GSS-SPNEGO option, which is required for signed DNS updates when using BIND as DNS backend on your Samba DC. This circumstance requires

On Fri, Apr 17, 2015 at 7:46 AM, James Hogarth <james.hogarth at gmail.com> wrote: > It wasn't the bind package directly but rather an issue with the libkrb5 > libraries. > > This is the specific bug that fixed the issue: > > https://bugzilla.redhat.com/show_bug.cgi?id=1087068 > > I'll get the samba wiki updated to make this clear. > Zoinks! I

On 17 Apr 2015 13:04, "Mike" <1100100 at gmail.com> wrote: > > On Fri, Apr 17, 2015 at 7:46 AM, James Hogarth <james.hogarth at gmail.com> > wrote: > > > It wasn't the bind package directly but rather an issue with the libkrb5 > > libraries. > > > > This is the specific bug that fixed the issue: > > > >

Hi @ all, I try to update the DNS records from my DHCP Clients to my AD DC but there ist an issue with the GSSAPI I don't know how to solve. For this I followed this guide. https://wiki.samba.org/index.php/Configure_DHCP_to_update_DNS_records_with_B IND9 GSSAPI Error: start_gssrequest tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor code may provide more

I've enabled the GSS code in dovecot, but our Kerberos nerds are complaining that it doesn't work :) I probably have the thing totally misconfigured (so don't worry about that part for now), but I do have a crash: Info: imap-login: Disconnected: rip=XXX.YYY.229.8, lip= XXX.YYY.17.59, TLS handshake Error: auth(default): gssapi(?,XXX.YYY.229.8): While acquiring service credentials: No

Hello I have error during connection from managed host to ovirt server. Jun 16 12:31:24 main qpidd[27662]: 2009-jun-16 12:31:24 warning Client closed connection with 501: internal-error: Sasl error: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No credentials cache found) (qpid/client/SaslFactory.cpp:226) I read on this maillist

what about this? can we do about this if we break the protocol? -------------- next part -------------- An embedded message was scrubbed... From: Love <lha at stacken.kth.se> Subject: gss userauth Date: Fri, 22 Aug 2003 16:06:27 +0200 Size: 2878 Url: http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20030822/f7bb85a0/attachment.mht

http://bugzilla.mindrot.org/show_bug.cgi?id=1218 Summary: GSSAPI client code permits SPNEGO usage Product: Portable OpenSSH Version: 4.3p2 Platform: Other OS/Version: All Status: NEW Severity: normal Priority: P2 Component: Kerberos support AssignedTo: bitbucket at mindrot.org ReportedBy:

https://bugzilla.mindrot.org/show_bug.cgi?id=1868 Summary: 'ssh -k' should explicitly disable gss auth Product: Portable OpenSSH Version: 5.8p1 Platform: All OS/Version: All Status: NEW Severity: normal Priority: P2 Component: Kerberos support AssignedTo: unassigned-bugs at mindrot.org