Page 1 of 1
[SOLVED] kerberos error - Preauthentication failed
Published: November 8, 2018 - 4:27 PM
by empbilly
Hello,
I re-configured auth from my clients via kerberos. Some machines are not being recognized and the server log shows the following:
Code: Select all
Nov 8 11:33:26 wapt winbindd[6145]: [2018/11/08 11:33:26.387247, 0] ../source3/libsmb/cliconnect.c:1895(cli_session_setup_spnego_send)
Nov 8 11:33:26 wapt winbindd[6145]: Kinit for WAPT$@... to access cifs/dc4....@... failed: Preauthentication failed
Configurations:
Installed version of WAPT: 1.6.2.7
Server OSLinux
OS of the administration machine/creation of packagesWindows 7
Do I need to re-register (wapt-get register) the machine? Can I do this remotely to all the machines in my park?
Re: kerberos error - Preauthentication failed
Published: November 12, 2018 - 7:42 PM
by empbilly
Any ideas or help are welcome!!
Re: kerberos error - Preauthentication failed
Published: November 27, 2018 - 11:30 AM
by empbilly
Wapt staff never got an error/issue like that?
Re: kerberos error - Preauthentication failed
Published: November 30, 2018 - 2:49 PM
by empbilly
Hello,
I discovered some new information!!!!
I made the configuration following the tutorial:
https://www.wapt.fr/fr/doc/Installation ... ebian.html
Before executing the commands below the server was part of the domain, but after executing the commands,
Code: Select all
sudo msktutil --server DOMAIN_CONTROLER --precreate --host $(hostname) -b cn=computers --service HTTP --description "host account for wapt server" --enctypes 24 -N
sudo msktutil --server DOMAIN_CONTROLER --auto-update --keytab /etc/nginx/http-krb5.keytab --host $(hostname) -N
it appears that the wapt server is removed from the domain.
root@wapt:/etc/samba# net ads testjoin
kerberos_kinit_password WAPT$@... failed: Preauthentication failed
ads_connect: No logon servers are currently available to service the logon request.
Join to domain is not valid: No logon servers are currently available to service the logon request.
but the host is successfully registered.
c:\>psexec.exe /acceptula -s wapt-get register
PsExec v2.2 - Execute processes remotely
Copyright (C) 2001-2016 Mark Russinovich
Sysinternals -
www.sysinternals.com
Host correctly registered against server
https://wapt....
Is this normal after configuring authentication via kerberos?
Re: kerberos error - Preauthentication failed
Published: Dec 17, 2018 - 10:42 PM
by sfonteneau
Samba is not used in wapt.
The tutorial asks you to create a keytab:
/etc/nginx/http-krb5.keytab
This is the one that will be used. No need to test with net ads testjoin
Re: kerberos error - Preauthentication failed
Published: Dec 18, 2018 - 6:14 PM
by empbilly
Okay.
Thanks for your feedback!