Re: openssh + kerberos + windows ad

2010-01-06 Thread Marcello Mezzanotti
Bob, What exactly you want to know? :) On Mon, Jan 4, 2010 at 9:18 PM, Bob Rasmussen wrote: > I am attempting the same thing myself, almost. Please provide as many > details as you can. > > My AD server is a 2008 Server box, my client is a Windows 2000 box, trying > to use Windows PuTTY to log

Re: openssh + kerberos + windows ad

2010-01-06 Thread Douglas E. Engert
Marcello Mezzanotti wrote: > I just did :) > > the problem was the keytab, i created using linux command "net ads > keytab create", > > i tested both linux ssh client and putty > (PuTTY-0.58-GSSAPI-2005-07-24, i tested with another patched putty > client, worked, but it didnt created/forwared m

Re: openssh + kerberos + windows ad

2010-01-06 Thread Bob Rasmussen
On Wed, 6 Jan 2010, Marcello Mezzanotti wrote: > Bob, > > What exactly you want to know? :) 1) What version(s) of PuTTY work in your environment? Did you try the developer's build from the official PuTTY site? 2) Did you have to create a keytab file on the AD server, and transfer it to the SS

Re: openssh + kerberos + windows ad

2010-01-06 Thread Marcello Mezzanotti
Bob, On Wed, Jan 6, 2010 at 12:30 PM, Bob Rasmussen wrote: > On Wed, 6 Jan 2010, Marcello Mezzanotti wrote: > >> Bob, >> >> What exactly you want to know? :) > > 1) What version(s) of PuTTY work in your environment? Did you try the > developer's build from the official PuTTY site? http://sweb.cz

Upcoming KfW 3.x ??

2010-01-06 Thread Jeff Blaine
I seem to have all sorts of weird problems with KfW. For instance, I just clicked 'Cancel' in the 'Obtain new credentials' dialog for a certain realm and the dialog greyed out, won't go away, and won't close via [X]. Other times I get DNS failures from NIM when nslookup in a cmd.exe window resolv

KfW installation question (krb.con, etc...)

2010-01-06 Thread Jeff Blaine
If one specifies a URL for KfW configuration at install-time, but does not care about or want to support krb4 and does not offer krb.con or krbrealm.con files, a 'critical error' dialog is raised to users. Download failed: HTTP/1.1 404 Not Found Is there a way to avoid this? We'd like to pr

Prematurely locked out by Active Directory

2010-01-06 Thread Warren Jones
Our site has configured Active Directory so that an account is temporarily locked after five consecutive failed login attempts. This works as expected when I authenticate from a Linux box running MIT Kerberos 1.6.3. However, I've noticed a change after updating to version 1.7: My account is now

Re: Prematurely locked out by Active Directory

2010-01-06 Thread Greg Hudson
This is a known bug and should be corrected in krb5 1.7.1. I can supply a source code patch if it would help. Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos

Re: Prematurely locked out by Active Directory

2010-01-06 Thread Douglas E. Engert
Warren Jones wrote: Our site has configured Active Directory so that an account is temporarily locked after five consecutive failed login attempts. This works as expected when I authenticate from a Linux box running MIT Kerberos 1.6.3. However, I've noticed a change after updating to version

Re: KfW installation question (krb.con, etc...)

2010-01-06 Thread Jeffrey Altman
On 1/6/2010 3:25 PM, Jeff Blaine wrote: > If one specifies a URL for KfW configuration at install-time, > but does not care about or want to support krb4 and does not > offer krb.con or krbrealm.con files, a 'critical error' dialog > is raised to users. > > Download failed: HTTP/1.1 404 Not Fo

Re: Upcoming KfW 3.x ??

2010-01-06 Thread Jeffrey Altman
On 1/6/2010 2:32 PM, Jeff Blaine wrote: > I seem to have all sorts of weird problems with KfW. > > For instance, I just clicked 'Cancel' in the 'Obtain > new credentials' dialog for a certain realm and the > dialog greyed out, won't go away, and won't close > via [X]. > > Other times I get DNS fail

Re: Prematurely locked out by Active Directory

2010-01-06 Thread Warren Jones
On Wed, Jan 06, 2010 at 04:31:34PM -0600, Douglas E. Engert wrote: > I had seen that during testing, and used the attached patch to get around it. That works. Thanks to both Greg and Douglas for the quick response! -- Warren Jones Software Engineering Support Group Fluke Corporation -