Cross-domain auth using Kerberos

[Michael Richter]

Hi,
On a Linux server I want to access a Windows server from Windows domain sub.dnsdomain using an account from parent Windows domain dnsdomain. The account has admin permissions to that server and can login using RDP.

I have configured Kerberos realms for both domains on the Linux server. I can than get a Kerberos ticket using kinit user. I can access servers from dnsdomain. But I can not access the server from sub.dnsdomain.

[libdefaults]
        default_realm = DNSDOMAIN
        dns_lookup_realm = false
        #ticket_lifetime = 24h
        renew_lifetime = 7d
        rdns = false
        default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
        default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
        permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5
        ticket_lifetime = 600
        kdc_timesync = 1
        ccache_type = 4

# The following krb5.conf variables are only for MIT Kerberos.
        kdc_timesync = 1
        ccache_type = 4
        forwardable = true
        proxiable = true

# The following libdefaults parameters are only for Heimdal Kerberos.
        fcc-mit-ticketflags = true

[realms]
        DNSDOMAIN = {
                kdc = dc1.dnsdomain:88
                kdc = dc2.dnsdomain:88
                admin_server = dc1.dnsdomain:749
                default_domain = dnsdomain
        }
        SUB.DNSDOMAIN = {
                kdc = subdc1.sub.dnsdomain:88
                kdc = subdc2.sub.dnsdomain:88
                admin_server = subdc1.sub.dnsdomain:749
                default_domain = sub.dnsdomain
        }

[domain_realm]
        .dnsdomain = DNSDOMAIN
        dnsdomain = DNSDOMAIN
        .sub.dnsdomain = SUB.DNSDOMAIN
        sub.dnsdomain = SUB.DNSDOMAIN

[appdefaults]
autologin = true
forward = true
forwardable = true
encrypt = true

Note: The Windows domain name differs from the DNS names. I'm not using it in Kerberos config.

Than I can do this:

$ kinit user
Password for user@DNSDOMAIN:
$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: user@DNSDOMAIN

Valid starting       Expires              Service principal
07.08.2020 14:06:07  07.08.2020 14:16:00  krbtgt/DNSDOMAIN@DNSDOMAIN
        renew until 10.08.2020 14:06:07
$ rpcclient server.dnsdomain -k
rpcclient $> srvinfo
        XXXXXXX         
        platform_id     :       500
        os version      :       6.3
        server type     :       0x801013
rpcclient $> quit
$ rpcclient subserver.sub.dnsdomain -k
Cannot connect to server.  Error was NT_STATUS_LOGON_FAILURE

If I try to connect via Ansible/WinRM to the server in subdomain I get the error:

Server not found in Kerberos database

How to get access to the server in subdomain using an account from parent domain?

[Michael Richter]

OK, threw away Kerberos and switched to NTLM which works great.