topic Re: UserID Monitored server (WinRM-HTTP) gets Kerberos error. in General Topics

UserID Monitored server (WinRM-HTTP) gets Kerberos error.

BigPalo — Tue, 05 Jul 2022 12:38:20 GMT

Hi,

We tried this: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/map-ip-addresses-to-users/configure-server-monitoring-using-winrm

It seems like config is OK but we are getting "kerberos error" in status ofr this server monitored. Where can we see whats happening about this error? useridd logs doesnt show anythimng.

Re: UserID Monitored server (WinRM-HTTP) gets Kerberos error.

sgoethals — Tue, 05 Jul 2022 16:19:36 GMT

I recently changed to WinRM-HTTP and I am seeing the same thing. From the cli if I look at the log, I can see that I have an error "KDC has no support for encryption type.

The error is at the end of the log when you use Shift-G after entering less mp-log useridd.log from the cli.

I am not sure why I am getting this error, and trying to figure it out.

For the service account I am using, I have turned on the option to use aes128-cts-hmac-sha1-96, but I am still getting the error.

The DC is a Windows 2012R2 server.

Re: UserID Monitored server (WinRM-HTTP) gets Kerberos error.

BPry — Wed, 06 Jul 2022 00:25:15 GMT

@BigPalo,

As @sgoethals mentioned you should check the useridd.log file to check for errors, and you can also build out an authentication-profile with your Kerberos profile so that you can test authentication to ensure that it's setup properly. I'd also just check with your server team that they've enabled it on their end, as this is usually restricted during standard hardening standards.

Re: UserID Monitored server (WinRM-HTTP) gets Kerberos error.

sgoethals — Wed, 06 Jul 2022 12:10:49 GMT

After spending quite a bit of time on this, I determined a resolution to my issue.

The newer encryption methods that use AES are supported in 2012R2. This is the OS, that I am using on the domain controllers (for just a little longer), however, the functional level of the domain was set to 2008. Once I updated the functional level, the Kerberos error went away and an "access denied" error showed up. The is happened because I had not made the service account a member of the Windows Group Remote Management.

Once I made the service account a member of this group the error went away, and I was able to connect via WinRM-HTTP.

Good luck on your resolution.

Re: UserID Monitored server (WinRM-HTTP) gets Kerberos error.

BigPalo — Fri, 08 Jul 2022 08:48:05 GMT

We check the useridd logs an we only see this kind of events:

2022-07-08 09:04:39.610 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-1e0c0b0affff0000, new_cp=7, new_uid=249, old_cp=7, old_uid=250, gp_user=0
2022-07-08 09:04:39.610 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-390c0b0affff0000, new_cp=7, new_uid=380, old_cp=7, old_uid=636, gp_user=0
2022-07-08 09:04:39.610 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-1e0c0b0affff0000, new_cp=7, new_uid=251, old_cp=7, old_uid=250, gp_user=0
2022-07-08 09:04:39.610 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-1e0c0b0affff0000, new_cp=7, new_uid=1542, old_cp=7, old_uid=250, gp_user=0
2022-07-08 09:04:39.610 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-1e0c0b0affff0000, new_cp=7, new_uid=248, old_cp=7, old_uid=250, gp_user=0
2022-07-08 09:04:39.610 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-1e0c0b0affff0000, new_cp=7, new_uid=672, old_cp=7, old_uid=250, gp_user=0
2022-07-08 09:04:39.610 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-390c0b0affff0000, new_cp=7, new_uid=472, old_cp=7, old_uid=636, gp_user=0
2022-07-08 09:04:39.610 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-390c0b0affff0000, new_cp=7, new_uid=257, old_cp=7, old_uid=636, gp_user=0
2022-07-08 09:04:39.610 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-1e0c0b0affff0000, new_cp=7, new_uid=476, old_cp=7, old_uid=250, gp_user=0
2022-07-08 09:04:39.610 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-1e0c0b0affff0000, new_cp=7, new_uid=255, old_cp=7, old_uid=250, gp_user=0
2022-07-08 09:04:39.610 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-1e0c0b0affff0000, new_cp=7, new_uid=90, old_cp=7, old_uid=250, gp_user=0
2022-07-08 09:04:39.610 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-1e0c0b0affff0000, new_cp=7, new_uid=410, old_cp=7, old_uid=250, gp_user=0
2022-07-08 09:04:39.611 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-1e0c0b0affff0000, new_cp=7, new_uid=933, old_cp=7, old_uid=250, gp_user=0
2022-07-08 09:04:39.611 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-1e0c0b0affff0000, new_cp=7, new_uid=258, old_cp=7, old_uid=250, gp_user=0
2022-07-08 09:04:39.611 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-1e0c0b0affff0000, new_cp=7, new_uid=933, old_cp=7, old_uid=250, gp_user=0
2022-07-08 09:04:39.611 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-390c0b0affff0000, new_cp=7, new_uid=257, old_cp=7, old_uid=636, gp_user=0
2022-07-08 09:04:39.611 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-1e0c0b0affff0000, new_cp=7, new_uid=416, old_cp=7, old_uid=250, gp_user=0
2022-07-08 09:04:39.611 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-1e0c0b0affff0000, new_cp=7, new_uid=246, old_cp=7, old_uid=250, gp_user=0
2022-07-08 09:04:39.611 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-390c0b0affff0000, new_cp=7, new_uid=472, old_cp=7, old_uid=636, gp_user=0
2022-07-08 09:04:39.611 +0200 ignore the user logged in at the same time: ts=1657263879, ip=0-1e0c0b0affff0000, new_cp=7, new_uid=249, old_cp=7, old_uid=250, gp_user=0
2022-07-08 09:04:50.333 +0200 ignore the user logged in at the same time: ts=1657263866, ip=0-900c010affff0000, new_cp=7, new_uid=385, old_cp=7, old_uid=555, gp_user=0
2022-07-08 09:04:55.581 +0200 ignore the user logged in at the same time: ts=1657263895, ip=0-920c010affff0000, new_cp=7, new_uid=548, old_cp=7, old_uid=545, gp_user=0
2022-07-08 09:04:55.581 +0200 ignore the user logged in at the same time: ts=1657263895, ip=0-920c010affff0000, new_cp=7, new_uid=1516, old_cp=7, old_uid=545, gp_user=0
2022-07-08 09:04:55.581 +0200 ignore the user logged in at the same time: ts=1657263895, ip=0-900c010affff0000, new_cp=7, new_uid=198, old_cp=7, old_uid=507, gp_user=0
2022-07-08 09:04:55.582 +0200 ignore the user logged in at the same time: ts=1657263895, ip=0-920c010affff0000, new_cp=7, new_uid=546, old_cp=7, old_uid=545, gp_user=0
2022-07-08 09:04:55.582 +0200 ignore the user logged in at the same time: ts=1657263895, ip=0-920c010affff0000, new_cp=7, new_uid=204, old_cp=7, old_uid=545, gp_user=0
2022-07-08 09:04:55.582 +0200 ignore the user logged in at the same time: ts=1657263895, ip=0-a90c010affff0000, new_cp=7, new_uid=547, old_cp=7, old_uid=189, gp_user=0
2022-07-08 09:04:55.582 +0200 ignore the user logged in at the same time: ts=1657263895, ip=0-920c010affff0000, new_cp=7, new_uid=551, old_cp=7, old_uid=545, gp_user=0
2022-07-08 09:04:55.582 +0200 ignore the user logged in at the same time: ts=1657263895, ip=0-900c010affff0000, new_cp=7, new_uid=447, old_cp=7, old_uid=507, gp_user=0
2022-07-08 09:04:55.582 +0200 ignore the user logged in at the same time: ts=1657263895, ip=0-900c010affff0000, new_cp=7, new_uid=385, old_cp=7, old_uid=507, gp_user=0
2022-07-08 09:04:55.582 +0200 ignore the user logged in at the same time: ts=1657263895, ip=0-9d0c010affff0000, new_cp=7, new_uid=553, old_cp=7, old_uid=492, gp_user=0
2022-07-08 09:04:55.582 +0200 ignore the user logged in at the same time: ts=1657263895, ip=0-9d0c010affff0000, new_cp=7, new_uid=669, old_cp=7, old_uid=492, gp_user=0

----------------

where we can see the "kerberos error" showed in monitored server useridd?

Re: UserID Monitored server (WinRM-HTTP) gets Kerberos error.

SubaMuthuram — Wed, 17 Aug 2022 03:04:58 GMT

Hi Team,

Have you resolved this issue ?, I am having same issue and I am getting error in server 2016.

Re: UserID Monitored server (WinRM-HTTP) gets Kerberos error.

Han.Valk — Wed, 17 Aug 2022 17:23:15 GMT

Sometimes enabling AES128 and AES256 encryption on the service account in active directory isn't enough. You also must reset the password of the service account. You can have a look at my post.