Sophos XGS AD SSO ""Cannot initialise Kerberos authentication with DOMAIN"

Hello Leon Pohl ,

Thank you for reaching out to the community, please refer -  Kerberos authentication not working.

Hello, I just delete this file.

Stop the NASM service: service nasm:stop -ds nosync

Remove file /content/nasm: rm -rf /content/nasm

Start the NASM service: service nasm:start -ds nosync

But I get "Cannot initialize Kerberos authentication with Domain" again.

I can see the file krb5.keytab under content/nasm/etc/ but I cant show the file by the command less or so.

Feb 23 14:34:39.493984Z [nasm] initialize_kerberos(): realm = DOMAIN
Feb 23 14:34:39.496045Z [nasm] system configured hostname [NAME]
Feb 23 14:34:39.496542Z [nasm] initialize_kerberos(): gss_acquire_cred HOST/NAME@DOMAIN: No key table entry found for HOST/NAME.DOMAIN
Feb 23 14:34:39.496574Z [nasm] setup_channel(): unable to initialize kerberos
Feb 23 14:34:39.496582Z [nasm] sending channel established status to ntlm server

Did you verify FQDN configured with a hostname of 15 characters max?

Yes, the hostname has 6 characters. Together with the domain 16 characters. In other words, the FQDN currently has 16 characters

Good day Folks,

As I've been facing this issue too and the commands didn't help nor was my hostname more than 15 characters, here's how I solved it:

The issue was a firewall name change/ AD hiccup, therefore I had to do the following steps:

1. Turn OFF "AD SSO" for (in my case) the LAN zone in "Administration" - "Device access"

2. Delete the computer object of the firewall in my AD

3. Run the commands:

service nasm:stop -ds nosync

rm -rf /content/nasm

service nasm:start -ds nosync

4. Turn ON "AD SSO" for the LAN zone in "Administration" - "Device access"

5. Run an authentication test for the configured AD server in "Authentication" and hit save afterwards

As for the name change, I went with "hostname.domain" instead of just "hostname" for the firewall (According to Sophos, this should not make a difference though).

Afterwards, the logs showed Kerberos authenticating :-).

I'm running Version 20.0.0 GA-Build222 as a VM.

Hope this helps someone!

Cheers

Max