---
title: "Deploy the kerberos-connect container on the Network Connector"
slug: "network-connector-how-to-deploy-the-kerberos-connect-container"
updated: 2026-11-03T14:47:51Z
published: 2026-11-03T14:47:51Z
canonical: "docs.senhasegura.io/network-connector-how-to-deploy-the-kerberos-connect-container"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy the kerberos-connect container on the Network Connector

The kerberos-connect container lets Segura™ Platform acquire Kerberos tickets through the Network Connector. Deploy it alongside the Network Connector agent, in the same Docker Compose file, so Segura™ can change Windows credential passwords over Kerberos when it reaches the Active Directory domain only through the connector.

This is the prerequisite setup for [Change a password over Kerberos through the Network Connector](/v4-2/docs/execution-how-to-change-a-password-over-kerberos-through-the-network-connector).

## Requirements

- Segura™ Platform 4.2.0 or later.
- A working Network Connector server and agent. See [How to install Network Connector](/v4-2/docs/network-connector-how-to-install-network-connector).
- Separate hosts for Segura™ Platform, the Network Connector agent (the Docker host), and the domain controller. Segura™ reaches the Active Directory only through the Network Connector agent, never directly.
- Root access to the Docker host that runs the Network Connector agent.
- Docker and Docker Compose on that host.
- The Kerberos realm and the KDC hostname for the target Active Directory.

## Steps

1. On Segura™ Platform, generate the certificate bundle. In the Segura™ terminal, run:

```
orbit kerberos-connect setup
```

The command creates the bundle at `/tmp/leaf_cert_bundle.tar.gz`.
2. Copy the bundle to the Docker host. Replace `user@dockerhost` with your host:

```
scp /tmp/leaf_cert_bundle.tar.gz user@dockerhost:/tmp
```
3. On the Docker host, extract the bundle:

```
mkdir -p /etc/kerberos-connect
tar -xvzf /tmp/leaf_cert_bundle.tar.gz -C /etc/kerberos-connect
```
4. Add the `segura-kerberos-connect` service to the Network Connector Docker Compose file. Deploy it in the same file as the Network Connector agent:

```
services:
  senhasegura-network-connector-agent:
    image: "registry.senhasegura.io/network-connector/agent-v2:latest"
    restart: unless-stopped
    networks:
      - senhasegura-network-connector
    environment:
      SENHASEGURA_FINGERPRINT: "FINGERPRINT_HERE"
      SENHASEGURA_AGENT_PORT: "PORT_HERE"
      SENHASEGURA_ADDRESSES: "SEGURA_IP"
      SENHASEGURA_AGENT_SECONDARY: "false"

  segura-kerberos-connect:
    image: registry.senhasegura.io/tools/kerberos-connect/kdc:latest
    environment:
      REALM: "MY.KERBEROS.REALM"
      KDC: "MYKDC.my.kerberos.realm"
      KDC_PORT: "88"           # Optional, defaults to 88
    ports:
      - "51088:51088"
    restart: unless-stopped
    networks:
      - senhasegura-network-connector
    # Root filesystem locked down; only these tmpfs are writable
    read_only: true
    tmpfs:
      - /run:rw,nosuid,nodev,mode=1777
      - /tmp:rw,nosuid,nodev,mode=1777
      - /var/cache/nginx:rw,nosuid,nodev,uid=65532,gid=65532,mode=0750
    # Minimize kernel privileges
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    # Contain blast radius
    pids_limit: 100
    mem_limit: 256m
    cpus: "0.50"
    # Avoid interactive shells by default
    stdin_open: false
    tty: false
    # Mount the TLS certificate and key
    volumes:
      - $PATH_TO_CERTIFICATE:/run/secrets/tls.crt:ro
      - $PATH_TO_KEY:/run/secrets/tls.key:ro

networks:
  senhasegura-network-connector:
    driver: bridge
```

Set the following values for the `segura-kerberos-connect` service:

Info

The Network Connector agent fields (`SENHASEGURA_FINGERPRINT`, `SENHASEGURA_AGENT_PORT`, and `SENHASEGURA_ADDRESSES`) are covered in [How to install Network Connector](/v4.2/docs/network-connector-how-to-install-network-connector).
  - `REALM`: your Kerberos realm. Replace the example `MY.KERBEROS.REALM`.
  - `KDC`: the KDC hostname. Replace the example `MYKDC.my.kerberos.realm`.
  - `KDC_PORT`: the KDC port. Defaults to `88`; change it only if your KDC uses another port.
  - `$PATH_TO_CERTIFICATE` and `$PATH_TO_KEY`: the paths to the TLS certificate and key you extracted in Step 3.
  - `51088`: the port the container exposes. Change it only if it conflicts with another service.
5. On the Docker host, start the services:

```
docker compose up -d
```

## Verify your results

Confirm that the container is running:

```
docker compose ps
```

The `segura-kerberos-connect` service is listed as running. Segura™ Platform can now change Windows credential passwords over Kerberos through the Network Connector. To configure a credential and run the change, see [Change a password over Kerberos through the Network Connector](/v4-2/docs/execution-how-to-change-a-password-over-kerberos-through-the-network-connector).