[25154] in Kerberos
Re: Key version number for principal in key table is incorrect -
daemon@ATHENA.MIT.EDU (Jeffrey Altman)
Wed Dec 21 12:18:24 2005
From: Jeffrey Altman <jaltman2@nyc.rr.com>
Message-ID: <cKfqf.8720$Ed.322@news-wrt-01.rdc-nyc.rr.com>
Date: Wed, 21 Dec 2005 16:51:20 GMT
To: kerberos@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Please learn to properly quote messages from other people.
sandypossible@gmail.com wrote:
> Hi ,
>
> There should be no reason why you want or need to restrict the
> enctypes in a krb5.conf file. Doing so will only create a severe
> maintenance problem once you realize that DES encryption is too weak
> for continued use.
>>> Do you mean that there is no need to specify the default_xxx_enctypes in conf file ?
> Could you please confirm ?
confirmed.
>
> What command line did you use?
>>> c:\>ktpass -princ sample/linux.kerb.com@KERB.COM -mapuser sample -pass <password> -out sample.keytab
>
> This is because you did not specify the correct kvno value when you
> executed ktpass.exe. Before executing ktpass.exe using the "kvno"
> tool to determine what key version number is being issued by Active
> Directory.
>>> I tried to use kvno on windows 2003 to find the version number, but it was asking for ccache. I didnt know what to give for ccache. Could you please tell me how to use it ?
Install MIT Kerberos for Windows.
Execute "kinit <principal>" where <principal> is a client principal for
which you know the password and can obtain a TGT. This will create for
you a credential cache.
kvno will not ask you for a credential cache unless it cannot find one
with a valid TGT.
"kvno sample/linux.kerb.com@KERB.COM"
will report the key version number of the service ticket for
"sample/linux.kerb.com@KERB.COM" it was able to obtain using the TGT for
<principal> obtained above.
Jeffrey Altman
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
