[28248] in Kerberos
Re: Using keytab on Windows with KfW
daemon@ATHENA.MIT.EDU (Markus Moeller)
Sun Aug 12 18:00:18 2007
To: kerberos@mit.edu
From: "Markus Moeller" <huaraz@moeller.plus.com>
Date: Sun, 12 Aug 2007 22:59:30 +0100
Message-ID: <f9nvsp$ohn$1@sea.gmane.org>
X-Complaints-To: usenet@sea.gmane.org
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
I would have prefered that too, but some bugs on the Windows side required
the fixed enc types to get the cross realm working. The windows kdc replied
with unsupported enctype if rc4 wasn't the first enc type in the list. I
don't understand why I needed to fix it in this case though. The MIT kdc is
configured with
supported_enctypes = rc4-hmac:normal des3-cbc-sha1:normal
des-cbc-crc:normal des-cbc-md5:normal
kdc_supported_enctypes = rc4-hmac:normal
des3-cbc-sha1:normal des-cbc-crc:normal des-cbc-md5:normal
in kdc.conf and on my kfw client I had no enctype configured. Why did the
interactive kinit work and with the keytab not ?
It only worked after adding
default_tgs_enctypes = rc4-hmac des3-cbc-sha1 des-cbc-crc des-cbc-md5
default_tkt_enctypes = rc4-hmac des3-cbc-sha1 des-cbc-crc
des-cbc-md5
permitted_enctypes = rc4-hmac des3-cbc-sha1 des-cbc-crc des-cbc-md5
to krb5.ini
Markus
"Christopher D. Clausen" <cclausen@acm.org> wrote in message
news:f9nkq0$bni$1@news.ks.uiuc.edu...
> Markus Moeller <huaraz@moeller.plus.com> wrote:
>> Thanks for the pointer. I thought I fixed the enctypes in krb5.ini
>> too, but copied it under the domain_realm section instead of
>> libdefaults. (The default krb5.ini didn't have the same order as my
>> krb5.conf )
>
> I'd strongly suggest NOT specifying enc_types anywhere. The newer krb5
> libs are smart enough to use the "best" encryption supported by themselves
> and the KDC and the application server. Manually specifying them just
> causes things to break, as you just saw.
>
> <<CDC
>
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
