[28976] in Kerberos
Re: GSSAPI on Linux using Windows AD Servers as KDCs - Errors about
daemon@ATHENA.MIT.EDU (Jason D. McCormick)
Mon Jan 7 10:59:21 2008
Message-ID: <47824C28.7040004@devrandom.org>
Date: Mon, 07 Jan 2008 10:58:32 -0500
From: "Jason D. McCormick" <jason@devrandom.org>
MIME-Version: 1.0
To: "Douglas E. Engert" <deengert@anl.gov>
In-Reply-To: <47824B4A.9050102@anl.gov>
Cc: "Richard E. Silverman" <res@qoxp.net>, kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Douglas E. Engert wrote:
> The problem might be that on the AD account the UserAccountControl flag
> does not have the USE_DES_KEY_ONLY 0x200000 set, So AD is returning an
> ArcFour ticket, which is not in the keytab. ktpass has a /DESOnly option
> to set this.
>
> See kb 305144 too.
I'll give that a shot, thanks.
> Why are you using DES? All the newer Kerberos can use ArcFour. So try
> ktpass witout the crypto option.
Do you know if the Linux NFSv4 stuff can use ArcFour? I've only been
able to find (older - circa '06) docs that state the only working type
is des-cbc-crc.
- Jason
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
