[19673] in Kerberos_V5_Development
Re: Incompatibility between krb's AES256-CTS-HMAC-SHA1-96 and
daemon@ATHENA.MIT.EDU (Isaac Boukris)
Tue Oct 31 11:59:32 2017
MIME-Version: 1.0
In-Reply-To: <CAC-fF8TBSKR07pZ4ik6T9tzzwr+yBcH0JTCH70dhvU2mQ2bjzA@mail.gmail.com>
From: Isaac Boukris <iboukris@gmail.com>
Date: Tue, 31 Oct 2017 17:59:20 +0200
Message-ID: <CAC-fF8S=sUt5A3uD5qTgU1hH_iiTP5AGJ-1r4_+TDBWtgYrHPg@mail.gmail.com>
To: Ido Shlomo <shloim@gmail.com>
Cc: krbdev@mit.edu, Simo Sorce <simo@redhat.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Tue, Oct 31, 2017 at 5:47 PM, Isaac Boukris <iboukris@gmail.com> wrote:
> On Tue, Oct 31, 2017 at 4:44 PM, Ido Shlomo <shloim@gmail.com> wrote:
>> Since this is an automated task, I cannot generate anything outside the
>> machine.
>> Is it possible to specify the salt using ktutil?
>
> You can try an AS request where the KDC tells the salt, like:
> # KRB5_TRACE=/dev/tty kinit principal
>
> btw, for user-account in AD the salt is the UPN attribute of the user.
Sorry, I misread the question, thought you were asking how to find the
actual salt.
I am not familiar with such option in ktutil, though according to the
source code the recent version of it does provide this option
(alternatively, you can use the same code that ktutil uses and specify
the salt).
Regards.
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
