Greetings, I sent an email to the list a week regarding issues with a cisco switch in an MIT Kerberos realm.
Through some trial-and-error I am currently getting the following error
in the kdc.log:
AS_REQ (1 etypes {1}) 10.25.1.14: CANT_FIND_CLIENT_KEY:
[email protected] for krbtgt/[email protected], KDC has no support
for encryption type
I assume the encryption type is (1) des-cbc-crc.
How do I make the KDC have support for the encryption type? It looks
like I already have it:
% cat /etc/krb5kdc/kdc.conf
[kdcdefaults]
kdc_ports = 750,88
[realms]
D.UMN.EDU = {
database_name = /var/lib/krb5kdc/principal
admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
acl_file = /etc/krb5kdc/kadm5.acl
key_stash_file = /etc/krb5kdc/stash
kdc_ports = 750,88
max_life = 10h 0m 0s
max_renewable_life = 7d 0h 0m 0s
master_key_type = des3-hmac-sha1
supported_enctypes = aes256-cts:normal arcfour-hmac:normal
des3-hmac-sha1:normal des3-cbc-md5:normal des-cbc-crc:normal des:normal
des:v4 des:norealm des:onlyrealm des:afs3
default_principal_flags = +preauth
}
That is, des-cbc-crc:normal is in the above list of
"supported_enctypes".
Thanks for any help,
--
Matt Zagrabelny - [email protected] - (218) 726 8844
University of Minnesota Duluth
Information Technology Systems & Services
PGP key 4096R/42A00942 2009-12-16
Fingerprint: 5814 2CCE 2383 2991 83FF C899 07E2 BFA8 42A0 0942
He is not a fool who gives up what he cannot keep to gain what he cannot
lose.
-Jim Elliot
signature.asc
Description: This is a digitally signed message part
________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
