> Date: Fri, 14 Sep 2012 13:41:04 EDT
> To: [email protected]
> From: "Martin B. Smith" <[email protected]>
> Subject: Encryption type troubles
>
> Hi all,
>
> I'm trying to debug a problem where I've specifically asked for an=20
> encryption type that I know my principal has an entry for, but I still=20
> fail to get a ticket, and I am not getting a lot of good information=20
> about what's happening. I'll describe the situation below, and I'd=20
> welcome any feedback about the problem itself or how to gather more=20
> information.
>
> Thanks!
>
> I've got a principal configured like so:
>
> Number of keys: 6
> Key: vno 27, DES with HMAC/sha1, no salt
> Key: vno 27, DES cbc mode with RSA-MD5, no salt
> Key: vno 27, DES cbc mode with CRC-32, Version 4
> Key: vno 27, DES cbc mode with CRC-32, AFS version 3
> Key: vno 27, Triple DES cbc mode with HMAC/sha1, no salt
> Key: vno 27, ArcFour with HMAC/md5, no salt
> Attributes: REQUIRES_PRE_AUTH
2 things,
1 try reordering the enc types. You want strongest first,
weakest last. I don't think that matters much here,
but it's a good general practice.
2 check your krbtgt key types (and any other service tickets
you want to get.) You won't be able to get a service ticket
for a given enc type if the service doesn't have a key for
that enc type. (It will probably always be encrypted
with the *first* key - which is where and why the principal
key order matters.)
-Marcus Watts
________________________________________________
Kerberos mailing list [email protected]
https://mailman.mit.edu/mailman/listinfo/kerberos
