[22503] in Kerberos
Re: UNIX GSS-API / Windows SSPI :
daemon@ATHENA.MIT.EDU (Norbert Klasen)
Mon Sep 20 10:29:38 2004
Date: Mon, 20 Sep 2004 15:18:15 +0200
From: Norbert Klasen <norbert+lists.mit-kerberos@burgundy.dyndns.org>
To: kerberos@mit.edu
Message-ID: <DDD9B336B07B396A44B7450D@[10.110.20.166]>
In-Reply-To: <414B4B17.3000906@nyc.rr.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Errors-To: kerberos-bounces@mit.edu
--On Freitag, 17. September 2004 20:35 +0000 Jeffrey Altman
<jaltman2@nyc.rr.com> wrote:
> Jacques Lebastard wrote:
>
>> How can I check this and, second question, how can I generate a keytab
>> with RC4-HMAC encryption ? The ktpass tool does not accept the RC4-HMAC
>> crypto type:
>>
>> [- /] crypto : Cryptosystem to use
>> [- /] crypto : is one of:
>> [- /] crypto : DES-CBC-CRC : for compatibility
>> [- /] crypto : DES-CBC-MD5 : default
>>
>> Trying '-crypto RC4-HMAC' indicates that the SPN is marked for DES only
>> ! How can I modify this ?
>>
>> Thanks for your help,
>
> You need to use the KTPASS.EXE from the SUPPORT folder of Windows 2003
> SP1 pre-release in order to generate a keytab with RC4-HMAC.
If you don't need a separate service account you can use Samba >= 3.0.6.
and join the host into your AD domain. With "use kerberos keytab = yes" in
smb.conf, Samba will populate your keytab with all known enc-types:
2 des3-cbc-sha1 host/brittany.ad.local@AD.LOCAL
2 des3-cbc-md5 host/linux.ad.local@AD.LOCAL
2 arcfour-hmac-md5 host/linux.ad.local@AD.LOCAL
2 des-cbc-md5 host/linux.ad.local@AD.LOCAL
2 des-cbc-md4 host/linux.ad.local@AD.LOCAL
2 des-cbc-crc host/linux.ad.local@AD.LOCAL
2 des3-cbc-sha1 cifs/linux.ad.local@AD.LOCAL
[..]
The keytab can be managed (e.g. add another principal) with "net ads
keytab".
Norbert
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
