[33485] in Kerberos
cross-realm with windows 2k3 ad
daemon@ATHENA.MIT.EDU (Mark Davies)
Thu Jun 16 16:34:31 2011
From: Mark Davies <mark@ecs.vuw.ac.nz>
To: kerberos@mit.edu
Date: Fri, 17 Jun 2011 08:34:14 +1200
MIME-Version: 1.0
Message-Id: <201106170834.14683.mark@ecs.vuw.ac.nz>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
We have previously successfully set up cross-realm between our
heimdal
realm and a windows server 2008 r2 based AD domain, but I'm now
trying
to set up cross-realm to a 2k3 based AD domain and having problems.
On the windows side, they have entered our realm in lowercase which
may cause some issues at some point but I don't think I'm getting
far
enough to strike that yet.
If I kinit a user principle from the windows domain then try to ssh
into one of our machines it fails with "KDC has no support for
encryption type"
icon% kinit daviesma@STAFF.VUW.AC.NZ
daviesma@STAFF.VUW.AC.NZ's Password:
icon% klist -v
Credentials cache: FILE:/tmp/krb5cc_XXX
Principal: daviesma@STAFF.VUW.AC.NZ
Cache version: 4
Server: krbtgt/STAFF.VUW.AC.NZ@STAFF.VUW.AC.NZ
Client: daviesma@STAFF.VUW.AC.NZ
Ticket etype: arcfour-hmac-md5, kvno 2
Ticket length: 1192
Auth time: Jun 16 12:37:55 2011
End time: Jun 16 22:37:55 2011
Renew till: Jun 23 12:37:55 2011
Ticket flags: pre-authent, initial, renewable, forwardable
Addresses: addressless
icon% ssh -v debretts
[...]
debug1: Miscellaneous failure (see text)
KDC has no support for encryption type
[...]
wireshark shows me that its sending a TGS-REQ to the AD KDC
for the cross realm tgt krbtgt/ECS.VUW.AC.NZ@STAFF.VUW.AC.NZ
with encryption types: aes256-cts-hmac-sha1-96 aes128-cts-hmac-
sha1-96
des3-cdc-sha rc4-hmac
and that the KDC is returning KRB5KDC_ERR_ETYPE_NOSUPP
surely the rc4-hmac type should be supported?
What is going on here?
cheers
mark
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
