[33488] in Kerberos
Re: cross-realm with windows 2k3 ad
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Fri Jun 17 14:08:38 2011
Message-ID: <4DFB9821.4010906@anl.gov>
Date: Fri, 17 Jun 2011 13:08:33 -0500
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: kerberos@mit.edu
In-Reply-To: <201106161307.51747.mark@ecs.vuw.ac.nz>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 6/15/2011 8:07 PM, Mark Davies wrote:
> We have previously successfully set up cross-realm between our heimdal
> realm and a windows server 2008 r2 based AD domain, but I'm now trying
> to set up cross-realm to a 2k3 based AD domain and having problems.
>
> On the windows side, they have entered our realm in lowercase which
> may cause some issues at some point but I don't think I'm getting far
> enough to strike that yet.
>
> If I kinit a user principle from the windows domain then try to ssh
> into one of our machines it fails with "KDC has no support for
> encryption type"
>
> icon% kinit daviesma@STAFF.VUW.AC.NZ
> daviesma@STAFF.VUW.AC.NZ's Password:
> icon% klist -v
> Credentials cache: FILE:/tmp/krb5cc_XXX
> Principal: daviesma@STAFF.VUW.AC.NZ
> Cache version: 4
>
> Server: krbtgt/STAFF.VUW.AC.NZ@STAFF.VUW.AC.NZ
> Client: daviesma@STAFF.VUW.AC.NZ
> Ticket etype: arcfour-hmac-md5, kvno 2
> Ticket length: 1192
> Auth time: Jun 16 12:37:55 2011
> End time: Jun 16 22:37:55 2011
> Renew till: Jun 23 12:37:55 2011
> Ticket flags: pre-authent, initial, renewable, forwardable
> Addresses: addressless
>
> icon% ssh -v debretts
> [...]
> debug1: Miscellaneous failure (see text)
> KDC has no support for encryption type
> [...]
>
>
> wireshark shows me that its sending a TGS-REQ to the AD KDC
> for the cross realm tgt krbtgt/ECS.VUW.AC.NZ@STAFF.VUW.AC.NZ
> with encryption types: aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
> des3-cdc-sha rc4-hmac
> and that the KDC is returning KRB5KDC_ERR_ETYPE_NOSUPP
>
> surely the rc4-hmac type should be supported?
Yes it should be. But when you setup the cross realm trust,
did W2K3 assume the MIT realm could only do DES?
Id the des-only bit on in the TGT account in AD?
DES is off by default in most Kerberos and W2008.
> What is going on here?
>
> cheers
> mark
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
>
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
