[33496] in Kerberos
Re: cross-realm with windows 2k3 ad
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Sun Jun 19 20:48:14 2011
Message-ID: <4DFE98C6.4020003@anl.gov>
Date: Sun, 19 Jun 2011 19:48:06 -0500
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: Mark Davies <mark@ecs.vuw.ac.nz>
In-Reply-To: <201106200006.58070.mark@ecs.vuw.ac.nz>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 6/19/2011 7:06 AM, Mark Davies wrote:
> On Saturday 18 June 2011 06:08:33 Douglas E. Engert wrote:
>>> surely the rc4-hmac type should be supported?
>>
>> Yes it should be. But when you setup the cross realm trust,
>> did W2K3 assume the MIT realm could only do DES?
>> Id the des-only bit on in the TGT account in AD?
>
> How does one check in AD? and change it if it is?
Check the userAccountControl attribute of the cross realm TGT
look for USE_DES_KEY_ONLY = 2097152, i.e. 0x200000
http://support.microsoft.com/kb/305144
>
>> DES is off by default in most Kerberos and W2008.
>
> That I knew, but don't know anything about the "des-only bit".
>
> cheers
> mark
>
>
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
