Bug 1877991

.DES and 3DES encryption types have been removed Due to security reasons, the Data Encryption Standard (DES) algorithm has been deprecated and disabled by default since RHEL 7. With the recent rebase of Kerberos packages, single-DES (DES) and triple-DES (3DES) encryption types have been removed from RHEL 8. If you have configured services or users to only use DES or 3DES encryption, you might experience service interruptions such as: * Kerberos authentication errors * `unknown enctype` encryption errors * Kerberos Distribution Centers (KDCs) with DES-encrypted Database Master Keys (`K/M`) fail to start Perform the following actions to prepare for the upgrade: . Check if your KDC uses DES or 3DES encryption with the `krb5check` open source Python scripts. See link:https://github.com/frozencemetery/krb5check[krb5check] on GitHub. . If you are using DES or 3DES encryption with any Kerberos principals, re-key them with a supported encryption type, such as Advanced Encryption Standard (AES). For instructions on re-keying, see link:https://web.mit.edu/kerberos/krb5-latest/doc/admin/advanced/retiring-des.html[Retiring DES] from MIT Kerberos Documentation. . Test independence from DES and 3DES by temporarily setting the following Kerberos options before upgrading: .. In `/var/kerberos/krb5kdc/kdc.conf` on the KDC, set `supported_enctypes` and do not include `des` or `des3`. .. For every host, in `/etc/krb5.conf` and any files in `/etc/krb5.conf.d`, set `allow_weak_crypto` to `false`. It is false by default. .. For every host, in `/etc/krb5.conf` and any files in `/etc/krb5.conf.d`, set `permitted_enctypes`, `default_tgs_enctypes`, and `default_tkt_enctypes`, and do not include `des` or `des3`. . If you do not experience any service interruptions with the test Kerberos settings from the previous step, remove them and upgrade. You do not need those settings after upgrading to the latest Kerberos packages.