+++ This bug was initially created as a clone of Bug #498316 +++
Description of problem:
The current in kernel implementation of the NFS Server and Client can't use any other key types but the DES key type.
DES keys have been long deprecated, all major Kerberos KDC implementation either already disable generation of kerberos keys by default or are going to.
DES keys are also not considered safe by Government Agencies regulations, and can't probably be used without explicit exemptions.
Acceptable key types would be RC4 and AES (probably also DES3).
Raising priority.
*please* get this going, it is really important, we can't ship 6.0 without supporting any good encryption. DES is dead and is being removed from all major krb implementations (it is also disabled by default in AD since always).
Created attachment 397405[details]
Tar file of kernel patches and nfs-utils patches
Here is a tar file containing the original patches, those patches
ported to Fedora, a large patch containing all of the smaller
patches, and the nfs-utils patches to rpc.gssd and rpc.svcgssd
which are required.
Comment 10Aristeu Rozanski
2010-04-20 19:43:23 UTC
*** Bug 583137 has been marked as a duplicate of this bug. ***
Comment 17releng-rhel@redhat.com
2010-11-11 16:00:44 UTC
Red Hat Enterprise Linux 6.0 is now available and should resolve
the problem described in this bug report. This report is therefore being closed
with a resolution of CURRENTRELEASE. You may reopen this bug report if the
solution does not work for you.