Bug 57847

Summary:	Incompatible encryption types in config files
Product:	[Retired] Red Hat Linux	Reporter:	Jason Heiss <jheiss-bugzilla>
Component:	krb5	Assignee:	Nalin Dahyabhai <nalin>
Status:	CLOSED RAWHIDE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.3	CC:	chris.ricker, dkelson, k.georgiou, mail, steve
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	1.4.2-2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-08-31 20:35:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jason Heiss 2001-12-27 23:58:05 UTC

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.4)
Gecko/20011126 Netscape6/6.2.1

Description of problem:
The kdc.conf config file from the krb5-server RPM does not specify
des3-hmac-sha1 as a supported encryption type, but that seems to be one of
the two default encryption types used by clients (the other being
des-cbc-crc) if not specifically configured in krb5.conf.

The results in decryption failures when setting up principles for
cron jobs, database replication to slave KDCs, etc.

In addition, the kdc.conf supplied with RH specifies des-cbc-crc
as the master_key_type while the stock kdc.conf from MIT for Kerberos 1.2.2
specifies des3-hmac-sha1.

Changing master_key_type and supported_enctypes to the values from a stock
MIT kdc.conf fixed all of the issues I was having (and I got a stronger
encryption type for the master key while I was at it).

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1.  Create master KDC by changing EXAMPLE.COM and example.com in krb5.conf
and kdc.conf, then run kdb5_util create -s
2.  Create host principles for master and slave KDCs and setup keytabs
3.  Add entry for master KDC host principal to kpropd.acl on slave KDC
4.  Run kdb5_util dump to dump database to a file
5.  Attempt to run kprop and receive encryption error

Expected Results:  kprop should have been able to decrypt whatever key it
is using and transfer database to slave KDC

Additional info:

The values from a stock MIT kdc.conf work great, I'd recommend them unless
there is a particular reason the RH kdc.conf is setup the way it is.

Comment 1 Chris Ricker 2002-06-11 23:04:02 UTC

I'm seeing this as well.  This bug is still present in RH 7.3

Comment 2 Steven Pritchard 2004-07-18 18:01:15 UTC

On FC2, master_key_type is set to des-cbc-crc, and supported_enctypes  
includes a long list.  Other than defaulting to a perhaps not 
terribly secure encryption type, it looks like this bug is fixed.

Comment 3 Dax Kelson 2004-09-21 05:47:53 UTC

It would be nice if the master_key_type was changed to the default
used by both MIT and Heimdal, the one in the original (shockingly
old!) bug report -- des3-hmac-sha1.