Bug 623694

Summary:	When kdc is configured to accept only des-cbc-crc encryption type, the client authenticating against the server cannot login, because kdc claims the encryption is not supported
Product:	Red Hat Enterprise Linux 6	Reporter:	Martin Osvald 🛹 <mosvald>
Component:	krb5	Assignee:	Nalin Dahyabhai <nalin>
Status:	CLOSED NOTABUG	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	6.0	CC:	borgan, ddumas, dpal, jplans, jwest, tao
Target Milestone:	rc	Keywords:	RHELNAK
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-08-18 15:42:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Martin Osvald 🛹 2010-08-12 14:30:43 UTC

Description of problem:

When using Kerberos for authentication on RHEL 6 with KDC limited to des-cbc-crc console and ssh logon events fail even though kinit functions.


Version-Release number of selected component (if applicable):

RHEL 6 Beta 2 Refresh


How reproducible:

Always


Steps to Reproduce:
1. Configure KDC to accept only des-cbc-crc encryption type.
2. Configure RHEL 6 Beta 2 client to authenticate against above server.
3. Add allow_weak_crypto = true option to libdefaults section of krb5.conf
4. Set tgs and tkt enctypes to des-cbc-crc.

  
Actual results:

Attempt to log into the RHEL 6 system via console or ssh. Logon will fail. Log messages on client will contain message KDC has no support for encryption type.


Expected results:

The client should be able to log in.


Additional info:

This issue may or may not be related to Red Hat Bugtracker ID 613682. 

There appears to be a major change in behavior in the RHEL 6 Kerberos client implementation. The des-cbc-crc encryption type is rejected by default and all functionality is broken until the allow_weak_crypto option is set. Once that option is set kinit works normally and kadmin can be used to install a keytab but logon events continue to fail. According to our KDC admins the logon events are logged as attempting encryption types 18 17 16 23. To me this says that either pam.krb5 or the kerberos client libraries are ignoring the encryption configuration in krb5.conf when processing logon events via PAM.

Comment 2 RHEL Program Management 2010-08-12 14:37:54 UTC

This issue has been proposed when we are only considering blocker
issues in the current Red Hat Enterprise Linux release.

** If you would still like this issue considered for the current
release, ask your support representative to file as a blocker on
your behalf. Otherwise ask that it be considered for the next
Red Hat Enterprise Linux release. **

Comment 3 Nalin Dahyabhai 2010-08-12 15:56:49 UTC

Could you please attach your client and KDC configuration files?

Comment 13 Denise Dumas 2010-08-18 15:42:02 UTC

Thanks Travis! Based on Travis' comment 12, closing this NOTABUG