Bug 800542

Summary:	Need way to obtain DES keys for older NFS
Product:	Red Hat Enterprise Linux 6	Reporter:	Dmitri Pal <dpal>
Component:	doc-Identity_Management_Guide	Assignee:	Deon Ballard <dlackey>
Status:	CLOSED CURRENTRELEASE	QA Contact:	ecs-bugs
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.3	CC:	jskeoch, mkosek
Target Milestone:	rc	Keywords:	Documentation
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-06-21 23:15:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Dmitri Pal 2012-03-06 17:02:18 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/2471

DES is completely disabled in 2.2 servers. We need a way to be able to generate DES keys at least for older NFS clients and servers.

I tried adding allow_weak_crypto = yes to libdefaults of the IPA server krb5.conf and adding support for the enc type but was still unable to use ipa-getkeytab from a RHEL-5 client.

I added this to LDAP:
dn: cn=$REALM,cn=kerberos,dc=greyoak,dc=com
krbSupportedEncSaltTypes: des-cbc-crc:normal
krbSupportedEncSaltTypes: des-cbc-crc:special
krbDefaultEncSaltTypes: des-cbc-crc:special

Comment 2 Deon Ballard 2012-05-03 16:34:36 UTC

Setting all priority and severity to medium.

Comment 5 Deon Ballard 2012-06-21 23:15:09 UTC

Closing.