Bug 2005277

.Kerberos now only requests permitted encryption types Previously, RHEL did not apply permitted encryption types specified in the `permitted_enctypes` parameter in the `/etc/krb5.conf` file if the `default_tgs_enctypes` or `default_tkt_enctypes` parameters were not set. Consequently, Kerberos clients were able to request deprecated cipher suites, such as RC4, which might cause other processes to fail. With this update, RHEL applies the encryption types set in `permitted_enctypes` to the default encryption types as well, and processes can only request permitted encryption types. If you use Red Hat Identity Management (IdM) and want to set up a trust with Active Directory (AD), note that the RC4 cipher suite, which is deprecated in RHEL 8, is the default encryption type for users, services, and trusts between AD domains in an AD forest. You can use one of the following options: * (Preferred): Enable strong AES encryption types in AD. For details, see the link:https://support.microsoft.com/en-us/help/4492348/kerberos-unsupported-etype-error-when-authenticating-across-trust[AD DS: Security: Kerberos "Unsupported etype" error when accessing a resource in a trusted domain] Microsoft article. * Use the `update-crypto-policies --set DEFAULT:AD-SUPPORT` command on RHEL hosts that should be members of an AD domain to enable the deprecated RC4 encryption type for backwards compatibility with AD.