Red Hat Bugzilla – Bug 57847
Incompatible encryption types in config files
Last modified: 2007-04-18 12:38:50 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.4)
Description of problem:
The kdc.conf config file from the krb5-server RPM does not specify
des3-hmac-sha1 as a supported encryption type, but that seems to be one of
the two default encryption types used by clients (the other being
des-cbc-crc) if not specifically configured in krb5.conf.
The results in decryption failures when setting up principles for
cron jobs, database replication to slave KDCs, etc.
In addition, the kdc.conf supplied with RH specifies des-cbc-crc
as the master_key_type while the stock kdc.conf from MIT for Kerberos 1.2.2
Changing master_key_type and supported_enctypes to the values from a stock
MIT kdc.conf fixed all of the issues I was having (and I got a stronger
encryption type for the master key while I was at it).
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Create master KDC by changing EXAMPLE.COM and example.com in krb5.conf
and kdc.conf, then run kdb5_util create -s
2. Create host principles for master and slave KDCs and setup keytabs
3. Add entry for master KDC host principal to kpropd.acl on slave KDC
4. Run kdb5_util dump to dump database to a file
5. Attempt to run kprop and receive encryption error
Expected Results: kprop should have been able to decrypt whatever key it
is using and transfer database to slave KDC
The values from a stock MIT kdc.conf work great, I'd recommend them unless
there is a particular reason the RH kdc.conf is setup the way it is.
I'm seeing this as well. This bug is still present in RH 7.3
On FC2, master_key_type is set to des-cbc-crc, and supported_enctypes
includes a long list. Other than defaulting to a perhaps not
terribly secure encryption type, it looks like this bug is fixed.
It would be nice if the master_key_type was changed to the default
used by both MIT and Heimdal, the one in the original (shockingly
old!) bug report -- des3-hmac-sha1.