Bug 623694 - When kdc is configured to accept only des-cbc-crc encryption type, the client authenticating against the server cannot login, because kdc claims the encryption is not supported
When kdc is configured to accept only des-cbc-crc encryption type, the client...
Status: CLOSED NOTABUG
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: krb5 (Show other bugs)
6.0
All Linux
urgent Severity urgent
: rc
: ---
Assigned To: Nalin Dahyabhai
BaseOS QE Security Team
: RHELNAK
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2010-08-12 10:30 EDT by Martin Osvald
Modified: 2010-10-23 11:58 EDT (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-08-18 11:42:02 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Martin Osvald 2010-08-12 10:30:43 EDT
Description of problem:

When using Kerberos for authentication on RHEL 6 with KDC limited to des-cbc-crc console and ssh logon events fail even though kinit functions.


Version-Release number of selected component (if applicable):

RHEL 6 Beta 2 Refresh


How reproducible:

Always


Steps to Reproduce:
1. Configure KDC to accept only des-cbc-crc encryption type.
2. Configure RHEL 6 Beta 2 client to authenticate against above server.
3. Add allow_weak_crypto = true option to libdefaults section of krb5.conf
4. Set tgs and tkt enctypes to des-cbc-crc.

  
Actual results:

Attempt to log into the RHEL 6 system via console or ssh. Logon will fail. Log messages on client will contain message KDC has no support for encryption type.


Expected results:

The client should be able to log in.


Additional info:

This issue may or may not be related to Red Hat Bugtracker ID 613682. 

There appears to be a major change in behavior in the RHEL 6 Kerberos client implementation. The des-cbc-crc encryption type is rejected by default and all functionality is broken until the allow_weak_crypto option is set. Once that option is set kinit works normally and kadmin can be used to install a keytab but logon events continue to fail. According to our KDC admins the logon events are logged as attempting encryption types 18 17 16 23. To me this says that either pam.krb5 or the kerberos client libraries are ignoring the encryption configuration in krb5.conf when processing logon events via PAM.
Comment 2 RHEL Product and Program Management 2010-08-12 10:37:54 EDT
This issue has been proposed when we are only considering blocker
issues in the current Red Hat Enterprise Linux release.

** If you would still like this issue considered for the current
release, ask your support representative to file as a blocker on
your behalf. Otherwise ask that it be considered for the next
Red Hat Enterprise Linux release. **
Comment 3 Nalin Dahyabhai 2010-08-12 11:56:49 EDT
Could you please attach your client and KDC configuration files?
Comment 13 Denise Dumas 2010-08-18 11:42:02 EDT
Thanks Travis! Based on Travis' comment 12, closing this NOTABUG

Note You need to log in before you can comment on or make changes to this bug.