Description of problem:

When using Kerberos for authentication on RHEL 6 with KDC limited to des-cbc-crc console and ssh logon events fail even though kinit functions.


Version-Release number of selected component (if applicable):

RHEL 6 Beta 2 Refresh


How reproducible:

Always


Steps to Reproduce:
1. Configure KDC to accept only des-cbc-crc encryption type.
2. Configure RHEL 6 Beta 2 client to authenticate against above server.
3. Add allow_weak_crypto = true option to libdefaults section of krb5.conf
4. Set tgs and tkt enctypes to des-cbc-crc.

  
Actual results:

Attempt to log into the RHEL 6 system via console or ssh. Logon will fail. Log messages on client will contain message KDC has no support for encryption type.


Expected results:

The client should be able to log in.


Additional info:

This issue may or may not be related to Red Hat Bugtracker ID 613682. 

There appears to be a major change in behavior in the RHEL 6 Kerberos client implementation. The des-cbc-crc encryption type is rejected by default and all functionality is broken until the allow_weak_crypto option is set. Once that option is set kinit works normally and kadmin can be used to install a keytab but logon events continue to fail. According to our KDC admins the logon events are logged as attempting encryption types 18 17 16 23. To me this says that either pam.krb5 or the kerberos client libraries are ignoring the encryption configuration in krb5.conf when processing logon events via PAM.