Description of problem:
When using Kerberos for authentication on RHEL 6 with KDC limited to des-cbc-crc console and ssh logon events fail even though kinit functions.
Version-Release number of selected component (if applicable):
RHEL 6 Beta 2 Refresh
Steps to Reproduce:
1. Configure KDC to accept only des-cbc-crc encryption type.
2. Configure RHEL 6 Beta 2 client to authenticate against above server.
3. Add allow_weak_crypto = true option to libdefaults section of krb5.conf
4. Set tgs and tkt enctypes to des-cbc-crc.
Attempt to log into the RHEL 6 system via console or ssh. Logon will fail. Log messages on client will contain message KDC has no support for encryption type.
The client should be able to log in.
This issue may or may not be related to Red Hat Bugtracker ID 613682.
There appears to be a major change in behavior in the RHEL 6 Kerberos client implementation. The des-cbc-crc encryption type is rejected by default and all functionality is broken until the allow_weak_crypto option is set. Once that option is set kinit works normally and kadmin can be used to install a keytab but logon events continue to fail. According to our KDC admins the logon events are logged as attempting encryption types 18 17 16 23. To me this says that either pam.krb5 or the kerberos client libraries are ignoring the encryption configuration in krb5.conf when processing logon events via PAM.
This issue has been proposed when we are only considering blocker
issues in the current Red Hat Enterprise Linux release.
** If you would still like this issue considered for the current
release, ask your support representative to file as a blocker on
your behalf. Otherwise ask that it be considered for the next
Red Hat Enterprise Linux release. **
Could you please attach your client and KDC configuration files?
Thanks Travis! Based on Travis' comment 12, closing this NOTABUG