Bug 623694 - When kdc is configured to accept only des-cbc-crc encryption type, the client authenticating against the server cannot login, because kdc claims the encryption is not supported
Summary: When kdc is configured to accept only des-cbc-crc encryption type, the client...
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: krb5
Version: 6.0
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Nalin Dahyabhai
QA Contact: BaseOS QE Security Team
Keywords: RHELNAK
Depends On:
TreeView+ depends on / blocked
Reported: 2010-08-12 14:30 UTC by Martin Osvald 🛹
Modified: 2018-10-27 12:43 UTC (History)
6 users (show)

Clone Of:
Last Closed: 2010-08-18 15:42:02 UTC

Attachments (Terms of Use)

Description Martin Osvald 🛹 2010-08-12 14:30:43 UTC
Description of problem:

When using Kerberos for authentication on RHEL 6 with KDC limited to des-cbc-crc console and ssh logon events fail even though kinit functions.

Version-Release number of selected component (if applicable):

RHEL 6 Beta 2 Refresh

How reproducible:


Steps to Reproduce:
1. Configure KDC to accept only des-cbc-crc encryption type.
2. Configure RHEL 6 Beta 2 client to authenticate against above server.
3. Add allow_weak_crypto = true option to libdefaults section of krb5.conf
4. Set tgs and tkt enctypes to des-cbc-crc.

Actual results:

Attempt to log into the RHEL 6 system via console or ssh. Logon will fail. Log messages on client will contain message KDC has no support for encryption type.

Expected results:

The client should be able to log in.

Additional info:

This issue may or may not be related to Red Hat Bugtracker ID 613682. 

There appears to be a major change in behavior in the RHEL 6 Kerberos client implementation. The des-cbc-crc encryption type is rejected by default and all functionality is broken until the allow_weak_crypto option is set. Once that option is set kinit works normally and kadmin can be used to install a keytab but logon events continue to fail. According to our KDC admins the logon events are logged as attempting encryption types 18 17 16 23. To me this says that either pam.krb5 or the kerberos client libraries are ignoring the encryption configuration in krb5.conf when processing logon events via PAM.

Comment 2 RHEL Product and Program Management 2010-08-12 14:37:54 UTC
This issue has been proposed when we are only considering blocker
issues in the current Red Hat Enterprise Linux release.

** If you would still like this issue considered for the current
release, ask your support representative to file as a blocker on
your behalf. Otherwise ask that it be considered for the next
Red Hat Enterprise Linux release. **

Comment 3 Nalin Dahyabhai 2010-08-12 15:56:49 UTC
Could you please attach your client and KDC configuration files?

Comment 13 Denise Dumas 2010-08-18 15:42:02 UTC
Thanks Travis! Based on Travis' comment 12, closing this NOTABUG

Note You need to log in before you can comment on or make changes to this bug.