Re: Migrating away from single DES
ProbaNet SRLS <[email protected]>
| Newsgroups | gmane.comp.file-systems.openafs.general |
|---|---|
| Organization | ProbaNet SRLS |
| Message-ID | <[email protected]> |
Il 14/09/20 12:11, Andreas Ladanyi ha scritto: > Rekey your AFS Server(s). > Have a look at this document: > https://www.openafs.org/pages/security/how-to-rekey.txt > An interesting discussion about "how-to-rekey.txt": > https://openafs-info.openafs.narkive.com/PVFdhGZD/afs-principal-rekeying-instructions-may-be-incomplete > Thank you, I'll take a read! Stefano > > Am 14.09.20 um 10:32 schrieb ProbaNet SRLS: >> Hello! >> >> Â Â Â Â Recent releases of krb5 (> 1.18) no longer support single des >> encryption (the "allow_weak_crypto = yes" option in krb5.conf client >> side has no longer effect), so now we get this error with "aklog -d": >> >> --- >> >> Kerberos error code returned by get_cred : -1765328370 >> aklog: Couldn't get XXXXX AFS tickets: >> aklog: KDC has no support for encryption type while getting AFS tickets >> >> --- >> >> How should we proceed? >> >> >> Stefano >> >> __ -- ProbaNet s.r.l.s. p.i. - c.f. 02453890200 tel. +39.333.9897553 fax. +39.0376.1850161 - email [email protected] <mailto:[email protected]> via Brusca, 12, 46030 Bigarello (MN)