Re: aklog: unknown RPC error (-1765328370) while getting AFS tickets

Jose M Calhariz <[email protected]> Mon, 12 Sep 2022 16:49:47 +0100

Newsgroups	gmane.comp.file-systems.openafs.general
Message-ID	<[email protected]>

On Mon, Sep 12, 2022 at 02:28:01PM +0000, [email protected] wrote:
> The error means that the server does not support the requested encryption type.
> 
> You may have a look here for the list of krb5 error codes:
> https://www.netmeister.org/blog/krb5-error-codes-table.html
> 
> If you run MIT kerberos, you can run aklog as:
> $ KRB5_TRACE=/dev/stderr aklog
> 
> which should present you with a detailed trace of the kerberos communication. It could help you find out which server denies the request and what else has been tried by the client.
>

Thank you both.  This is a problem of encryption types, yes.

Todo the setup of the cell I was following the instrtuctions from
Debian 9.  So I have done:

kadmin.local
addprinc -randkey -e des-cbc-crc:v4 afs
ktadd -k /root/afs.keytab -e des-cbc-crc:v4 afs
getprinc afs
quit

and later:


asetkey add <kvno> /root/afs.keytab afs



But I am seing the aklog requesting:

[5785] 1662996087.387118: Generated subkey for TGS request: aes256-cts/AA29
[5785] 1662996087.387435: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts, des-cbc-crc, des, des-cbc-md4


My OpenAFS is 1.6.20-2+deb9u2


> Kind regards,
> –Michael
> _______________________________________________
> OpenAFS-info mailing list
> [email protected]
> https://lists.openafs.org/mailman/listinfo/openafs-info
> 


Kind regards
Jose M Calhariz



-- 
--

Os homens não ficam mais espertos com a idade. Apenas perdem mais cabelos

--Preston Sturges

signature.asc (application/pgp-signature, 833 B)