9a0372d992
Samba clients are often machine accounts with non-default salts that will fail if they can't use the AES encryption type they know the KDC supports. The problem is that arcfour-hmac-md5 has no salt so was being used in preference. Samba started to fail when kdc_config->preauth_use_strongest_session_key = true; was forced into the KDC configuration. The history here is an attempt to avoid Kerberos v4 salts in des-cbc-crc keys, but this instead broke Samba clients with AES-keys on machine accounts as these have a non-default salt by default. These accounts were incorrectly restricted to arcfour-hmac-md5 and they didn't like that. A broader fix than Samba commit 8e1efd8bd3bf698dc0b6ed2081919f49b1412b53 REF: https://lists.samba.org/archive/samba/2021-October/237844.html Samba BUG: https://bugzilla.samba.org/show_bug.cgi?id=14864 Change-Id: Ia8908a5a2eef107e6b133d7f0e4343c1988c18bb
Heimdal
Heimdal is an implementation of:
- ASN.1/DER,
- PKIX, and
- Kerberos.
For information how to install see here.
There are man pages for most of the commands.
Bug reports and bugs are appreciated. Use GitHub issues.
For more information see the project homepage https://heimdal.software/heimdal/ or the mailing lists:
heimdal-announce@heimdal.software low-volume announcement heimdal-discuss@heimdal.software high-volume discussion
send mail to heimdal-announce-subscribe@heimdal.software and heimdal-discuss-subscribe@heimdal.software respectively to subscribe.
Build Status
