<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<font face="Bitstream Cyberbit">Douglas E. Engert wrote:</font><br>
<blockquote cite="mid40115252.E8008A68@anl.gov" type="cite">
<pre wrap=""><font face="Bitstream Cyberbit">The afternoon, I believe. I will install the morning one again just to make sure.
</font></pre>
</blockquote>
thanks. I am going to use the one from the morning unless we can prove
your theory.<br>
<blockquote cite="mid40115252.E8008A68@anl.gov" type="cite">
<pre wrap=""></pre>
<pre wrap=""><font face="Bitstream Cyberbit">If I upgrade the one host in question to krb5-1.3.x and don't use the "default_*_enctypes"
I believe it works. The KRB5.ANL.GOV KDC is still at 1.2.8. I am willing to update
it, but would like to use 1.3.2 to avoid multiple updates.
The point being that the release notes for KfW may want to warn against
using the "default_*_enctypes, and may require krb5-1.3.x on hosts?
</font></pre>
</blockquote>
The issue is specifically due to the importation of the tickets from
the LSA ccache<br>
which produces a DES session key but a RC4 encryption key. The MSLSA
ccache code<br>
does not pay attention to the default_*_enctypes. <br>
<br>
I think there were some other issues with default_*_enctypes that made
them undesireable.<br>
(cc'd to krbcore in case there are others who can comment.)<br>
<br>
- Jeff<br>
<br>
</body>
</html>