CANT_FIND_CLIENT_KEY

[Matt Zagrabelny]

On Tue, 2010-03-30 at 14:13 -0700, Russ Allbery wrote:
> Matt Zagrabelny <mzagrabe at d.umn.edu> writes:
> 
> > Through some trial-and-error I am currently getting the following error
> > in the kdc.log:
> 
> > AS_REQ (1 etypes {1}) 10.25.1.14: CANT_FIND_CLIENT_KEY:
> > mzagrabe at D.UMN.EDU for krbtgt/D.UMN.EDU at D.UMN.EDU, KDC has no support
> > for encryption type
> 
> > I assume the encryption type is (1) des-cbc-crc.
> 
> > How do I make the KDC have support for the encryption type? It looks
> > like I already have it:
> 
> Add:
> 
> [libdefaults]
>     allow_weak_crypto = true

Thanks for the quick help, Russ. Still the same problem, though.

# grep -B1 allow_weak_crypto /etc/krb5.conf
[libdefaults]
    allow_weak_crypto = true

# /etc/init.d/krb5-kdc restart

% telnet blah...

AS_REQ (1 etypes {1}) 10.25.1.14: CANT_FIND_CLIENT_KEY:
mzagrabe at D.UMN.EDU for krbtgt/D.UMN.EDU at D.UMN.EDU, KDC has no support
for encryption type


Any other ideas?


-- 
Matt Zagrabelny - mzagrabe at d.umn.edu - (218) 726 8844
University of Minnesota Duluth
Information Technology Systems & Services
PGP key 4096R/42A00942 2009-12-16
Fingerprint: 5814 2CCE 2383 2991 83FF  C899 07E2 BFA8 42A0 0942

He is not a fool who gives up what he cannot keep to gain what he cannot
lose.
-Jim Elliot
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part
Url : http://mailman.mit.edu/pipermail/kerberos/attachments/20100330/451c84fd/attachment.bin