problem with pam_krb5 4.2-1

[Russ Allbery]

Rohit Kumar Mehta <rohitm at engr.uconn.edu> writes:

> Hi guys, in upgrading some Ubuntu systems from Karmic (libpam-krb5 
> 3.15-1) to Lucid (libpam-krb5 4.2-1) I discovered a problem.

> SSH authentication would fail with pam_krb5 the error:
> "credential verification failed: KDC has no support for encryption type"

> However kinit username at REALM worked fine, as did kerberized NFS mounts.  
> I found that if I removed my krb5.keytab things ssh authentication also 
> worked.

Chances are, your system keytab only has DES keys.  Either download a new
keytab that has more enctypes or add:

    allow_weak_crypto = true

to the [libdefaults] section of your krb5.conf.

> I'm also wondering why my krb5.keytab is not accepted by pam_krb5.
> Could it be because I am authenticating in the realm=AD.ENGR.UCONN.EDU
> and the principals in the keytab are in the realm=ENGR.UCONN.EDU?

If your system keytab is fine, then it may be that the cross-realm key
only has DES keys, but I bet it's your system keytab.

-- 
Russ Allbery (rra at stanford.edu)             <http://www.eyrie.org/~eagle/>