permitted_enctypes = "des-cbc-crc" triggers 'kinit: Generic error (see e-text) while getting initial credentials'

[Benjamin Kaduk]

On Thu, 20 Mar 2014, Wendy Lin wrote:

> I have this in my Suse 11.3 /etc/krb.conf for libdefaults:
>
>        allow_weak_crypto = true
> #       permitted_enctypes = "des-cbc-crc arcfour-hmac des3-cbc-sha1
> aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96"
>        permitted_enctypes = "des-cbc-crc"
>
> Now if I try to kinit I get this error:
>
> kinit
> kinit: Generic error (see e-text) while getting initial credentials

If your client is only trying to use des-cbc-crc (a bad idea, see RFC 
6649) but the KDC does not have a key for your principal of that enctype, 
attempting to get a ticket cannot succeed -- there is no key that both 
parties will use to secure the communication.

-Ben Kaduk