[OpenAFS] Re: OpenAFS 1.7.26 windows and not changed AFS service principle -
Fri, 26 Jul 2013 09:51:11 -0500
On Fri, 26 Jul 2013 14:07:46 +0200
Lars Schimmer <firstname.lastname@example.org> wrote:
> Ok, now with access to such a machine:
> Etype (skey, tkt): AES-256 CTS mode with 96-bit SHA-1 HMAC, AES-256 CTS
> mode with 96-bit SHA-1 HMAC
> Etype /skey, tkt): DES cbc mode with CRC-32, AES-256 CTS mode with
> 96-bit SHA-1 HMAC
> On the working machine the AES-256 CTS is also some kind of DES.
> Interesting why one of three get 2 DES and non AES....
Are you sure you have the "DES-only" account option set? Can you show
what the userAccountControl and msDS-SupportedEncryptionTypes fields are
for that account in LDAP? (You can see this either using ldapsearch from
a unix machine if you don't know how in windows) Do you know what
version of Windows Server this is?
If the "des-only" attribute is set for the account, it looks like it's
not being honored.