How does one remove an encryption type from a kerberos principal?

Posted by 84104 on Server Fault See other posts from Server Fault or by 84104
Published on 2013-07-24T22:48:13Z Indexed on 2013/11/01 21:58 UTC
Read the original article Hit count: 302

Filed under:

kerberos

|

mitkerberos

I would like to remove all of the des keys from the principal below, but have no idea how to do so without someone inputting the password.

kadmin:  getprinc user
Principal: [email protected]
Expiration date: [never]
Last password change: Thu May 26 08:52:51 PDT 2013
Password expiration date: [none]
Maximum ticket life: 0 days 12:00:00
Maximum renewable life: 7 days 00:00:00
Last modified: Tue Jul 16 15:17:18 PDT 2013 (administrator/[email protected])
Last successful authentication: Wed Jul 24 14:40:53 PDT 2013
Last failed authentication: [never]
Failed password attempts: 0
Number of keys: 8
Key: vno 3, aes256-cts-hmac-sha1-96, no salt
Key: vno 3, arcfour-hmac, no salt
Key: vno 3, des3-cbc-sha1, no salt
Key: vno 3, des-cbc-crc, no salt
Key: vno 3, des-cbc-md5, no salt
Key: vno 3, des-cbc-md5, Version 5 - No Realm
Key: vno 3, des-cbc-md5, Version 5 - Realm Only
Key: vno 3, des-cbc-md5, AFS version 3
MKey: vno 2
Attributes: REQUIRES_PRE_AUTH
Policy: [none]

Also, the the kdc is using an OpenLDAP backend.

© Server Fault or respective owner

Related posts about kerberos

NFS (with Kerberos) mount failing due to "Server not found in Kerberos database" error

as seen on Server Fault - Search for 'Server Fault'
When running: `sudo mount -t nfs4 -o sec=krb5 sol.domain.com:/ /mnt` I get this error on the client: mount.nfs4: access denied by server while mounting sol.domain.com:/ And on the server syslogs UNKNOWN_SERVER: authtime 0, nfs/[email protected] for nfs/ip-#-#-#-#.ec2.internal@SOL… >>> More
Enabling Kerberos Authentication for Reporting Services

as seen on SQL Blogcasts - Search for 'SQL Blogcasts'
Recently, I’ve helped several customers with Kerberos authentication problems with Reporting Services and Analysis Services, so I’ve decided to write this blog post and pull together some useful resources in one place (there are 2 whitepapers in particular that I found invaluable configuring Kerberos… >>> More
Relative security of SAML vs Kerberos

as seen on Server Fault - Search for 'Server Fault'
Does anyone have any info/links on the relative security of SAML vs Kerberos. I believe I grasp the differences between the two, and what they mean for my particular application, but to decided between the two, knowing which is more secure, if either, would be a valuable bit of info. >>> More
Confusion about Kerberos, delegation and SPNs.

as seen on Server Fault - Search for 'Server Fault'
I already posted this question on SO, but the nature of it is between programming and server configuration, so I'll re-post it here as well. I'm trying to write a proof-of-concept application that performs Kerberos delegation. I've written all the code, and it seems to working (I'm authenticating… >>> More
Kerberos & signle-sign-on for website

as seen on Server Fault - Search for 'Server Fault'
I have a website running on a Linux computer using Apache. I've employed mod_auth_kerb for single-sign-on Kerberos authentication against a Windows Active Directory server. In order for Kerberos to work correctly, I've created a service account in Active Directory called dummy. I've generated a… >>> More

Related posts about mitkerberos

Linking Linux MIT Kerberos with a Windows 2003 Active Directory

as seen on Server Fault - Search for 'Server Fault'
Greetings, I was wondering how one might link a Linux MIT Kerberos with a Windows 2003 Active Directory to achieve the following: A user, [email protected], attempts to log in at an Apache website, which runs on the same server as the Linux MIT Kerberos. The Apache module first asks… >>> More
Single Sign On for intranet with Apache and Linux MIT Kerberos

as seen on Server Fault - Search for 'Server Fault'
Greetings, I am looking for a way to do a single sign on to an intranet in the following manner: A Linux user logs on via a graphical frontend (for example, GNOME). He automatically requests a TGT for his username from the MIT Kerberos KDC. Via some way or another, the Apache server (which we'll… >>> More
[SOLVED] Single Sign On for intranet with Apache and Linux MIT Kerberos

as seen on Server Fault - Search for 'Server Fault'
EDIT: SOLVED! See my answer below. Greetings, I am looking for a way to do a single sign on to an intranet in the following manner: A Linux user logs on via a graphical frontend (for example, GNOME). He automatically requests a TGT for his username from the MIT Kerberos KDC. Via some way or another… >>> More
Which kerberos flavor?

as seen on Server Fault - Search for 'Server Fault'
So I'm setting up a small network with all the standard stuff (files, email, etc.) and I've decided to go with a Kerberos+LDAP solution. Any ideas or recommendations on Heimdal vs. MIT? I've used MIT before, and tangentially Heimdal, but I don't really know of any real reason for using one over the… >>> More
How does one remove an encryption type from a kerberos principal?

as seen on Server Fault - Search for 'Server Fault'
I would like to remove all of the des keys from the principal below, but have no idea how to do so without someone inputting the password. kadmin: getprinc user Principal: [email protected] Expiration date: [never] Last password change: Thu May 26 08:52:51 PDT 2013 Password expiration date: [none] Maximum… >>> More