Fedora 31: Samba DC: "setup_kerberos_keys: generation of a des-cbc-md5 key failed: Bad encryption type"

[Dario Lesca]

I have fill this bug: 
https://bugzilla.redhat.com/show_bug.cgi?id=1757071

This error happen into my test Samba DC MIT Kerberos environment 
If you suggest to me some trick I can test it

Thanks

[Robbie Harwood]

Dario Lesca  writes:
> I have fill this bug: 
> https://bugzilla.redhat.com/show_bug.cgi?id=1757071
>
> This error happen into my test Samba DC MIT Kerberos environment 
> If you suggest to me some trick I can test it

Single-DES support has been removed from krb5 as per
https://fedoraproject.org/wiki/Changes/krb5_crypto_modernization

I invite you to peruse https://tools.ietf.org/html/rfc6649 ; single-DES
is *NOT SECURE*.  You can find information on migrating at
https://web.mit.edu/kerberos/krb5-latest/doc/admin/advanced/retiring-des.htm...

Thanks,
--Robbie

[Alexander Bokovoy]

On ma, 30 syys 2019, Dario Lesca wrote:
> I have fill this bug:
> https://bugzilla.redhat.com/show_bug.cgi?id=1757071
>
> This error happen into my test Samba DC MIT Kerberos environment
> If you suggest to me some trick I can test it

There is no a trick yet because DES is deprecated and removed in the
recent MIT Kerberos code. It has been deprecated since 2012.

Fedora 31:
https://fedoraproject.org/wiki/Changes/krb5_crypto_modernization

Isaac Boukris is working on fixing Samba:
https://gitlab.com/samba-team/devel/samba/commits/iboukris_no_des_mit_118
but this is work in progress and does not pass full tests yet.

[Dario Lesca]

Il giorno lun, 30/09/2019 alle 18.37 +0300, Alexander Bokovoy ha scritto:
> Isaac Boukris is working on fixing Samba:
> https://gitlab.com/samba-team/devel/samba/commits/iboukris_no_des_mit_118
>
> but this is work in progress and does not pass full tests yet.

Ok, thanks.