On Wed, May 5, 2021 at 3:27 PM Jeremy Monnet jmonnet@gmail.com wrote:
[root@hostname sssd]# kinit -V -k Using new cache: persistent:0:krb_ccache_PECiZeh Using principal: host/fqdn@DOMAIN kinit: Client 'host/fqdn@domain' not found in Kerberos database while getting initial credentials
You cannot knit against host/fqdn unless sAMAccountName was set to host/fqdn when the host was joined to AD.
[root@hostname sssd]# kinit -V -k HOSTNAME$ Using new cache: persistent:0:krb_ccache_cFLtQ1H Using principal: HOSTNAME$@DOMAIN kinit: Keytab contains no suitable keys for HOSTNAME$@DOMAIN while getting initial credentials
This may mean that the KDC does not support the aes encryption types (only rc4-hmac). You can test this by logging in as a normal user with a valid TGT and running:
$ kvno -e aes256-cts-hmac-sha1-96 'HOSTNAME$' $ kinit $ kvno -e aes128-cts-hmac-sha1-96 'HOSTNAME$' $ kinit $ kvno -e arcfour-hmac 'HOSTNAME$'
(The kinit commands are to flush any successfully-acquired service ticket; if the preceding kvno command fails, you can skip them.)
We have added krb5_validate = False in sssd.conf and [libdefaults] allow_weak_crypto = true default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5 default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5 permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc des-cbc-md5 in krb5.conf
If you mean you literally edited /etc/krb5.conf, then this will not work, because the "includedir" directive at the top of /etc/krb5.conf will read the configuration files in the /etc/krb5.conf.d first, and the crypto-policies file will set permitted_enctypes to whatever the system-wide crypto policy is. Because the first setting wins, by the time your settings in /etc/krb5.conf are parsed, permitted_enctypes has already been set and your attempt to override it will (silently!) fail.
You should restore the package default /etc/krb5.conf file and perform any overrides in a separate file in /etc/krb5.conf.d, selecting a filename that will sort lexicographically before the other files; e.g., create /etc/krb5.conf.d/50-override with:
[libdefaults] permitted_enctypes = aes rc4
If the problem is that your AD only supports rc4, then performing "kinit -V -k 'HOSTNAME$'" should then succeed.