[SSSD-users] Re: RHEL 8.3 KDC has no support for encryption type

[Jeremy Monnet]

Hi,
> To allow all the old (weak) RHEL7 crypto ciphers (like 3des-cbc and arcfour-hmac).
>
> It's not advisable to leave crypto-polcies at LEGACY -- that accepts some truly weak ciphers.

You are right, only I do not decide the AD version used... 2012R2 is
still supported by Microsoft, so people are not eager to migrate to
2016 or 2019. That brings me to another question :
- Is there a reference to supported ciphers, eg will rhel without
enabling weak ciphers will work out of the box with an AD 2016 (that
could another argument to upgrade) ?

And yes you are right, the issue is pure kerberos, sssd just sits on top...

Regards,

Jeremy