From: Josh Tanski <mortonjt@rochester.rr.com>
To: Stephen Frost <sfrost@snowman.net>
Cc: pgsql-admin@postgresql.org
Subject: Re: 8.4 to 9.1 Upgrade Kerberos Auth Stops Working "Wrong principal in request"
Date: Fri, 31 May 2013 13:50:23 -0400
Message-ID: <51A8E2DF.4010803@rochester.rr.com> (raw)
In-Reply-To: <20130531124648.GW6434@tamriel.snowman.net>
References: <51A89A1A.8040405@rochester.rr.com>
<20130531124648.GW6434@tamriel.snowman.net>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
On 5/31/2013 8:46 AM, Stephen Frost wrote:
> That key type (des-cbc-md5) has looonngggg been deprecated and has
> been actively disabled and disallowed from use in modern Kerberos
> libraries.
>
> Please go get an AES256 key and install that instead.
>
Thanks - that was one of my fears - I just double checked and ktpass on
Windows 2000 only gives me DES-CBC-CRC and DES-CBC-MD5 as crypto
options, it won't accept AES256-SHA1. I already did have
allow_weak_crypto on and a Group Policy for Windows 7 clients which did
get it to work & cannot migrate from Windows 2000 just yet...
Josh
>> root@ss-sv-tmp40:~# cat /etc/krb5.conf
>> [libdefaults]
>> default_realm = MYDOMAIN.LOCAL
>> allow_weak_crypto = true
>> <snip>
>>
--
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: mortonjt@rochester.rr.com, sfrost@snowman.net
Subject: Re: 8.4 to 9.1 Upgrade Kerberos Auth Stops Working "Wrong principal in request"
In-Reply-To: <51A8E2DF.4010803@rochester.rr.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox