Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtp (Exim 4.72) (envelope-from
	<pgsql-admin-owner+M41166=pgsql+2Dadmin=arkaria.postgresql.org@postgresql.org>)
	id 1UiTTC-0004CQ-UK
	for pgsql-admin@arkaria.postgresql.org; Fri, 31 May 2013 17:50:31 +0000
Received: from localhost ([127.0.0.1] helo=postgresql.org)
	by malur.postgresql.org with smtp (Exim 4.72) (envelope-from
	<pgsql-admin-owner+M41166=pgsql+2Dadmin=arkaria.postgresql.org@postgresql.org>)
	id 1UiTTC-0007ur-Az
	for pgsql-admin@arkaria.postgresql.org; Fri, 31 May 2013 17:50:30 +0000
Received: from makus.postgresql.org ([2001:4800:7903:4::125])
	by malur.postgresql.org with esmtp (Exim 4.72)
	(envelope-from <mortonjt@rochester.rr.com>) id 1UiTTB-0007um-Gg
	for pgsql-admin@postgresql.org; Fri, 31 May 2013 17:50:29 +0000
Received: from eu1sys200aog112.obsmtp.com ([207.126.144.133])
	by makus.postgresql.org with smtp (Exim 4.80)
	(envelope-from <mortonjt@rochester.rr.com>) id 1UiTT8-0006YK-TZ
	for pgsql-admin@postgresql.org; Fri, 31 May 2013 17:50:28 +0000
Received: from salthub.morton.com ([74.201.1.161]) by
	eu1sys200aob112.postini.com ([207.126.147.11]) with SMTP
	ID DSNKUaji4F3tBcpCi3wIVHaK56f7mEJ+1y7N@postini.com;
	Fri, 31 May 2013 17:50:26 UTC
Received: from mail ([10.203.105.14])
	by salthub.morton.com (Lotus Domino Release 8.5.3)
	with SMTP id 2013053112502289-141870 ;
	Fri, 31 May 2013 12:50:22 -0500
Received: from [127.0.0.1] (oljdt.mortonss109.local [10.203.105.196])
	by mail (Postfix) with ESMTPS id 8163734E04C;
	Fri, 31 May 2013 13:50:23 -0400 (EDT)
Message-ID: <51A8E2DF.4010803@rochester.rr.com>
Date: Fri, 31 May 2013 13:50:23 -0400
From: Josh Tanski <mortonjt@rochester.rr.com>
User-Agent: Mozilla/5.0 (Windows NT 5.1;
	rv:17.0) Gecko/20130509 Thunderbird/17.0.6
MIME-Version: 1.0
To: Stephen Frost <sfrost@snowman.net>
Cc: pgsql-admin@postgresql.org
Subject: Re: 8.4 to 9.1 Upgrade Kerberos Auth Stops Working "Wrong
	principal in request"
References: <51A89A1A.8040405@rochester.rr.com>
	<20130531124648.GW6434@tamriel.snowman.net>
In-Reply-To: <20130531124648.GW6434@tamriel.snowman.net>
X-MIMETrack: Itemize by SMTP Server on salthub/salt/morton(Release
	8.5.3|September 15, 2011) at 05/31/2013 12:50:22,
	Serialize by Router on salthub/salt/morton(Release 8.5.3|September 15,
	2011) at 05/31/2013 12:50:25,
	Serialize complete at 05/31/2013 12:50:25
X-TNEFEvaluated: 1
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
X-Pg-Spam-Score: -0.8 (/)
List-Archive: <http://archives.postgresql.org/pgsql-admin>
List-Help: <mailto:majordomo@postgresql.org?body=help>
List-ID: <pgsql-admin.postgresql.org>
List-Owner: <mailto:pgsql-admin-owner@postgresql.org>
List-Post: <mailto:pgsql-admin@postgresql.org>
List-Subscribe: <mailto:majordomo@postgresql.org?body=sub%20pgsql-admin>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
X-Mailing-List: pgsql-admin
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

On 5/31/2013 8:46 AM, Stephen Frost wrote:
>    That key type (des-cbc-md5) has looonngggg been deprecated and has
>    been actively disabled and disallowed from use in modern Kerberos
>    libraries.
>
>    Please go get an AES256 key and install that instead.
>


Thanks - that was one of my fears - I just double checked and ktpass on 
Windows 2000 only gives me DES-CBC-CRC and DES-CBC-MD5 as crypto 
options, it won't accept AES256-SHA1.  I already did have 
allow_weak_crypto on and a Group Policy for Windows 7 clients which did 
get it to work & cannot migrate from Windows 2000 just yet...

Josh


>> root@ss-sv-tmp40:~# cat /etc/krb5.conf
>> [libdefaults]
>>          default_realm = MYDOMAIN.LOCAL
>>          allow_weak_crypto = true
>> <snip>
>>



-- 
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin