Bug 36542

Summary:	Heimdal ignores default_tgs_enctypes, default_tkt_enctypes and permitted_enctypes
Product:	UCS	Reporter:	Arvid Requate <requate>
Component:	Kerberos	Assignee:	Arvid Requate <requate>
Status:	CLOSED FIXED	QA Contact:	Felix Botner <botner>
Severity:	normal
Priority:	P5	CC:	gohmann
Version:	UCS 4.2	Keywords:	interim-3
Target Milestone:	UCS 4.3
Hardware:	Other
OS:	Linux
See Also:	https://forge.univention.org/bugzilla/show_bug.cgi?id=46292 https://forge.univention.org/bugzilla/show_bug.cgi?id=45822
What kind of report is it?:	Development Internal	What type of bug is this?:	---
Who will be affected by this bug?:	---	How will those affected feel about the bug?:	---
User Pain:		Enterprise Customer affected?:
School Customer affected?:		ISV affected?:
Waiting Support:		Flags outvoted (downgraded) after PO Review:
Ticket number:		Bug group (optional):	Cleanup
Max CVSS v3 score:

Description Arvid Requate

2014-11-10 15:30:31 CET

In /etc/krb5.conf we set

default_tgs_enctypes, default_tkt_enctypes and permitted_enctypes

From heimdal/lib/krb5/verify_krb5_conf.c it seems that these are ignored or at least MIT specific. The man page suggests that "default_tgs_etypes" is evaluated instead.

We should check if the current settings in /etc/krb5.conf have any effect at all or if they should be removed or adjusted to current Heimdal behaviour.

Comment 1 Stefan Gohmann

2017-06-16 20:39:09 CEST

This issue has been filed against UCS 3. UCS 3 is out of the normal maintenance and many UCS components have vastly changed in UCS 4.

If this issue is still valid, please change the version to a newer UCS version otherwise this issue will be automatically closed in the next weeks.

Comment 2 Arvid Requate

2018-02-15 18:55:42 CET

Fixed for Bug #46292 by setting the Heimdal specific options (default_etypes, default_tgs_etypes and default_as_etypes) too.

Comment 3 Felix Botner

2018-02-16 11:37:49 CET

FAIL -changelog?

OK - 4.3 master + 4.2 s4 backup works
OK - correct enctype options in 4.3 
      aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, arcfour-hmac-md5,
      des-cbc-crc, des-cbc-md5, des-cbc-md4, des3-cbc-sha1

Comment 4 Arvid Requate

2018-02-16 12:21:28 CET

Ok, I've added an entry to the release changelog.

Comment 5 Felix Botner

2018-02-16 12:23:24 CET

OK

Comment 6 Stefan Gohmann

2018-03-14 14:38:11 CET

UCS 4.3 has been released:
 https://docs.software-univention.de/release-notes-4.3-0-en.html
 https://docs.software-univention.de/release-notes-4.3-0-de.html

If this error occurs again, please use "Clone This Bug".