[Bug 1195871] Re: net ads join does not provide AES keys in host keytab

[Adam Koczur]

This is also affecting samba 3.6.3 in 12.04

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to samba in Ubuntu.
https://bugs.launchpad.net/bugs/1195871

Title:
   net ads join does not provide AES keys in host keytab

Status in Samba:
  Fix Released
Status in “samba” package in Ubuntu:
  Confirmed
Status in “samba” package in Fedora:
  Unknown

Bug description:
  Ubuntu 12.10 and 13.04

  Samba 3.6.9 configured to manage keytab ('kerberos method = secrets
  and keytab').

  When joining an AD domain (`net ads join`) the keytab is created
  without AES keys, but instead includes only des-cbc-crc, des-cbc-md5,
  and arcfour-hmac keys.

  This causes kinit using the machine keys to fail.  To make it work
  /etc/krb5.conf needs to be modified to include:

    default_tkt_enctypes = rc4-hmac des-cbc-crc des-cbc-md5
    default_tgs_enctypes = rc4-hmac des-cbc-crc des-cbc-md5

  in [libdefaults] section.

  This has already been fixed upstream in Samba 3.6.10.

To manage notifications about this bug go to:
https://bugs.launchpad.net/samba/+bug/1195871/+subscriptions