Keytabs generation issue

Question

I have troubles while creating keytabs for user.
Keytabs are working only when I have rc4-hmac encryption enabled

[root@host ~]# klist -kte test_user.keytab_rc4
Keytab name: FILE:test_user.keytab_rc4
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
   0 09/01/2018 14:54:07 [email protected] (arcfour-hmac)
[root@host]# kinit -V -kt test_user.keytab_rc4 [email protected]
Using default cache: /tmp/krb5_1015
Using principal: [email protected]
Using keytab: test_user.keytab_rc4
Authenticated to Kerberos v5
[root@host ~]# klist 
Ticket cache: FILE:/tmp/krb5_1015
Default principal: [email protected]

Valid starting       Expires              Service principal
10/08/2018 09:10:40  10/08/2018 19:10:40  krbtgt/[email protected]
        renew until 10/15/2018 09:10:40
[root@host ~]# kdestroy

If I'm trying to authenticate with keytab that contains any other encryption

[root@host ~]# klist -kte test_user.keytab_aes256
Keytab name: FILE:test_user.keytab_aes256
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
   0 09/01/2018 14:57:07 [email protected] (aes256-cts-hmac-sha1-96)

Or multiple encryption types

[root@host ~]# klist -kte test_user.keytab_rc4_aes256
Keytab name: FILE:test_user.keytab_rc4_aes256
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
   0 09/01/2018 14:57:07 [email protected] (arcfour-hmac)
   0 09/01/2018 14:57:07 [email protected] (aes256-cts-hmac-sha1-96)
[root@host ~]# kinit -V -kt test_user.keytab_rc4_aes256 [email protected]
Using default cache: /tmp/krb5_1015
Using principal: [email protected]
Using keytab: test_user.keytab_rc4_aes256
kinit: Preauthentication failed while getting initial credentials

it fails

All keytabs where created with same ktutil from CentOS:

[root@host ~]# ktutil
ktutil: add_entry -password -p [email protected] -k 0 -e arcfour-hmac
Password for [email protected]:
ktutil: wkt test_user.keytab_rc4

• Kerberos Server: Microsoft Active Directory 2012 with latest updates
• Tested encryption types that are not working :
  • des3-cbc-sha1
  • aes128-cts-hmac-sha1-96
  • aes256-cts-hmac-sha1-96
  • dec-cbc-md5
• Kerberos client: CentOS 7.4 with latest updates.

Answer 1

First, all enctypes except arcfour-hmac use the realm name as part of the key salt. To derive the correct key from password, you must use exactly the same realm as the KDC uses. This usually means it needs to be uppercase (despite UPNs being lowercase).

Additionally, aes128-cts… and aes256-cts… enctypes may need to be enabled per account (and possibly globally in the domain controller as well) – see the linked Microsoft documentation.

As for DES: des-cbc… must not be used: single-DES is trivial to crack even on a PC. (On the other hand, Triple-DES des3-cbc… is simply not supported by Windows Server.)

(arcfour-hmac simply uses the NTLM password hash as its "key"; it was retrofitted to Kerberos. Therefore its keysalt does not include the realm.)