I have troubles while creating keytabs for user.
Keytabs are working only when I have rc4-hmac encryption enabled

[root@host ~]# klist -kte test_user.keytab_rc4
Keytab name: FILE:test_user.keytab_rc4
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
   0 09/01/2018 14:54:07 test_user@testdomain.dev (arcfour-hmac)
[root@host]# kinit -V -kt test_user.keytab_rc4 test_user@testdomain.dev
Using default cache: /tmp/krb5_1015
Using principal: test_user@testdomain.dev
Using keytab: test_user.keytab_rc4
Authenticated to Kerberos v5
[root@host ~]# klist 
Ticket cache: FILE:/tmp/krb5_1015
Default principal: test_user@testdomain.dev

Valid starting       Expires              Service principal
10/08/2018 09:10:40  10/08/2018 19:10:40  krbtgt/testdomain.dev@testdoman.dev
        renew until 10/15/2018 09:10:40
[root@host ~]# kdestroy

If I'm trying to authenticate with keytab that contains any other encryption

[root@host ~]# klist -kte test_user.keytab_aes256
Keytab name: FILE:test_user.keytab_aes256
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
   0 09/01/2018 14:57:07 test_user@testdomain.dev (aes256-cts-hmac-sha1-96)

Or multiple encryption types

[root@host ~]# klist -kte test_user.keytab_rc4_aes256
Keytab name: FILE:test_user.keytab_rc4_aes256
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
   0 09/01/2018 14:57:07 test_user@testdomain.dev (arcfour-hmac)
   0 09/01/2018 14:57:07 test_user@testdomain.dev (aes256-cts-hmac-sha1-96)
[root@host ~]# kinit -V -kt test_user.keytab_rc4_aes256 test_user@testdomain.dev
Using default cache: /tmp/krb5_1015
Using principal: test_user@testdomain.dev
Using keytab: test_user.keytab_rc4_aes256
kinit: Preauthentication failed while getting initial credentials

it fails

All keytabs where created with same ktutil from CentOS:

[root@host ~]# ktutil
ktutil: add_entry -password -p test_user@testdomain.dev -k 0 -e arcfour-hmac
Password for test_user@testdomain.dev:
ktutil: wkt test_user.keytab_rc4
  • Kerberos Server: Microsoft Active Directory 2012 with latest updates
  • Tested encryption types that are not working :
    • des3-cbc-sha1
    • aes128-cts-hmac-sha1-96
    • aes256-cts-hmac-sha1-96
    • dec-cbc-md5
  • Kerberos client: CentOS 7.4 with latest updates.

First, all enctypes except arcfour-hmac use the realm name as part of the key salt. To derive the correct key from password, you must use exactly the same realm as the KDC uses. This usually means it needs to be uppercase (despite UPNs being lowercase).

Additionally, aes128-cts… and aes256-cts… enctypes may need to be enabled per account (and possibly globally in the domain controller as well) – see the linked Microsoft documentation.

As for DES: des-cbc… must not be used: single-DES is trivial to crack even on a PC. (On the other hand, Triple-DES des3-cbc… is simply not supported by Windows Server.)

(arcfour-hmac simply uses the NTLM password hash as its "key"; it was retrofitted to Kerberos. Therefore its keysalt does not include the realm.)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.