[Bug 1195871] Re: net ads join does not provide AES keys in host keytab

[Sebastien Bacher]

That's fixed in the current version

** Changed in: samba (Ubuntu)
   Importance: Undecided => High

** Changed in: samba (Ubuntu)
       Status: Confirmed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to samba in Ubuntu.
https://bugs.launchpad.net/bugs/1195871

Title:
   net ads join does not provide AES keys in host keytab

Status in samba:
  Fix Released
Status in samba package in Ubuntu:
  Fix Released
Status in samba package in Fedora:
  Unknown

Bug description:
  Ubuntu 12.10 and 13.04

  Samba 3.6.9 configured to manage keytab ('kerberos method = secrets
  and keytab').

  When joining an AD domain (`net ads join`) the keytab is created
  without AES keys, but instead includes only des-cbc-crc, des-cbc-md5,
  and arcfour-hmac keys.

  This causes kinit using the machine keys to fail.  To make it work
  /etc/krb5.conf needs to be modified to include:

    default_tkt_enctypes = rc4-hmac des-cbc-crc des-cbc-md5
    default_tgs_enctypes = rc4-hmac des-cbc-crc des-cbc-md5

  in [libdefaults] section.

  This has already been fixed upstream in Samba 3.6.10.

To manage notifications about this bug go to:
https://bugs.launchpad.net/samba/+bug/1195871/+subscriptions