Hi Greg, On Mon, Aug 08, 2016 at 01:39:49PM -0400, Greg Hudson wrote: > On 08/05/2016 02:48 PM, Michael Howe wrote: > > When a client has an existing (forwardable) ticket, and the krbtgt is > > rekeyed with -keepold, most things keep working. However, if that > > ticket is used with SSH using GSSAPIDelegateCredentials=yes it seems to > > make the forwarded ticket unusable - the KDC returns 'Bad encryption > > type' whenever it's used. (I've not tested other applications that > > might forward credentials.) > > I can reproduce this bug under 1.12 (the version of krb5 in Debian > Jessie) but not master. I believe it to be a previously unknown > manifestation of > http://krbdev.mit.edu/rt/Ticket/Display.html?id=8139 > which was previously believed to only affect S4U2Proxy operations. That > bug was fixed in 1.14. > > The fix for this bug is fairly invasive, so it wouldn't be easy to put > together a safe backport. I think it would be possible to work around > the bug by ignoring errors from krb5_c_verify_checksum() in > kdc_authdata.c:verify_ad_signedpath_checksum().
Thanks for confirming that - nice to know it's not because of something crazy we've done on our side. I've tested with 1.14, and that does indeed fix things. As it's only required on the KDCs, and 1.14 in Debian is trivially backportable to run on Debian stable, I'm happy to use it to solve the problem, particularly if the fix is invasive. That said, I might raise a Debian bug anyway, so the maintainers are aware (and anyone else encountering the issue can find it more easily). Michael -- Michael Howe, Infrastructure and Hosting Team Systems Development and Support IT Services, University of Oxford ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos
