Howto
This article describes how to restrict the Kerberos encryption types in a UCS environment using Heimdal Kerberos. The configuration permits only AES-256, AES-128, and RC4 and subsequently renews the keytab entries for the host and ldap principals.
Important: Before applying this procedure, verify that the system is not a Samba Active Directory Domain Controller. Do not use this procedure on a Samba AD DC or RODC.
1. Check and back up the current configuration
Run the following commands as root:
ucr get server/role
ucr get samba4/role
Expected output for server/role:
domaincontroller_master
ucr get samba4/roleshould return no value. If the system is a Samba AD DC or RODC, do not continue with this procedure.
Create a backup of the current Kerberos keytab and UCR configuration:
cp -a /etc/krb5.keytab /etc/krb5.keytab.before-enctype-test
ucr dump > /root/ucr-before-enctype-test.txt
Check the current keytab:
ktutil -k /etc/krb5.keytab list
2. Configure the permitted encryption types
The three Kerberos encryption type variables must contain the same encryption types. Otherwise, TGS and TGT operations can continue to use older DES or 3DES encryption types.
Define the permitted encryption types:
ENCTYPES="aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 arcfour-hmac-md5"
Configure the corresponding UCR variables:
ucr set kerberos/defaults/enctypes/permitted="$ENCTYPES"
ucr set kerberos/defaults/enctypes/tgs="$ENCTYPES"
ucr set kerberos/defaults/enctypes/tkt="$ENCTYPES"
ucr set kerberos/allow/weak/crypto="false"
The variables can also be set in a single command:
ucr set kerberos/defaults/enctypes/permitted="$ENCTYPES" kerberos/defaults/enctypes/tgs="$ENCTYPES" kerberos/defaults/enctypes/tkt="$ENCTYPES" kerberos/allow/weak/crypto="false"
Example output:
Setting kerberos/defaults/enctypes/permitted
Create kerberos/defaults/enctypes/tgs
Create kerberos/defaults/enctypes/tkt
Create kerberos/allow/weak/crypto
File: /etc/krb5.conf
3. Apply the Kerberos configuration
Regenerate /etc/krb5.conf:
ucr commit /etc/krb5.conf
Example output:
File: /etc/krb5.conf
Verify the resulting configuration:
grep -n -A10 -B3 enctypes /etc/krb5.conf
The configuration must contain the following three identical encryption type lists:
permitted_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 arcfour-hmac-md5
default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 arcfour-hmac-md5
default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 arcfour-hmac-md5
For example:
22- #
23- # The following libdefaults are for clients using the MIT Kerberos library
24- #
25: permitted_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 arcfour-hmac-md5
26: default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 arcfour-hmac-md5
27: default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 arcfour-hmac-md5
28-
29-[realms]
30-DEADPOOL.INTRANET = {
31- acl_file = /var/lib/heimdal-kdc/kadmind.acl
32- admin_server = ucs5primary.deadpool.intranet
33- kpasswd_server = ucs5primary.deadpool.intranet
34-}
35-[kdc]
36-hdb-ldap-create-base = cn=kerberos,dc=deadpool,dc=intranet
37-v4-realm = DEADPOOL.INTRANET
4. Restart the Kerberos service
Restart the Heimdal KDC:
systemctl restart heimdal-kdc
Verify its status:
systemctl status heimdal-kdc
If the service fails to start, stop the procedure and inspect the logs:
journalctl -u heimdal-kdc -b
5. Define the principals
For the example system ucs5primary.deadpool.intranet, define the host and LDAP principals as follows:
HOST_PRINCIPAL="host/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET"
LDAP_PRINCIPAL="ldap/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET"
For systems with a different hostname or Kerberos realm, adjust these values accordingly.
6. Generate new keys for the host principal
Generate new random keys for the host principal:
kadmin -l cpw -r "$HOST_PRINCIPAL"
Export the principal to the keytab:
kadmin -l ext "$HOST_PRINCIPAL"
7. Generate new keys for the LDAP principal
Generate new random keys for the LDAP principal:
kadmin -l cpw -r "$LDAP_PRINCIPAL"
Export the principal:
kadmin -l ext "$LDAP_PRINCIPAL"
8. Inspect and remove obsolete keytab entries
The kadmin -l ext command can append additional entries to the existing keytab. Therefore, inspect the keytab after exporting the principals:
ktutil -k /etc/krb5.keytab list
For example, the keytab can still contain des3-cbc-sha1 entries:
/etc/krb5.keytab:
Vno Type Principal Aliases
6 arcfour-hmac-md5 host/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
6 arcfour-hmac-md5 host/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
6 des3-cbc-sha1 host/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
6 aes256-cts-hmac-sha1-96 host/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
3 aes256-cts-hmac-sha1-96 ldap/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
3 arcfour-hmac-md5 ldap/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
3 des3-cbc-sha1 ldap/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
3 arcfour-hmac-md5 ldap/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
6 aes256-cts-hmac-sha1-96 host/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
6 des3-cbc-sha1 host/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
3 aes256-cts-hmac-sha1-96 ldap/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
3 des3-cbc-sha1 ldap/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
To remove all existing entries for both principals, use:
ktutil remove -p "$HOST_PRINCIPAL"
ktutil remove -p "$LDAP_PRINCIPAL"
Afterward, the keytab can be empty:
ktutil -k /etc/krb5.keytab list
Example:
/etc/krb5.keytab:
Vno Type Principal Aliases
Export the currently generated keys again:
kadmin -l ext "$HOST_PRINCIPAL"
kadmin -l ext "$LDAP_PRINCIPAL"
9. Remove remaining unwanted encryption types
After re-exporting the principals, check the keytab again:
ktutil -k /etc/krb5.keytab list
On the test system, des3-cbc-sha1 was still exported:
/etc/krb5.keytab:
Vno Type Principal Aliases
6 arcfour-hmac-md5 host/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
3 arcfour-hmac-md5 ldap/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
6 des3-cbc-sha1 host/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
6 aes256-cts-hmac-sha1-96 host/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
3 aes256-cts-hmac-sha1-96 ldap/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
3 des3-cbc-sha1 ldap/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
Remove the remaining 3DES entries explicitly:
ktutil remove -p "$HOST_PRINCIPAL" -e des3-cbc-sha1
ktutil remove -p "$LDAP_PRINCIPAL" -e des3-cbc-sha1
Verify the keytab again:
ktutil -k /etc/krb5.keytab list
The test system then contained:
/etc/krb5.keytab:
Vno Type Principal Aliases
6 arcfour-hmac-md5 host/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
3 arcfour-hmac-md5 ldap/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
6 aes256-cts-hmac-sha1-96 host/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
3 aes256-cts-hmac-sha1-96 ldap/ucs5primary.deadpool.intranet@DEADPOOL.INTRANET
Only the following encryption types should remain:
aes256-cts-hmac-sha1-96
aes128-cts-hmac-sha1-96
arcfour-hmac-md5
The following encryption types should no longer be present:
des-cbc-crc
des-cbc-md4
des-cbc-md5
des3-cbc-sha1
Note: The test output above contains AES-256 and RC4 entries but no AES-128 entries. Therefore, verify the actual keytab output on the target system instead of assuming that all configured encryption types have automatically been generated.
10. Test Kerberos functionality
Request a Kerberos ticket for Administrator:
kinit Administrator
Example:
Administrator@DEADPOOL.INTRANET's Password:
Display the Kerberos credentials cache:
klist
Example output from the test system:
Credentials cache: FILE:/tmp/krb5cc_0
Principal: Administrator@DEADPOOL.INTRANET
Destroy the credentials cache after the test:
kdestroy
Restart services or the whole system, that use the host or ldap principals.
systemctl restart slapd.service