Errors with new version of Kerberos | CentOS 8

Question

Yesterday all kerberos packages on in my container builds got updated to 1.18.2-5.el8 and 1.17-18.el8 is no longer available.

This is causing some big problems on servers.

Our connections all show

Pre-authentication failed: No key table entry found for user@domain

Thanks.

score 0 · Answer 1 · answered Dec 08 '20 at 16:12

0

You upgraded to CentOS 8.3, which includes a rebased Kerberos.

To quote from the RHEL 8.3 release notes:

krb5 rebased to version 1.18.2

The krb5 packages have been upgraded to upstream version 1.18.2. Notable fixes and enhancements include:

Single- and triple-DES encryption types have been removed.

Draft 9 PKINIT has been removed as it is not needed for any of the supported versions of Active Directory.

NegoEx mechanism plug-ins are now supported.

Hostname canonicalization fallback is now supported (dns_canonicalize_hostname = fallback).

(BZ#1802334)

You didn't say what problems you are having (and you should have!). But I would guess based on experience that you still have ancient stuff in your environment that was using 3DES or DES. Of course all of that stuff should have been reconfigured, upgraded or decommissioned many years ago. Since nobody did, now is the time to do it.

answered Dec 08 '20 at 16:12

Michael Hampton

237,123
42
477
940

We didn't upgrade. Our container is locked at tag 8.2.2004 – David West Dec 08 '20 at 17:33
@DavidWest Eh? Your original post says you upgraded. – Michael Hampton Dec 08 '20 at 17:42
We didn't the whole OS. the OS version is locked. – David West Dec 08 '20 at 17:43
@DavidWest This is interesting. I just pulled the centos:centos8.2.2004 image, ran `dnf upgrade` in it, and was upgraded to 8.3. It may be time to have a chat with the CentOS container image maintainers.\ – Michael Hampton Dec 08 '20 at 18:41
That doesn’t sound like good behavior for people that need reliable systems – David West Jan 03 '21 at 17:02
Wait until you hear about what IBM is doing to CentOS (i.e. killing it off). – Michael Hampton Jan 03 '21 at 18:41
We’ve been keeping up with that news. I hope it moves us towards Canonical. – David West Jan 03 '21 at 21:14
1

I'd sooner take my chances with CentOS Stream than Canonical, but to each their own I suppose. :) – Michael Hampton Jan 03 '21 at 21:32

score 0 · Answer 2 · answered Dec 08 '20 at 17:37

0

This fixed all our problems: http://plosquare.blogspot.com/2013/01/solution-for-key-table-entry-not-found.html

Specifically we added

default_tkt_enctypes = arcfour-hmac-md5
default_tgs_enctypes = arcfour-hmac-md5

to the /etc/krb5.conf

answered Dec 08 '20 at 17:37

David West

101
4

Errors with new version of Kerberos | CentOS 8

2 Answers2

krb5 rebased to version 1.18.2