Zurück
-
Titel
ERROR: VAS_ERR_KRB5: Kerberos error Caused by: KRB5KRB_AP_ERR_BAD_INTEGRITY (-1765328353): Decrypt integrity check failed -
Beschreibung
Authentication fails. -
Ursache
The keytab was made with bad AES entries due to QAS 4.X bug 201442, but it used RC4 entries, so it wasn't failing.
Once SAS was upgraded to 5.X, it starts using the bad AES entries.
-
Lösung
These commands make it use RC4 only, and then rotate/change the password and stores correct AES entries. In this example the keytab is QAS.keytab
sudo cp /etc/opt/quest/vas/QAS.keytab /etc/opt/quest/vas/QAS.keytab.`date +"%Y_%m_%d"
sudo /opt/quest/bin/vastool ktutil -k /etc/opt/quest/vas/QAS.keytab remove -e aes256-cts-hmac-sha1-96
sudo /opt/quest/bin/vastool ktutil -k /etc/opt/quest/vas/QAS.keytab remove -e aes128-cts-hmac-sha1-96
sudo /opt/quest/bin/vastool -u QAS/ passwd -rk /etc/opt/quest/vas/QAS.keytab
-
Änderungsanforderung
201442