Retour
-
Titre
ERROR: VAS_ERR_KRB5: Kerberos error Caused by: KRB5KRB_AP_ERR_BAD_INTEGRITY (-1765328353): Decrypt integrity check failed -
Description
Authentication fails. -
Cause
The keytab was made with bad AES entries due to QAS 4.X bug 201442, but it used RC4 entries, so it wasn't failing.
Once SAS was upgraded to 5.X, it starts using the bad AES entries.
-
Résolution
These commands make it use RC4 only, and then rotate/change the password and stores correct AES entries. In this example the keytab is QAS.keytab
sudo cp /etc/opt/quest/vas/QAS.keytab /etc/opt/quest/vas/QAS.keytab.`date +"%Y_%m_%d"
sudo /opt/quest/bin/vastool ktutil -k /etc/opt/quest/vas/QAS.keytab remove -e aes256-cts-hmac-sha1-96
sudo /opt/quest/bin/vastool ktutil -k /etc/opt/quest/vas/QAS.keytab remove -e aes128-cts-hmac-sha1-96
sudo /opt/quest/bin/vastool -u QAS/ passwd -rk /etc/opt/quest/vas/QAS.keytab
-
Demande de changement
201442