Web lists-archives.com

Re: [Samba] samba creating keytabs... ( possible bug, can someone confirm this )




On Wed, 1 Feb 2017 14:43:52 +0100
"L.P.H. van Belle via samba" <samba@xxxxxxxxxxxxxxx> wrote:

> Hai, 
> 
>  
> 
> I noticed something strange in the keytab file on my member server. 
> 

I can confirm this, but it gets stranger ;-)

If I go into the computers object and remove any 'http' lines so that I
have this:

servicePrincipalName: HOST/DEVCLIENT
servicePrincipalName: HOST/devclient.samdom.example.com
servicePrincipalName: nfs/devclient
servicePrincipalName: nfs/devclient.samdom.example.com
servicePrincipalName: HTTP/devclient
servicePrincipalName: HTTP/devclient.samdom.example.com

If I then remove the keytab, then recreate it. I then find this in the
computers object

servicePrincipalName: HOST/DEVCLIENT
servicePrincipalName: HOST/devclient.samdom.example.com
servicePrincipalName: nfs/devclient
servicePrincipalName: nfs/devclient.samdom.example.com
servicePrincipalName: HTTP/devclient
servicePrincipalName: HTTP/devclient.samdom.example.com
servicePrincipalName: http/devclient
servicePrincipalName: http/devclient.samdom.example.com

The lowercase 'http' spn line are back!

And the relevant lines in the keytab are all lowercase:

   2 04/02/17 12:22:15 http/devclient.samdom.example.com@xxxxxxxxxxxxxxxxxx (des-cbc-crc) 
   2 04/02/17 12:22:15 http/DEVCLIENT@xxxxxxxxxxxxxxxxxx (des-cbc-crc) 
   2 04/02/17 12:22:15 http/devclient.samdom.example.com@xxxxxxxxxxxxxxxxxx (des-cbc-md5) 
   2 04/02/17 12:22:15 http/DEVCLIENT@xxxxxxxxxxxxxxxxxx (des-cbc-md5) 
   2 04/02/17 12:22:15 http/devclient.samdom.example.com@xxxxxxxxxxxxxxxxxx (aes128-cts-hmac-sha1-96) 
   2 04/02/17 12:22:15 http/DEVCLIENT@xxxxxxxxxxxxxxxxxx (aes128-cts-hmac-sha1-96) 
   2 04/02/17 12:22:15 http/devclient.samdom.example.com@xxxxxxxxxxxxxxxxxx (aes256-cts-hmac-sha1-96) 
   2 04/02/17 12:22:15 http/DEVCLIENT@xxxxxxxxxxxxxxxxxx (aes256-cts-hmac-sha1-96) 
   2 04/02/17 12:22:15 http/devclient.samdom.example.com@xxxxxxxxxxxxxxxxxx (arcfour-hmac) 
   2 04/02/17 12:22:15 http/DEVCLIENT@xxxxxxxxxxxxxxxxxx (arcfour-hmac) 

Rowland

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba