KrbException：没有 default_tkt_enctypes 中列出的可用类型的键

Question

每次运行命令时我都会收到此执行：

kinit -k -t C:\Users\XXXX\user.keytab MYUSER

这是执行

C:\Users\XXXX>kinit -k -t C:\Users\XXXX\user.keytab MYUSER
    Exception: krb_error 0 Do not have keys of types listed in default_tkt_enctypes available; only have keys of following type:  No error
    KrbException: Do not have keys of types listed in default_tkt_enctypes available; only have keys of following type:
            at sun.security.krb5.internal.crypto.EType.getDefaults(EType.java:280)
            at sun.security.krb5.KrbAsReqBuilder.build(KrbAsReqBuilder.java:261)
            at sun.security.krb5.KrbAsReqBuilder.send(KrbAsReqBuilder.java:315)
            at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:361)
            at sun.security.krb5.internal.tools.Kinit.<init>(Kinit.java:219)
            at sun.security.krb5.internal.tools.Kinit.main(Kinit.java:113)

我的krb5.ini好像没问题！

[libdefaults]
    default_realm = XXXX.COM
    ticket_lifetime = 24h
    dns_lookup_realm = false
    dns_lookup_kdc = false
    #default_tkt_enctypes = aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
    #default_tgs_enctypes = aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
    default_tgs_enctypes = aes des3-cbc-sha1 rc4 des-cbc-md5
    default_tkt_enctypes = aes des3-cbc-sha1 rc4 des-cbc-md5
    renew_lifetime = 7d
    forwardable = true
    ticket_lifetime = 24h

[realms]
XXXX.COM = {
    admin_server = XXXX.com
    kdc = XXXX.com
  }

[domain_realm]
    xxxx.com= XXXX.COM

有什么问题吗？

Answer 1

它抱怨您在创建密钥表时使用了不兼容的算法。创建密钥表时。我通常使用 RC4-HMAC:

kutil
addent -password -p [email protected] -k 1 -e RC4-HMAC
wkt username.keytab
quit

现在可以正常使用了。