From eae33e96fcaa456830862325b91579faf2a96213 Mon Sep 17 00:00:00 2001 From: =?utf8?q?G=C3=BCnther=20Deschner?= Date: Thu, 15 Dec 2011 18:12:41 +0100 Subject: [PATCH] s3-krb5: use and request AES keys in kerberos operations. Guenther --- lib/krb5_wrap/krb5_samba.c | 6 ++++++ source3/libads/kerberos.c | 1 + source3/libads/kerberos_keytab.c | 8 +++++++- 3 files changed, 14 insertions(+), 1 deletion(-) diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c index 1a5a71010ec..8037337d6e9 100644 --- a/lib/krb5_wrap/krb5_samba.c +++ b/lib/krb5_wrap/krb5_samba.c @@ -688,6 +688,12 @@ int cli_krb5_get_ticket(TALLOC_CTX *mem_ctx, ENCTYPE_ARCFOUR_HMAC, ENCTYPE_DES_CBC_MD5, ENCTYPE_DES_CBC_CRC, +#ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96 + ENCTYPE_AES128_CTS_HMAC_SHA1_96, +#endif +#ifdef HAVE_ENCTYPE_AES256_CTS_HMAC_SHA1_96 + ENCTYPE_AES256_CTS_HMAC_SHA1_96, +#endif ENCTYPE_NULL}; initialize_krb5_error_table(); diff --git a/source3/libads/kerberos.c b/source3/libads/kerberos.c index 1093d12c2c6..fd39394ba62 100644 --- a/source3/libads/kerberos.c +++ b/source3/libads/kerberos.c @@ -870,6 +870,7 @@ bool create_local_private_krb5_conf_for_domain(const char *realm, goto done; } + /* FIXME: add aes here - gd */ file_contents = talloc_asprintf(fname, "[libdefaults]\n\tdefault_realm = %s\n" "\tdefault_tgs_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5\n" diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c index eb2603b6720..b7df50dddf5 100644 --- a/source3/libads/kerberos_keytab.c +++ b/source3/libads/kerberos_keytab.c @@ -263,9 +263,15 @@ int ads_keytab_add_entry(ADS_STRUCT *ads, const char *srvPrinc) krb5_keytab keytab = NULL; krb5_data password; krb5_kvno kvno; - krb5_enctype enctypes[4] = { + krb5_enctype enctypes[6] = { ENCTYPE_DES_CBC_CRC, ENCTYPE_DES_CBC_MD5, +#ifdef HAVE_ENCTYPE_AES128_CTS_HMAC_SHA1_96 + ENCTYPE_AES128_CTS_HMAC_SHA1_96, +#endif +#ifdef HAVE_ENCTYPE_AES256_CTS_HMAC_SHA1_96 + ENCTYPE_AES256_CTS_HMAC_SHA1_96, +#endif ENCTYPE_ARCFOUR_HMAC, 0 }; -- 2.11.4.GIT