[Samba] Exporting keytab for SPN failure

Michael A Weber
2016-09-14T17:53:02Z

> On Sep 14, 2016, at 12:23 PM, Achim Gottinger via samba <samba at
lists.samba.org> wrote:
>
>
>
> Am 14.09.2016 um 18:23 schrieb Michael A Weber:
>> Question though, just for my curiosity:
>>
>> The encryption algorithms specified after each SPN:  I see that aes-256
is listed when I export the user, but not the SPN.  Are those expected, or have
I done something wrong and used incorrect algorithms somewhere?  I recall
reading that DES is not secure enough and that AES-256 (I think I read this
during TLS enablement) is what should be used.
> I get the same behaviour here. If i do nout use the FQDN and only the
hostname without the domain part the aes keys are included. In your case
--principal HTTP/intranet.

So, now I’m a little more confused.  I’ve added the SPN to the user without the
realm part, which succeeds.  I listed it to verify, and it’s there (sanitized
here):

samba-tool spn list web-intranet-macmini
web-intranet-macmini
User CN=web-intranet-macmini,CN=Users,DC=domain2,DC=domain1,DC=tld has the
following servicePrincipalName:
	 HTTP/intranet.domain2.domain1.tld

Then, if I go to export the keytab as you have indicated above with
—principal=HTTP/intranet it errors:

samba-tool domain exportkeytab ~/intranet-macmini.keytab
--principal=HTTP/intranet
ERROR(runtime): uncaught exception - Key table entry not found
  File "/usr/lib64/python2.6/site-packages/samba/netcmd/__init__.py",
line 175, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib64/python2.6/site-packages/samba/netcmd/domain.py",
line 129, in run
    net.export_keytab(keytab=keytab, principal=principal)

Should that command work?  Or, was that for demonstration/explanation purposes
only?  I’m assuming it worked for you since you referenced my specific case.

I feel I’m missing something.

>
> The encryption methods used can be controlled with net ads enctypes.
>
> If i run (after kinit Administrator)
> net ads enctypes list dc1$
> i get
> 'dc1$' uses "msDS-SupportedEncryptionTypes": 31
(0x0000001f)
> [X] 0x00000001 DES-CBC-CRC
> [X] 0x00000002 DES-CBC-MD5
> [X] 0x00000004 RC4-HMAC
> [X] 0x00000008 AES128-CTS-HMAC-SHA1-96
> [X] 0x00000010 AES256-CTS-HMAC-SHA1-96
>

I get this as well.

> If i use
> net ads enctypes list dc1.domain.local$
> i get
> no account found with filter:
(&(objectclass=user)(sAMAccountName=dc1.domain.local$))
>

Again, I get this as well.

> Seems "samba-tool domain exportkeytab" uses an similar algorythm
and therefore does not find the account and uses des and arcfour keys per
default.
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba

Mike