[Samba] Exporting keytab for SPN failure

Achim Gottinger
2016-09-15T08:20:23Z

Am 15.09.2016 um 09:35 schrieb Rowland Penny via samba:
> On Wed, 14 Sep 2016 16:23:27 -0500
> Michael A Weber via samba <samba at lists.samba.org> wrote:
>
>>> On Sep 14, 2016, at 2:00 PM, Achim Gottinger <achim at
ag-web.biz>
>>> wrote:
>>>
>>>
>>>
>>> Am 14.09.2016 um 20:33 schrieb Michael A Weber:
>>>>> On Sep 14, 2016, at 1:10 PM, Achim Gottinger <achim at
ag-web.biz
>>>>> <mailto:achim at ag-web.biz>> wrote:
>>>>>
>>>>>
>>>>>
>>>>> Am 14.09.2016 um 19:53 schrieb Michael A Weber:
>>>>>>> On Sep 14, 2016, at 12:23 PM, Achim Gottinger via
samba
>>>>>>> <samba at lists.samba.org <mailto:samba at
lists.samba.org>> wrote:
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> Am 14.09.2016 um 18:23 schrieb Michael A Weber:
>>>>>>>> Question though, just for my curiosity:
>>>>>>>>
>>>>>>>> The encryption algorithms specified after each
SPN:  I see
>>>>>>>> that aes-256 is listed when I export the user,
but not the
>>>>>>>> SPN.  Are those expected, or have I done
something wrong and
>>>>>>>> used incorrect algorithms somewhere?  I recall
reading that
>>>>>>>> DES is not secure enough and that AES-256 (I
think I read this
>>>>>>>> during TLS enablement) is what should be used.
>>>>>>> I get the same behaviour here. If i do nout use the
FQDN and
>>>>>>> only the hostname without the domain part the aes
keys are
>>>>>>> included. In your case --principal HTTP/intranet.
>>>>>> So, now I’m a little more confused.  I’ve added the SPN
to the
>>>>>> user without the realm part, which succeeds.  I listed
it to
>>>>>> verify, and it’s there (sanitized here):
>>>>>>
>>>>>> samba-tool spn list web-intranet-macmini
>>>>>> web-intranet-macmini
>>>>>> User
>>>>>>
CN=web-intranet-macmini,CN=Users,DC=domain2,DC=domain1,DC=tld
>>>>>> has the following servicePrincipalName:
>>>>>> HTTP/intranet.domain2.domain1.tld
>>>>>>
>>>>>> Then, if I go to export the keytab as you have
indicated above
>>>>>> with —principal=HTTP/intranet it errors:
>>>>>>
>>>>>> samba-tool domain exportkeytab
~/intranet-macmini.keytab
>>>>>> --principal=HTTP/intranet ERROR(runtime): uncaught
exception -
>>>>>> Key table entry not found File
>>>>>>
"/usr/lib64/python2.6/site-packages/samba/netcmd/__init__.py",
>>>>>> line 175, in _run return self.run(*args, **kwargs) File
>>>>>>
"/usr/lib64/python2.6/site-packages/samba/netcmd/domain.py",
>>>>>> line 129, in run net.export_keytab(keytab=keytab,
>>>>>> principal=principal)
>>>>>>
>>>>>> Should that command work?  Or, was that for
>>>>>> demonstration/explanation purposes only?  I’m assuming
it worked
>>>>>> for you since you referenced my specific case.
>>>>>>
>>>>>> I feel I’m missing something.
>>>>>>
>>>>>>> The encryption methods used can be controlled with
net ads
>>>>>>> enctypes.
>>>>>>>
>>>>>>> If i run (after kinit Administrator)
>>>>>>> net ads enctypes list dc1$
>>>>>>> i get
>>>>>>> 'dc1$' uses
"msDS-SupportedEncryptionTypes": 31 (0x0000001f)
>>>>>>> [X] 0x00000001 DES-CBC-CRC
>>>>>>> [X] 0x00000002 DES-CBC-MD5
>>>>>>> [X] 0x00000004 RC4-HMAC
>>>>>>> [X] 0x00000008 AES128-CTS-HMAC-SHA1-96
>>>>>>> [X] 0x00000010 AES256-CTS-HMAC-SHA1-96
>>>>>>>
>>>>>> I get this as well.
>>>>>>
>>>>>>> If i use
>>>>>>> net ads enctypes list dc1.domain.local$
>>>>>>> i get
>>>>>>> no account found with filter:
>>>>>>>
(&(objectclass=user)(sAMAccountName=dc1.domain.local$))
>>>>>>>
>>>>>> Again, I get this as well.
>>>>>>
>>>>>>> Seems "samba-tool domain exportkeytab"
uses an similar
>>>>>>> algorythm and therefore does not find the account
and uses des
>>>>>>> and arcfour keys per default.
>>>>>>>
>>>>>>> --
>>>>>>> To unsubscribe from this list go to the following
URL and read
>>>>>>> the instructions:
>>>>>>> https://lists.samba.org/mailman/options/samba
>>>>>>>
<https://lists.samba.org/mailman/options/samba>
>>>>>> Mike
>>>>> Try this
>>>>> net ads enctypes set web-intranet-macmini 31
>>>>>
>>>>> Afterwards "domain export" will export also aes
keys for the
>>>>> SPN's.
>>>> And, this is why I addressed you as “experts” earlier.  Indeed,
it
>>>> did!
>>>>
>>>> Now, I’m going to use ktutil to pull these into my existing
keytab
>>>> on the destination machine and begin my testing.
>>>>
>>>> Thank you tremendously (although I think we may have created
hell
>>>> for Rowland with the wiki documentation)!
>>>>
>>>> Mike
>>> I was wondering about the missing aes keys for an while. So thanks
>>> for bringing it up on the list.
>>>
>>> If an user gets created the attribute msDS-SupportedEncryptionTypes
>>> remains undefined and in this case only des and rc4 keys are
>>> exported.
>>>
>>> net ads enctypes set [hostname] [key value] can be used to define
>>> the valid keys for an accound (and it's spn's).
>>>
>>> The key value is repesented as
>>> 0x00000001 DES-CBC-CRC
>>> 0x00000002 DES-CBC-MD5
>>> 0x00000004 RC4-HMAC
>>> 0x00000008 AES128-CTS-HMAC-SHA1-96
>>> 0x00000010 AES256-CTS-HMAC-SHA1-96
>> (you mean, 0x00000016, for the last entry)
>>
>>> So using 31 enables all of them. samba-tool domain exportkeytab
>>> does always export des and rc4 keys but honours 0x8 for aes128 and
>>> 0x10 for aes256. I assume if enctypes are set to 24 for example
>>> (only aes128/256) the server will honour this and decline des and
>>> rc4 attempts.
>>>
>>>
>>>
>> That’s interesting, indeed.
>>
>> Rowland—
>>
>> This whole thing seems to me like we are duplicating the
>> functionality of the ktpass command on a Windows AD.  With that
>> command, one would need to include an encoding type, and I’m just
>> wondering if it should be included in the wiki pages as well rather
>> than trying to add it back manually after the export.  Also,
>> something tells me that the ktpass command, when creating the SPN for
>> a user, also sets the required encoding type.
>>
>> Thoughts?
>>
>> Mike
> The problem is the command 'samba-tool spn add' does just that, it
only
> adds the 'servicePrincipalName', no enctypes are mentioned.
>
> Exporting the keytab is the same, there is no mention of enctypes
>
> So, until this changes, the wiki can only document what actually
> happens.
>
> Rowland
>
Hello Rowland,

As I wrote before you can use the command

net ads enctypes set [username] 31

to convince domain export to export also the aes keys for the SPN's
assigned to [username] like it is done for [username].
If only aes keys are wanted in the keytab file unwanted keys can be
removed from the keytab file with ktutil.

See here for more info about "net ads enctypes"
https://www.mail-archive.com/cifs-protocol at lists.samba.org/msg00062.html.
It controls which encryption types are used for ticket generation on the
server.

achim~