The default value is aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 arcfour-hmac-md5 camellia256-cts-cmac camellia128-cts-cmac des-cbc-crc des-cbc-md5 des-cbc-md4, but single-DES encryption types Kdc.conf for a list of the accepted values for this tag. The list may be delimited withĬommas or whitespace. The client should request when making a TGS-REQ, in order of Identifies the supported list of session key encryption types that Realm must be specified with every Kerberos principal when default_realm Identifies the default Kerberos realm for the client. Relation is subject to parameter expansion (see below). default_keytab_name This relation specifies the default keytab name to be used byĪpplication servers such as sshd.

default_client_keytab_name This relation specifies the name of the default keytab for This relation is subject to parameterĮxpansion (see below). default_ccache_name This relation specifies the name of the default credential cache. The default value is 300 seconds, or five minutes. Library will tolerate before assuming that a Kerberos message is clockskew Sets the maximum allowable amount of clockskew in seconds that the Kerberos which interact with credential caches on the same host. Smaller valuesĬan be used for compatibility with very old implementations of Is 4, which represents the most current format. ccache_type This parameter determines the format of credential cache typesĬreated by kinit or other programs. Will request canonicalization of the client principal name, andĪnswers with different client principals than the requested canonicalize If this flag is set to true, initial ticket requests to the KDC See the kdc_req_checksum_type configuration option for the Set if backward compatibility requires a specific checksum type. This variable should be unset so the appropriateĬhecksum for the encryption key in use will be used. ap_req_checksum_type An integer which specifies the type of AP-REQ checksum to use inĪuthenticators. To true until their infrastructure adopts stronger ciphers. Users in affected environments should set this tag Value for this tag is false, which may cause authenticationįailures in existing Kerberos infrastructures that do not support In Encryption types in kdc.conf) will be filteredĭefault_tkt_enctypes, and permitted_enctypes. The libdefaults section may contain any of the following relations: allow_weak_crypto If this flag is set to false, then weak encryption types (as noted

Kerberos windows