Re: [squid-users] Re: Kerberos with AD

On Mon, Apr 16, 2012 at 07:05:23AM +0100, Markus Moeller wrote:
>
> BTW I would not recommend using ktpass and a user account. ktpass uses DES
> as a default which is not anymore supported by newer MS systems and
> secondly user accounts in AD have usually (depending on your AD setting) a
> password expiry which would make you keytab invalid.
>

You can choose the encryption that ktpass uses:

ktpass -princ HTTP/proxy.domain.com_at_DOMAIN.COM -mapuser proxyuser_at_DOMAIN.COM -crypto rc4-hmac-nt -pass secret -ptype KRB5_NT_SRV_HST -out file.keytab

This works fine on Win 2008 R2 servers - no problems with Win 7 machines
authenticating. What you say about using an user account is valid but
sometimes you are wedged if you want to use samba on the same machine.
For us regenerating the keytab is not onerous.

-- 
Brett Lymn
"Warning:
The information contained in this email and any attached files is
confidential to BAE Systems Australia. If you are not the intended
recipient, any use, disclosure or copying of this email or any
attachments is expressly prohibited.  If you have received this email
in error, please notify us immediately. VIRUS: Every care has been
taken to ensure this email and its attachments are virus free,
however, any loss or damage incurred in using this email is not the
sender's responsibility.  It is your responsibility to ensure virus
checks are completed before installing any data sent in this email to
your computer."