Ubuntu VDA show unregistered on DDC with "RC4_HMAC_MD5" error
Article ID: CTX474980
Updated On:
Description
One Ubuntu VDA show unregistered on DDC Reboot cannot resolve the issue.
Error "AgentKerberosServiceAction.Run: GSSException occurred. Error: Failure unspecified at GSS-API level (Mechanism level: Encryption type RC4 with HMAC is not supported/enabled)" Show in jproxy trace
Resolution
1. Enable RCA in VDA : /etc/krb5.conf，add allow_weak_crypto = TRUE which is below [libdefaults].
OR
2.Bash Disable RC4 on AD :
OR
2.Bash Disable RC4 on AD :
- Open the Group Policy Management Console.
- Locate the target domain, and then select Default Domain Policy.
- Right-click Default Domain Policy and select Edit. The Group Policy Management Editor opens.
- Select Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options.
- Double-click Network security: Configure encryption types allowed for Kerberos.
- Clear the DES_CBC_CRC, DES_CBC_MD5, and RC4_HMAC_MD5 check boxes and select AES128_HMAC_SHA1, AES256_HMAC_SHA1, and Future encryption types.
Problem Cause
RC4_HMAC_MD5 encryption is disabled in VDA. But RC4 is enable by default on AD, when use RC4 to do Kerberos ticket ,register will fail.
Was this article helpful?
Yes
No
Powered by
