AES加密已启用、但只能看到RC4
适用场景
- ONTAP 9.11.1P6
- Active Directory （ AD ）
- Domain Controller（域控制器）(DC)
- CIFS
- Kerberos
- 高级加密标准（ AES ）
问题描述
- AES已禁用/重新启用。
aes256由ONTAP使用SECD.Log:
Fri May 12 2023 11:51:36 +02:00 info : [krb5 context 08BBA000] Creating authenticator for <vserver>$@DOMAIN.DC-AD -> cifs/dcserver.01.dc-ad@, seqnum 681759282, subkey aes256-cts/9522, session key aes256-cts/F41E
Fri Fri May 12 2023 11:51:36 +02:00 debug: Adding new SMB2 session: serverName = dcserver.01.dc-ad, Uid = 251000707354133 { in AddNewSmb2SessionToGlobalSessionsMap() at src/FrameWork/ClientInfo.cpp:2665 }
Fri May 12 2023 11:51:36 +02:00 debug: SIGNING: Signing was negotiated { in LogOnUserExtBody() at src/Actions/ActionsONTAP.cpp:2669 }
Fri May 12 2023 11:51:36 +02:00 info : Successfully authenticated with DC dcserver.01.dc-ad { in connectToDomainController() at src/connection_manager/secd_connection.cpp:261 }
- 在仅注册到的DC服务器Vserver上
RC4
PS H:\> Get-ADComputer <vserver> -properties *
...
KerberosEncryptionType : {RC4}
...
LastLogonDate : 16.05.2023 10:45:25
...
Modified : 16.05.2023 10:45:55
modifyTimeStamp : 16.05.2023 10:45:55
msDS-SupportedEncryptionTypes : 6
msDS-User-Account-Control-Computed : 0
Name : <vserver>
...
PasswordLastSet : 17.12.2019 12:56:01
...