启用或禁用AES加密会导致失败并显示Kerberos错误：KDC不支持加密类型
适用场景
- ONTAP 9
- CIFS
- 密钥分发中心(KDC)
- Active Directory (AD)
问题描述
- 尝试启用/禁用AES时，命令失败：
::> vserver cifs security modify -vserver vs1 -is-aes-encryption-enabled false
Info: In order to disable CIFS AES encryption, the password for the CIFS server machine account must be reset. Enter the
username and password for the CIFS domain "NASLAB.LOCAL".
Enter your user ID: administrator
Enter your password:
Error: command failed: Password update failed. Reason: Kerberos Error: KDC has no support for encryption type.
SECD.log:
[kern_secd:info:xxx] | [xxx] info : [krb5 context xxx] Received error from KDC: -xxx/KDC has no support for encryption type<★★
[kern_secd:info:xxx] | [xxx] ERR : CIFS server could not authenticate as 'xxx@xxx': KDC has no support for encryption type (KRB5KDC_ERR_ETYPE_NOSUPP) { in getKerberosServerCredentials() at src/utils/secd_krb_utils.cpp:435 }
[kern_secd:info:xxx] | [xxx] ERR : RESULT_ERROR_KERBEROS_ETYPE_NOSUPP:7515 in getKerberosServerCredentials() at src/utils/secd_krb_utils.cpp:451
[kern_secd:info:xxx] | [xxx] ERR : RESULT_ERROR_KERBEROS_ETYPE_NOSUPP:7515 in changeMachineAccountPassword() at src/utils/secd_krb_utils.cpp:720
[kern_secd:info:xxx] | [xxx] ERR : RESULT_ERROR_KERBEROS_ETYPE_NOSUPP:7515 in secd_rpc_ad_change_password_1_svc_secd() at src/domain_services/secd_domain_services.cpp:1779
[kern_secd:info:xxx] | [xxx] debug: SecD RPC Server sending reply to RPC 5: secd_rpc_ad_change_password { in secdSendRpcResponse() at src/server/secd_rpc_server.cpp:2262 }
[kern_secd:info:xxx] | [xxx] ERR : RESULT_ERROR_CIFS_SMB_KERBEROS_ERROR:1056 in getFailureCode() at src/utils/secd_thread_task_journal.cpp:348