kinit: Bad encryption type while getting initial credentials

描述：RHEL 6.x主机执行kinit -kt命令报如下错误

[heboan@localhost~]$ kinit -kt heboan.keytab heboan
kinit: Bad encryption type while getting initial credentials

原因

KDC服务器正在RHEL .x主机上运行，​​RHEL .x该主机对keytab文件中的加密类型有不同的识别。
如<----行所示，两种加密类型在RHEL .x和7.x系统中都有不同的名称。这使得KDC服务器在RHEL .x主机的kinit请求中无法识别这两种加密类型.
RHEL 6x
[heboan@localhost ~]$ klist -e -kt heboan.keytab
Keytab name: FILE:heboan.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
 // :: heboan@HADOOP.COM (aes128-cts-hmac-sha1-)
 // :: heboan@HADOOP.COM (des3-cbc-sha1)
 // :: heboan@HADOOP.COM (arcfour-hmac)
 // :: heboan@HADOOP.COM (etype )  <----
 // :: heboan@HADOOP.COM (etype )  <----
 // :: heboan@HADOOP.COM (des-hmac-sha1)
 // :: heboan@HADOOP.COM (des-cbc-md5) 

RHEL 7x
[dengsc@nfjd-hadoop-test01 bash_script]$ klist -e -kt heboan.keytab
Keytab name: FILE:heboan.keytab
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
 // :: heboan@HADOOP.COM (aes128-cts-hmac-sha1-)
 // :: heboan@HADOOP.COM (des3-cbc-sha1)
 // :: heboan@HADOOP.COM (arcfour-hmac)
 // :: heboan@HADOOP.COM (camellia256-cts-cmac)   <----
 // :: heboan@HADOOP.COM (camellia128-cts-cmac)   <----
 // :: heboan@HADOOP.COM (des-hmac-sha1)
 // :: heboan@HADOOP.COM (des-cbc-md5) 

解决方案

导出密码时指定加密类型，跳过有差异的加密方法: xst -e "aes128-cts-hmac-sha1-96:normal" -k heboan.keytab heboan
注意：这样会使得之前的keytab失效，因为密码已经改成随机的了