AES暗号化を無効にしようとすると、「Kerberos Error：KDC has no support for encryption type」というエラーが表示されます。
環境
- ONTAP 9
- CIFS
問題
- AESを無効にする場合：
::> vserver cifs security modify -vserver vs1 -is-aes-encryption-enabled false
Info: In order to disable CIFS AES encryption, the password for the CIFS server machine account must be reset. Enter the
username and password for the CIFS domain "NASLAB.LOCAL".
Enter your user ID: administrator
Enter your password:
Error: command failed: Password update failed. Reason: Kerberos Error: KDC has no support for encryption type.
- SecDログ：
Fri Apr 12 2024 16:41:02 +09:00 [kern_secd:info:xxx] | [xxx] info : [krb5 context xxx] Received error from KDC: -xxx/KDC has no support for encryption type<★★
Fri Apr 12 2024 16:41:02 +09:00 [kern_secd:info:xxx] | [xxx] ERR : CIFS server could not authenticate as 'xxx@xxx': KDC has no support for encryption type (KRB5KDC_ERR_ETYPE_NOSUPP) { in getKerberosServerCredentials() at src/utils/secd_krb_utils.cpp:435 }
Fri Apr 12 2024 16:41:02 +09:00 [kern_secd:info:xxx] | [xxx] ERR : RESULT_ERROR_KERBEROS_ETYPE_NOSUPP:7515 in getKerberosServerCredentials() at src/utils/secd_krb_utils.cpp:451
Fri Apr 12 2024 16:41:02 +09:00 [kern_secd:info:xxx] | [xxx] ERR : RESULT_ERROR_KERBEROS_ETYPE_NOSUPP:7515 in changeMachineAccountPassword() at src/utils/secd_krb_utils.cpp:720
Fri Apr 12 2024 16:41:02 +09:00 [kern_secd:info:xxx] | [xxx] ERR : RESULT_ERROR_KERBEROS_ETYPE_NOSUPP:7515 in secd_rpc_ad_change_password_1_svc_secd() at src/domain_services/secd_domain_services.cpp:1779
Fri Apr 12 2024 16:41:02 +09:00 [kern_secd:info:xxx] | [xxx] debug: SecD RPC Server sending reply to RPC 5: secd_rpc_ad_change_password { in secdSendRpcResponse() at src/server/secd_rpc_server.cpp:2262 }
Fri Apr 12 2024 16:41:02 +09:00 [kern_secd:info:xxx] | [xxx] ERR : RESULT_ERROR_CIFS_SMB_KERBEROS_ERROR:1056 in getFailureCode() at src/utils/secd_thread_task_journal.cpp:348