graduate asra and medasaro

[wiki.git] / doc / kerberized-server.mdwn

diff --git a/doc/kerberized-server.mdwn b/doc/kerberized-server.mdwn
index bb36f93446d14633f08df7a96fd0b0119546a8ba..a87d552e6e33e3a94c2521a669fc6ac3588864ad 100644 (file)
--- a/doc/kerberized-server.mdwn
+++ b/doc/kerberized-server.mdwn
@@ -15,6 +15,9 @@ and then **set a new (random) key**.
     # k5srvutil change
     # k5srvutil delold
 
+Note that the `k5srvutil` command will also generate keys for the 3DES and RC4 ciphers, which are considered weak.
+You are strongly advised to read the "Upgrading cryptographic strength" section below on how to generate only AES keys instead.
+
 If you're using Debathena, you can install the `debathena-ssh-server-config` package to configure Kerberos authentication on the server side. If not, make sure your `/etc/ssh/sshd_config` file includes the lines
 
     GSSAPIAuthentication yes
@@ -44,11 +47,11 @@ To change the supported enctypes, run `kadmin`:
 
     kadmin -p daemon/kronborg.mit.edu  -k -t daemon.kronborg.keytab
 
-Then, create new keys:
+From within `kadmin`, to create new keys:
 
-    ktadd -k daemon.kronborg.keytab -e aes256-cts:normal -e aes128-cts:normal daemon/kronborg.mit.edu
+    ktadd -k daemon.kronborg.keytab -e aes256-cts:normal,aes128-cts:normal daemon/kronborg.mit.edu
 
-After all tickets currently issued against your service expire (which will happen after at most one day), you should remove the old keys from your keytab:
+After all tickets currently issued against your service expire (which will happen after at most one day), you should remove the old keys from your keytab. If there are no outstanding tickets, you can do this from within `kadmin`:
 
     ktremove -k daemon.kronborg.keytab daemon/kronborg.mit.edu old