X-Git-Url: https://sipb.mit.edu/gitweb.cgi/wiki.git/blobdiff_plain/af58e288162d60656e92c665624558330a1ada4b..83038ab3f26a53b81b01f408ac38d49905cb12e9:/doc/kerberized-server.mdwn

diff --git a/doc/kerberized-server.mdwn b/doc/kerberized-server.mdwn
index de5879b..763f8ea 100644
--- a/doc/kerberized-server.mdwn
+++ b/doc/kerberized-server.mdwn
@@ -15,6 +15,9 @@ and then **set a new (random) key**.
     # k5srvutil change
     # k5srvutil delold
 
+Note that the `k5srvutil` command will also generate keys for the DES and RC4 ciphers, which are considered weak.
+You are strongly advised to read the "Upgrading cryptographic strength" section below on how to generate only AES keys instead.
+
 If you're using Debathena, you can install the `debathena-ssh-server-config` package to configure Kerberos authentication on the server side. If not, make sure your `/etc/ssh/sshd_config` file includes the lines
 
     GSSAPIAuthentication yes